{ "Event": { "published": true, "date": "2021-09-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-20", "timestamp": 1632182582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6f2209a1-0706-4d2c-a7f1-7504a6ce5260", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ad146a-19f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632131304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131304, "uuid": "7b9986b6-af10-41c5-b200-2cccf9912c09", "comment": "Malware payload (Formbook)", "value": "def68dfa4922d2f67cb2d012e3c39f37", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131304, "uuid": "1a5dba10-4bf4-4b52-b5f4-41b24fb9b1b0", "comment": "Malware payload (Formbook)", "value": "009976024005fe51227fe775348a66081e2d958178685929678ea0453c7e137f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131304, "uuid": "816d493f-378c-409b-936e-b46e6bb86900", "comment": "Malware payload (Formbook)", "value": "c29cdfd7f2dcd01f54c72bfd8d716a5a5cf9cf14", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131304, "uuid": "1ddfdb1d-0323-4482-b680-c5985ad89f62", "comment": "Malware payload (Formbook)", "value": "570334a0780028427171d300e45e535c4fda9c72388c20ee2bc831be1e0545f6a8ea223af6c2e0f6cc3cec3800de0a22", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131304, "uuid": "474f1754-0442-4dda-be23-83db24603f4c", "value": "T138C423F7B0E5116818838AEC051D3AF6B11035D6BE4B147E61C9B5EB5CA439F8373A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131304, "uuid": "2f8feb96-c59c-413d-a080-803af45aa97f", "value": "12288:LN1Vp/e+ZWDGEuPxW1ujDYL1m2cWSguwc9g01MFvDfLvWRwHK1ytLN:LNg+Z7TJJDYLR3u60edaRw2ytLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131304, "uuid": "77d280bd-5a54-4a44-9a6b-eee9b36cf858", "value": 582166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131304, "uuid": "459e57a7-3cc0-4920-a0a4-e6af8a66223d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131304, "uuid": "367bc31c-a02b-44ee-932e-96aef3549091", "value": "Payment Advice_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f84fb7e-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632151748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151748, "uuid": "a3c3305a-1d9c-4498-9586-5cf3d5e4dd1e", "comment": "Malware payload (Formbook)", "value": "3c1f076434b6434a7f673bf694490526", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151748, "uuid": "7ec79d41-fefe-43b5-90f1-1fa3c75041c1", "comment": "Malware payload (Formbook)", "value": "01b97b0beb53edd8d8384da80441cbd5208aaf075e12fbf90665b8121b19d4b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151748, "uuid": "056d1081-adbe-474a-99a2-13a45c862c5d", "comment": "Malware payload (Formbook)", "value": "483127a32b5d9c1993b94efbe1b9f73d3873585c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151748, "uuid": "baca9c51-ad46-43ca-8195-3c5bfa563c2b", "comment": "Malware payload (Formbook)", "value": "7dd4559f2eec0893742829419c0ba57204884f50fcb765f4f748f4125f36e14f364071ee7a7a78b2ee01218190fc726c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151748, "uuid": "397e0847-a8ff-4b5b-bba1-2d8e1bbb6c4d", "value": "T170D4F22FB3B69687E17FDD7A4E92BC27CC384C1187487019E178F6566070A189FE63A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151748, "uuid": "55018a69-6bb3-4bdd-ae08-e6deec01f16a", "value": "12288:gXMWRwYGNXcFmSxXQUfRiMEpUwEM8hIE8qCTLu/rzDgHcAAAAAAAAI/SyAAAAAAp:g7RAN6LZgp5EVIJ5mLQ+lTvp9Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151748, "uuid": "743b453f-7150-4874-8bfe-90c4fc05d455", "value": 602040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151748, "uuid": "ac216797-d89d-4188-95ae-a227c9850d56", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151748, "uuid": "a0a3dbeb-1d65-4bd3-b5b7-39734bf58219", "value": "SteelTrading-PO41636.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad852fb-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632115931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115931, "uuid": "41f9cd0b-af9d-46cd-b84f-a4cc5e03dcf7", "comment": "Malware payload (SnakeKeylogger)", "value": "5608eb2ce1099fd898937c9b810adc81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115931, "uuid": "4f8d875d-19b9-40ce-be6f-16265156d6ab", "comment": "Malware payload (SnakeKeylogger)", "value": "01f5d956a6f513317e27bc3e4225ca7af32ab3748da712a26b785de56034a291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115931, "uuid": "ee230eee-ed8d-450b-8fef-74dfa31f17df", "comment": "Malware payload (SnakeKeylogger)", "value": "3a465ce657b1b29227445c26fd3511f69b8d461f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115931, "uuid": "f8ee0ec6-837f-483a-bcf8-15968fc63e9c", "comment": "Malware payload (SnakeKeylogger)", "value": "d63deef25eed9fc5bf1038f877971fcf0483ca4eec852b602fa74c5fcd6ed2c5952b0d1f1d95ba7bb2f228f3698ec98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115931, "uuid": "c964c3c1-988d-40d9-843a-ee10798508e2", "value": "T12F159C1077FC8729E6EE2774E030469416FAFC46A67ED74E5905B8AE1EA3B418D007B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115931, "uuid": "c61d3e63-1e3b-412c-8cfc-8f9b3db5c73d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115931, "uuid": "cc8ce974-5ae1-4c59-b1b1-ec38be96efff", "value": "12288:npn/gecNU2zqX6lUB2Akequ9tBciiiCjFFBvrftEGbOwz:+DNgWUB2Akequ9Tvsj7BtEQOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115931, "uuid": "e076fda2-9878-4c5c-9b12-74f20331f820", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115931, "uuid": "a8d3d065-513f-40b1-93a1-9fbc81f93d38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115931, "uuid": "bb286e95-22c0-4c5a-b375-3f86fa441b31", "value": "5608eb2ce1099fd898937c9b810adc81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27ca62f-1a23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632150116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150116, "uuid": "302ed012-730d-4f38-80ab-dd90010d454d", "comment": "Malware payload (AgentTesla)", "value": "d2fc9b2d979f350e4dfb8b6f97fd3c85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150116, "uuid": "27fe38c0-bcd7-4269-89b1-8cd728e1c793", "comment": "Malware payload (AgentTesla)", "value": "0270c0f1e5e85d5433df5a7144c05688f10f1e25593748dd594de1578d09f543", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150116, "uuid": "4b39ba8e-799b-4ec4-b802-8d888a27f8d8", "comment": "Malware payload (AgentTesla)", "value": "c452af9eef25c9ebd701c7eb1e138980488fb2e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150116, "uuid": "625dbe14-1bfc-427e-9b4e-31238928517e", "comment": "Malware payload (AgentTesla)", "value": "156e48608f48f616f6f14593e3ca25dfb214ac75bbb4a5d6e0341adadee5e5b351360f82062e26c1ad585fcec2df42a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150116, "uuid": "f4b74cc5-2056-46dd-9049-5a17748a38af", "value": "T15B550E294E2682F7C7EEC63CD45C0FCEEB62A4837A918F0ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150116, "uuid": "04f8803b-2279-4bca-b647-c2a7933000e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150116, "uuid": "71ccdc85-7a93-41e0-a031-06f3cf0b0ba6", "value": "12288:4pP/hHvX6Ce4Hbzx7x60VJwB9SpKNOAEDQoROwgYyVY8LSmqS:4pP/ZvqCe4vx93M94wOTDQDPmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632150116, "uuid": "f1a50917-1edf-40b1-bba2-566f6df147a1", "value": 1336832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632150116, "uuid": "902c1687-2736-4255-a451-d52a7fbf751f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150116, "uuid": "1d65d3ba-b6af-4ed4-a2b8-4c2cd0584290", "value": "Vessel Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914c9a79-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632146195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146195, "uuid": "337a7905-7701-40a8-9aa3-f567ce01cab9", "comment": "Malware payload", "value": "469c251511f31030e5aef15e470eab7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146195, "uuid": "73caac3a-2fcc-463f-8a7f-6370c5d7ee13", "comment": "Malware payload", "value": "0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146195, "uuid": "9a9f6466-e01b-4124-b284-0b80642c4ffc", "comment": "Malware payload", "value": "c86339a417c19fffedb85a8b0c757b526e59f942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146195, "uuid": "c764a395-5b87-4820-838a-afa21eac6e92", "comment": "Malware payload", "value": "3cbf28ac58525535996f474cb47318907b15183af5b40883f5c3681e64a668df0a63aa9416d0bdef36bc7ef7b994e4c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146195, "uuid": "c4f3d406-ae3a-4b30-9a00-4c8a3bec923f", "value": "T1CB45E113BAD181F2F1420532543EA73BBE36B2186935CE87D3D45C685A632A1EA3F35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146195, "uuid": "d7e574c9-ccc9-4eb2-ab6b-1be62b5754a2", "value": "ddf7967f271d2def449d78bf72166fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146195, "uuid": "a8ccc0e3-c97f-44f9-9004-87bbe643c6cf", "value": "24576:e13gJnNiQQSA7Ph8/Kv9UWqPU5EDvLJPjraFLR5ROWBcIrEH7is:eWjrRKv9UTPjrkp7ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146195, "uuid": "0c08d0ff-9c22-48da-b04b-a6927e7806e9", "value": 1259183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146195, "uuid": "cde590a8-7668-4d9c-bfc4-d4588f965204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146195, "uuid": "4ee9e51f-bc1d-4cf7-bb23-4b7d93d588f5", "value": "469c251511f31030e5aef15e470eab7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a986b85-19e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632124091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124091, "uuid": "aed6270c-3cb5-4ed8-ae88-30a0e8a0094c", "comment": "Malware payload (AgentTesla)", "value": "06724497d2eed41402dc37258bb0e0ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124091, "uuid": "83785a3b-cb14-4282-8e86-6bbc7c5950e4", "comment": "Malware payload (AgentTesla)", "value": "03fb719a7db9053112d0edff2ec86e54091e0c75f9914387224754b6065c7fe7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124091, "uuid": "8862e16e-3257-4d3c-8d54-e6108110bd8b", "comment": "Malware payload (AgentTesla)", "value": "c9173fd6f85057cc8d7f4fed74cc5e916988c528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124091, "uuid": "08e68791-2adf-473d-8af0-8acdc677c27b", "comment": "Malware payload (AgentTesla)", "value": "eb132d2f934ddef407f768624cbb2b86b493f221c25f4935025f516d531bb54b807c7e9ed74568e04a1a66d8b112ca4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124091, "uuid": "f244e31f-0d3f-43e0-ac8f-c98afe5e08b5", "value": "T1706423A4C1296399E3DBFCDC512C49B963171B0F92815ADC2709996CECA4CDFF823789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124091, "uuid": "e4e22f2a-27d1-4285-bf1f-8e85631ceeec", "value": "6144:m0rA4Mgdsd94INr86HLwzEKVBufFU0eK8ICJTxT7Coc:m4Mgmq6HEzNVfEC/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632124091, "uuid": "759a8b76-9b73-4236-be5a-5cc922f47a6e", "value": 310255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632124091, "uuid": "b50c8895-6668-4635-a0f9-461a008b3571", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124091, "uuid": "e6384886-0fdc-487e-b7e3-3cfb721c5425", "value": "new order NO002984844 dated 20212009.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7960fbdc-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632146584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146584, "uuid": "258a5d81-d91b-4985-81d6-c15a6ada3a25", "comment": "Malware payload (AgentTesla)", "value": "f533fc0f879641358ed26b2bb4c731a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146584, "uuid": "763a4d9f-716d-4a05-92b6-3c873123669c", "comment": "Malware payload (AgentTesla)", "value": "047484451678a12ca602c53bad24f1462d2dd56b96fc859d0f02799da623fc1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146584, "uuid": "ff9e3cc8-2e3b-4a81-892e-f1771eaeee64", "comment": "Malware payload (AgentTesla)", "value": "080083217f107ec111b37a227af0a0e7e7bc1459", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146584, "uuid": "3f58f6d2-a1ce-4ef2-8fa1-11c4e4af9296", "comment": "Malware payload (AgentTesla)", "value": "c9127b2fdf8eeabf67297d399bc3fa970cff4d51821e3b9753ef96e4dc35e9f240ce9f7b414afdfd602a58ea4a4fbcc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146584, "uuid": "ce9541db-9236-4167-8341-2d5e934dcbb1", "value": "T16005AEC17D47D89BF4DF1AB3986FC1201164AE9D9161C73D2682BA2B65F3312309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146584, "uuid": "709fea82-eb83-4633-9c73-a9557e23e0f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146584, "uuid": "e7a94c45-b47f-4f8f-b0b4-e38cce77cb25", "value": "12288:P5MTdEy/NSsmtiK5oyZRG5GpWNNgPEXaL1Xpp3iTsK+mLu8XPkf5DEc7YmQK:hM+Fox4pagPYaL1/4+mi8XPkJWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146584, "uuid": "6f18479b-ba82-4a6c-a104-1adcad1aa937", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146584, "uuid": "eb5d9847-e596-4994-8725-ac469973f5d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146584, "uuid": "74198d8c-1b52-4a99-a89d-883df3e59b38", "value": "f533fc0f879641358ed26b2bb4c731a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5fdddb-1a11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632142109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142109, "uuid": "4a44b9c0-ce1f-4b65-88ad-938665895402", "comment": "Malware payload (Formbook)", "value": "210e1011792149ce4641de31562d9de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142109, "uuid": "cd57df0e-66d1-4d23-a49e-17ecb074ae95", "comment": "Malware payload (Formbook)", "value": "05cc84b514af3890b82bbb8645e6f2ffd63782852f7ec8f00632cae804e7b443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142109, "uuid": "388ae199-bc50-4270-82ff-08ff37a2edf3", "comment": "Malware payload (Formbook)", "value": "d010a446926df6b01c02307415d9ef26aef6d5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142109, "uuid": "4275583f-cc02-4a8c-af86-3925238b7be7", "comment": "Malware payload (Formbook)", "value": "66d04dda2ca0ee2e4a801dca732f3f8df9aaa5052a084d1feee11e2c5641cb183eaeca4e62f237994b2e16dcff1ff006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142109, "uuid": "bb180290-f2d4-40b3-bf06-0f472968025f", "value": "T18F05AEC17D47D89BF4DF2AB3986FC12011656E9E9160C73D26827A2B55F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142109, "uuid": "0a7f3a35-eb23-494c-9a47-858f14d24a79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142109, "uuid": "cc494380-1efc-4118-b61e-8afdf1f5f093", "value": "12288:Y5MTdDWfssmtiK5oyZ96RL2pK6sOblSNQlbNiMmngjwEBkWmquN:5c+FoJD6pgJDgjUHLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142109, "uuid": "8f96b04d-3933-4e04-9866-e0b153463e39", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142109, "uuid": "8e5a3282-b6cb-41f5-850b-dd1dc59e9c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142109, "uuid": "45e384ff-ca1a-4fc4-8dca-7d5b17431eb7", "value": "ordinazione d'acquisto_pdf______________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3819fa-1a48-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632165919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165919, "uuid": "5df93559-96fb-4bfc-9d0a-7f2edd256efe", "comment": "Malware payload", "value": "18a60f91367007ebfae747b9f2fa71b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165919, "uuid": "e2aaf781-f18a-4089-8037-481276329a6d", "comment": "Malware payload", "value": "05eccfb1f6f691c12b6f9b71787003dae6774a0b1dbb503a13ae419d28de2fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165919, "uuid": "49866ca1-6ba1-4c95-bae9-af3ff3624c34", "comment": "Malware payload", "value": "fcd16d6bc7e37730d30c266986ec4f076eaa2d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165919, "uuid": "acf4d0bc-0467-4ed5-b97b-997c01bec4b3", "comment": "Malware payload", "value": "a68b413b85decc2cccc243d6a4c7cebca5ca718ef4f649196d6089e87b8793c20a12f8f6dab43474c9d9e6df50b45548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165919, "uuid": "47a2bae9-8724-4373-b229-7b82fadc1ca1", "value": "T1A3A523F226A5CF10FD7C9AB21434E96416AAAC5C0925E477C1C834D6A2FF2CF9CB7191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165919, "uuid": "8770350b-4bf2-43e1-889e-f6344dd6c5c4", "value": "49152:nw26ytEITC1naiGPEUMK9YyDPZZ9RLtNXiJs:nw2t/+1nMEBvCBryO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165919, "uuid": "0ce4c084-81cf-40f4-9cf4-2e2b0e872fc0", "value": 2254848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165919, "uuid": "f499e588-5667-47e5-9abf-ba5e072eb793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165919, "uuid": "08371b8f-d642-4bba-a359-0441590d82cf", "value": "18a60f91367007ebfae747b9f2fa71b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8c07c1-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125383, "uuid": "e01d0673-e8ef-4630-a6d6-14ef3cdb8bd7", "comment": "Malware payload (Dridex)", "value": "d20d7688a78bc28b14482a19bceceda3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125383, "uuid": "3f4ad7a9-f0ed-4df6-abae-c22c7870294f", "comment": "Malware payload (Dridex)", "value": "065fde93f1d3c4c4f4805d39933f30ca44b7b41fcfab2fd02e87cbae15a1c727", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125383, "uuid": "d8140770-9233-4d29-8877-050e685d6846", "comment": "Malware payload (Dridex)", "value": "8fe08044cf6ebf372a6240f5eb5875df12305032", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125383, "uuid": "d5380867-836f-4eeb-818f-5958e9495912", "comment": "Malware payload (Dridex)", "value": "ac241a7784a24067cc37c10c97eed4af6a847590744a3f66218bab3cef3c71f0a43e48740f5086a01d64c553d10e801f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125383, "uuid": "2e5fbe38-1e2f-42c0-9d67-77b96cf055d5", "value": "T16EA5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125383, "uuid": "bf7dd376-13d4-46a8-8bdc-b1d780754f15", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125383, "uuid": "9bef6e71-88e8-48de-887e-8fe13dd5c72c", "value": "12288:GVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:bfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125383, "uuid": "542a4c1b-0109-4366-b83f-c54ddfb9a0a7", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125383, "uuid": "55a35cdb-ccea-49bb-9eff-f3a2ea8d3e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125383, "uuid": "d1c317ff-9ace-4f93-aeae-5000530667fa", "value": "065fde93f1d3c4c4f4805d39933f30ca44b7b41fcfab2fd02e87cbae15a1c727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204ecc37-1a47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632165332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165332, "uuid": "30989997-7623-47d5-84dd-0ab05711ee87", "comment": "Malware payload (Formbook)", "value": "1eaf8232051d48b6207937c971965e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165332, "uuid": "936c892e-8e9d-49da-93c8-8561475818a6", "comment": "Malware payload (Formbook)", "value": "0693c816986f73899e351e1989103e680c336f401cca1d14f5bce3b5865cfee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165332, "uuid": "f095f6ca-92ce-4143-a877-b180d14acf6e", "comment": "Malware payload (Formbook)", "value": "0e1edb9297f0b7db297be69d4aee0c3a38eb7b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165332, "uuid": "2976037c-e767-452e-85ec-87f821191345", "comment": "Malware payload (Formbook)", "value": "a168b1f567468cc45ad7c6083309a93ea484bd96edbc0647605a04a254d5dd8b7cfce7e12e30635e2dd06aa1f4bd5d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165332, "uuid": "49ec77d5-4b68-4f04-9121-8b475a693765", "value": "T15705AED13D47D89BF0DF2AB398AFC42011646D8D9161C73D26967A2B64F335230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165332, "uuid": "e96c8fc2-1eab-4579-98cc-b2e87da5bdb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165332, "uuid": "0b99c661-a673-42ff-9e1d-9210eaf9efbf", "value": "12288:H2TMsmtiK5oUZrxFonq8p3vTwKgXT8+H4tSPN9astlO8tXqyGQK:Q+Fodr1vstj8GPN9ZoqXNZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165332, "uuid": "625ac620-8046-4622-ab24-7a987a56bf68", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165332, "uuid": "bc000ae8-e786-4db8-943d-8021ef941b1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165332, "uuid": "cedfad62-ef44-44e3-8b52-fecf72b2b784", "value": "aT8aer3ybNvYpl3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e507241e-1a59-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632173393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632173393, "uuid": "10d62e7b-4335-4b6d-868b-29ce9e929d03", "comment": "Malware payload", "value": "98586f27312dac0074453e56df6f853d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632173393, "uuid": "a62ef613-2005-43f3-984d-842292122f94", "comment": "Malware payload", "value": "08dcc0cd8aa90a04708aab25c7de5b66d62b4218ef0c5d2654a24b3cef83e534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632173393, "uuid": "46340ce9-8927-49a7-99d3-5c06e08b0f55", "comment": "Malware payload", "value": "5a59f647912e2b26e4e953a6f975931a52b7488e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632173393, "uuid": "57b39f31-a07a-4c01-9f46-b726b94137cd", "comment": "Malware payload", "value": "9697ef39a16622bccec3fee7ba1befb522a91f734f2fa68b7c58bbda497b86e79e2c8021d6773007da89cab674c6dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632173393, "uuid": "c9452186-8738-49b7-b5fb-84820ae868ea", "value": "T1BE46336C6E02C003D216EA339E5C85179B4EB307C831A155DD45123AEEC6A7EDBB76B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632173393, "uuid": "e8f08a01-04bb-4ae7-bef5-587eba434a1d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632173393, "uuid": "b4ca7d50-dfbf-4044-93ec-b4a1e5f794c6", "value": "98304:y+60DjG/U5hdRjAzfkMeQ35wQ7NazNRsZ3VyB/VY9D7RovkqZzG02SGf:y+6Mj1Uf1haz7sZ3VyBdYdRikqZzG02z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632173393, "uuid": "5419cbcf-498b-4001-b008-b437d8e70ce9", "value": 5378406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632173393, "uuid": "174a2271-c33e-4b1c-b068-66d743b9ae18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632173393, "uuid": "b01df349-8ba0-4ad2-be0c-95654a949268", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aea406-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125210, "uuid": "5a06586c-1dd0-4894-94fd-94711c8cd62d", "comment": "Malware payload (Dridex)", "value": "14f3e6b808feae164a1db175d560d4b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125210, "uuid": "95b5488a-4a57-4231-8c33-912834ea65e6", "comment": "Malware payload (Dridex)", "value": "094cfea228483095f83263ff487558f3e3e315744ffdf5f900485309769efacb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125210, "uuid": "136d8133-3061-42b1-8438-cf5e7663917a", "comment": "Malware payload (Dridex)", "value": "c4cf43d79f81beb1f501bed7fb15c83fc7db1ddb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125210, "uuid": "de05ad9a-caa5-4882-a9dd-57851f04bdf3", "comment": "Malware payload (Dridex)", "value": "37eb026bca7b08d307a0d64480a222e6dbd3bd05850f4f739ad00d57490c3d27e6aaeeea27c165590fc4662942d1fe8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125210, "uuid": "4ecd5d9b-c31f-4de6-bf8e-d3fe327c7220", "value": "T1F8A5E120EE69E1E6C6B99F3E940835231BB93D75110D609CC391604F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125210, "uuid": "a997013f-fbe0-41c2-bf6c-c97c18945bb1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125210, "uuid": "921ff5ca-b497-4c3a-8442-5c82723534e5", "value": "12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125210, "uuid": "a959a838-4b6b-4857-8c94-e5d0064bfdde", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125210, "uuid": "dffa73da-a0ca-4f49-ba85-2f093861d81a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125210, "uuid": "6006b400-42b6-4d8c-b8f4-31b3f5444c38", "value": "094cfea228483095f83263ff487558f3e3e315744ffdf5f900485309769efacb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a7e2ba-1a38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632158845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158845, "uuid": "b012a030-2789-48bd-9e8d-93c98d0c2cb1", "comment": "Malware payload (Quakbot)", "value": "944db2ee2b1958a2740d0b5c0057c46f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158845, "uuid": "cb09a175-032f-493f-899a-b06195c79d34", "comment": "Malware payload (Quakbot)", "value": "095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158845, "uuid": "4ecbf1e3-d0c2-42d9-89e6-2f733401d600", "comment": "Malware payload (Quakbot)", "value": "b0804ed04064aed6c9b283629b3416b5aeac84fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158845, "uuid": "9bd0e57f-928e-478b-8b90-44ce9eb5c9b4", "comment": "Malware payload (Quakbot)", "value": "057cbd1349b7e1add8b8c32d0de176bd53435d25da21f31a0b10b1c56de66946ff761f27aaf7d0b4be538c8dd46019b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158845, "uuid": "52c39f57-38b4-41a6-8c35-fb31857f94e3", "value": "T19605D02A7ED6E191C83C5D7988E1C8E67238BC686D28961739E53F3F29F30D1584909F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158845, "uuid": "ee004b84-f8b3-49a6-ac40-ee99dd44c906", "value": "fcecb109cd51f9ec6659a40269cd21c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158845, "uuid": "29e7a72d-74e1-4c0b-86c4-e778989d5001", "value": "12288:s0ySZOB93YJh6kwi4eYHc+12GPUhW1brsZCesX/OkSAIV5TQi/c+FI2PXmkp5:s0yiQFViB7IOcesPIVVZQi/csIrk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632158845, "uuid": "c89ef495-8b57-4836-98a3-05c791dfac34", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632158845, "uuid": "4ba5959d-8d9f-4682-9df2-9f26b21099e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158845, "uuid": "ada6c09a-3493-4c74-81c8-3e1d867fb3da", "value": "944db2ee2b1958a2740d0b5c0057c46f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca69f131-19ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632099475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099475, "uuid": "e0514597-7a64-484d-98cd-6474f8442486", "comment": "Malware payload", "value": "884d66f9b2674168bdcb7363bb335e8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099475, "uuid": "e3324248-3e68-4eb7-8e9c-23f6c8bc2bde", "comment": "Malware payload", "value": "09a0d1d21b35a15cac1bdf2a7a5f1705046f48e0b64b3882b12bea1bf53f2495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099475, "uuid": "541b0c16-a300-4d49-ac0c-adb9d04055b3", "comment": "Malware payload", "value": "f06be6acf264d780d53b4d91fdbf9ec41183b4eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099475, "uuid": "a48b873b-f1ed-4d0f-b245-100198e82944", "comment": "Malware payload", "value": "ffc6081a3ce2e458dacfcbf527be0bf0a4f0c55e9e5d97021deeb5f8109d32ceb75a19982555836470060873eaee0a41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099475, "uuid": "bf1e5b00-2632-4bcc-8d07-2f7da4477e32", "value": "T13A14ADD13AE0D871C5851C748824FBF45ABAF971CAA4828777B83B6F6E703F01626316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099475, "uuid": "3b482ad8-d937-44ff-9ee5-ddb03bad3c39", "value": "416df6c419e4b5b7e3749608d7e85fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099475, "uuid": "27dde66f-3218-44f7-8b9e-986ef5019444", "value": "3072:L1WLLLZXjrUgNWyN8eqaYjd5nwyOQsWvBdM4K9Kr9ZT3OqOS:QLLlPUuWyjYcM3M4brDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632099475, "uuid": "595486ad-f813-4cba-a260-797c4677005c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632099475, "uuid": "98fb941d-0e98-43df-ae87-04cc0549ead3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099475, "uuid": "a5068c9a-c89a-485e-84e1-564e5a19f9d2", "value": "884d66f9b2674168bdcb7363bb335e8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfe1e37-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632137463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137463, "uuid": "a5369036-f3af-4283-bd11-7c2251847650", "comment": "Malware payload (AgentTesla)", "value": "1684b303a9a2d39f14e72b4e7f37a9d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137463, "uuid": "83d06ee7-8414-460a-a01a-f66e274f6d72", "comment": "Malware payload (AgentTesla)", "value": "09b713a9013fba2283184af4816e244803baf5f42edc4d0ea9cdeb0c53acc61e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137463, "uuid": "9353e98d-17cb-41b6-964c-361e0be9a2cb", "comment": "Malware payload (AgentTesla)", "value": "976fe6e0186ea366f670e410f967d1c925dd1abe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137463, "uuid": "01351032-3c96-48c3-aa46-d626275766fd", "comment": "Malware payload (AgentTesla)", "value": "3f7acb63b1f4f00fd6d4a013d7e9eb941bcd8af12e4049763678122168f9aee688f5480080be1d1bced15c4de4d36fe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137463, "uuid": "0d2e673a-438c-4af2-b787-78212d46eec4", "value": "T1DAD4238D84714E95F81BAA0FAC9BE281A75E4C818115B46DCBA760CA060F7CFC75F4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137463, "uuid": "162c4e77-4a78-469e-9834-5a7bf546cd94", "value": "12288:Vy4l3s/kpgMMULN9qlA1IP0Dj0J1OKiw2Ez9BTNXtWhuWnBUo8tkOL8jgd0AH:V/30MhhR1OOPw2QhF4YoBett4geAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137463, "uuid": "2b13d4d7-fa41-49af-bf78-1e4f38dc57de", "value": 640586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137463, "uuid": "a38fa5bc-0380-44c9-ad42-c78340f1cb41", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137463, "uuid": "99b12120-176f-4aa4-bb49-42a456c202b6", "value": "DOC.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4348a6fd-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632138762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138762, "uuid": "f8d81a30-0596-4c70-b64e-12aec4e1bc23", "comment": "Malware payload", "value": "8dc65f01877c83e9aff70e73dd17c02e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138762, "uuid": "f177a053-0f4b-4d34-a066-a079828cb98c", "comment": "Malware payload", "value": "0a0856f946e474e517af7eddb56a74a8b36fbd29ba1549c21d5a49f52a3f6178", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138762, "uuid": "e8dce384-5230-4613-ab8f-984329f9a302", "comment": "Malware payload", "value": "a0953f005026ba6ef40b09393f6d20382afe3a8b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138762, "uuid": "fe2be8d6-558a-422a-891b-ee51fed29ca6", "comment": "Malware payload", "value": "6b04feccad9d9ada6a10f361a1b5dfad541fd3139e1e642f4d0fc5674c8ba54bca55f45279887721713aa85b38239928", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138762, "uuid": "4500bd61-abc3-4c32-b0a2-212e1d0183d7", "value": "T1A5D4F1E26F9CFF4FD8518DFD42BFA0865254EDB58E89C91506C072AB0EF79370029A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138762, "uuid": "d6a52aba-7706-423d-b38f-c5804f4acc4c", "value": "12288:D/9+vZ0QkvnUcuWHPEsWUYt5YIbHjz3pKmMe5L:b9+vOQBcxHNofzpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138762, "uuid": "f77efcf1-3fac-44a0-b375-b97477733b9b", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138762, "uuid": "b057957e-d647-4d9a-a0bd-1f9ca972ea33", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138762, "uuid": "12e2f84b-a70d-4a58-8414-673462e13147", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48626eef-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632148649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148649, "uuid": "fc0939fa-6c1b-4222-a39e-558422b790bc", "comment": "Malware payload (AgentTesla)", "value": "cd0cc9fd2478f71f5b408bb28109cf79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148649, "uuid": "8d874a43-b6e8-4614-8edc-4cba2ef0e428", "comment": "Malware payload (AgentTesla)", "value": "0a8b98d0de78978e2493c8634a1143d51a9ff5b8684389745753d0f5c244cc37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148649, "uuid": "bf5e9504-4493-47fa-834a-581334ee18d3", "comment": "Malware payload (AgentTesla)", "value": "0b7b37f97912eae77d7bdbb2dcc83b58e83a35dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148649, "uuid": "d1f14fa7-c2ea-4f9d-8e31-0d35688f4559", "comment": "Malware payload (AgentTesla)", "value": "16f7ca2d59c609217c1cddaa915ec11a0514b3b2d545037e6bb0b0c5f2d84237ffe97edcd02c739bd121f757af25ba5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148649, "uuid": "8ebadbf8-7b1f-4906-a9a7-1fde8b27b8f0", "value": "T1AC73BF10B70BA924D4341F7248B9E3C60376D389A5278B5E349E153EEFA279F07A0BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148649, "uuid": "29fd3ae4-ce8f-4f0d-963f-98f390a576aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148649, "uuid": "ad215b93-6605-46ea-88b9-a9021122c845", "value": "1536:H/n5S0Cy74CT3TrYz6vDpMQ43+41xPNfadf:f5S0h0CTXYmvFMQ4b1Lfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148649, "uuid": "660dba30-660a-4073-acde-03f1259b60b0", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148649, "uuid": "b8fc0160-a1a9-495e-a723-baa358a7d45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148649, "uuid": "10264838-c642-4914-976c-f0ce686360d4", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ca85bc-1a03-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632136265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136265, "uuid": "26122085-c29a-4abf-9d1b-3bcf70a0a416", "comment": "Malware payload (Loki)", "value": "c503e307341f2a94c5cd6e0cc3160647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136265, "uuid": "89a9620e-1470-4310-bfa1-6469198e24b9", "comment": "Malware payload (Loki)", "value": "0bb97dce40fb704d418bf56eaac0d0d8a62457920f57f20474d1b05a6e8bcf36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136265, "uuid": "2da522f4-f15d-43a2-8919-06d2af4a1831", "comment": "Malware payload (Loki)", "value": "9d1de8a1371dead41e6d7bf7fc203e022397bfa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136265, "uuid": "bb0c409d-3e88-44a1-b987-9f672abf25d7", "comment": "Malware payload (Loki)", "value": "974fa488d5dcf33d67178eb9748b0c6af6529942d106b74d261f734e53d99b52d3dfe6ea0cbf9c8573530d2ef0c5a0e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136265, "uuid": "3d912ef8-6f2e-41a8-bae8-2c665b669359", "value": "T15F941215A2945536E0B38F3CCC5A13A6E47F3832193AA84FF5542D198D7E3E3271DA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136265, "uuid": "8c95878a-3095-4bee-996d-55de116cd285", "value": "a391fda099714b955a3102eda9e0c1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136265, "uuid": "4df64a3d-c499-43ae-a98c-e2bca738f7a7", "value": "6144:d+BfhH6Avgk3YuJamgkkI4Iev2JGEhb8XnYTq6h70riHD2uxgWQlMSzYvoCYms93:dIDvpzad/V2lgXn0gSD0hXyteAePRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632136265, "uuid": "a71c4652-34ad-4bc7-90af-e8b04b349cea", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632136265, "uuid": "6cd5541f-b5c3-4353-82f0-ae8219365e7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136265, "uuid": "de83794d-027c-4f61-b8e2-e0b7d596f519", "value": "0BB97DCE40FB704D418BF56EAAC0D0D8A62457920F57F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacd8393-19c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632111556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111556, "uuid": "94948567-5eab-4fba-9d21-898a29738336", "comment": "Malware payload (CryptBot)", "value": "a72129e2dcf6d368358439f2350a4c16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111556, "uuid": "5ad5f66d-0c7e-4219-9a9c-655200ec7e90", "comment": "Malware payload (CryptBot)", "value": "0c6ecad78e1bc58b9a1ed69852ec543cd18ec3819121c0fdca6134267b42da8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111556, "uuid": "88de65be-cfee-422e-9354-7b943e9fc7b5", "comment": "Malware payload (CryptBot)", "value": "9739a6d3e84e9b252c66ddf06310661a60c467c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111556, "uuid": "81186dc9-317d-4dc4-9329-97e39e3e22e6", "comment": "Malware payload (CryptBot)", "value": "e7a76c7a1ebad883ab7d541399ca70ab7b3eaa2b3750cdb6fcd12f9555a0ef56a754861af0e278064a4ef664812277e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111556, "uuid": "9e94a5a2-2ca8-442b-bc60-26e8e08fd9e6", "value": "T1C274BF20B6E0C035F5FB12F819B987A8A93D7AB15B3490CB62D516FE66346E4DD30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111556, "uuid": "1d81ced5-c100-43de-be5c-dd1afe79d81a", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111556, "uuid": "b7f98ba5-34ff-41f4-821d-dc0dbd975d24", "value": "6144:ozZQJhmHzjkjoE7qi7d/nSeWQhhM8cgQVMv5vT6fC0eBxHGnzhPek/bA+:wZ7HzjkjoEWy/nX3hXZQ6p6yxmFPekT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111556, "uuid": "796414c9-a30a-43c3-a37c-eecbd0254423", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111556, "uuid": "c1a2fba0-372c-4fbc-a78b-f9ae7b6c9f81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111556, "uuid": "0facb673-b698-498a-b4b9-a2d670b58b23", "value": "a72129e2dcf6d368358439f2350a4c16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbdd608-19c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632110349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110349, "uuid": "f51a8b76-03dc-4fa0-b01d-cdc35181d067", "comment": "Malware payload (AgentTesla)", "value": "6b3f2749a99af96728d9f6b8c8719e69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110349, "uuid": "20ed20c4-be89-4944-b1f0-9cd513b91661", "comment": "Malware payload (AgentTesla)", "value": "0ce0a82bef3a8852e9cd21fa303880fe34243a8bf8940384a8303da6b4677a2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110349, "uuid": "4b31fbfb-de80-4596-911c-cc3d79f39b23", "comment": "Malware payload (AgentTesla)", "value": "5cec1f3f23a0498084ad0c84076917f13b382277", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110349, "uuid": "735e5404-6573-42d8-b647-6f9c8573acd5", "comment": "Malware payload (AgentTesla)", "value": "1fd59ba608b12dcb1dc151df874436fb0248b67ec6c8ee37b8476da5e867290639776f9354037492d32af532c4c2b21a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110349, "uuid": "fc490314-a570-4c5c-bceb-7c75166ba90e", "value": "T17715D0202264C26AF1FBF738D4729471873EFA86A026D99A5DC3D8DA0D35341C51BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110349, "uuid": "254983e2-92f4-487a-8dc4-5f5e254e2246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110349, "uuid": "74ce5b89-3a96-4018-b841-06a10c9b1829", "value": "24576:gA6DFuN6YP4/8iyv85i2ZyvqmjF+FoAj:yDFuYa4/5gScp6oAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632110349, "uuid": "b65c68d8-15c6-4dbf-8e38-d0bf629503c9", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632110349, "uuid": "c3745435-5f53-42ee-b835-7e3d5b71779b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110349, "uuid": "f1789854-f785-4743-a09f-5f7f79c3a1fc", "value": "RFQ.Order 0128-44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb3b9f6-19cd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632113012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113012, "uuid": "81a9bc4e-c21d-4ed4-a8c2-178fb59ccc54", "comment": "Malware payload (AgentTesla)", "value": "da766386190f034e7441eb6f90e40d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113012, "uuid": "fe9bd5cf-19b6-4940-8abf-e898e70d59f6", "comment": "Malware payload (AgentTesla)", "value": "0da1306ca75347a4387079465ef83befc5027ca4943c08024504175da47301af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113012, "uuid": "38c31d0f-cc05-4eac-9ea2-e1e907c53f54", "comment": "Malware payload (AgentTesla)", "value": "2ba80b55532dfd090aaea137638d6a465c3c4bec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113012, "uuid": "e51986b2-7424-49fc-a682-8e4337f30f0c", "comment": "Malware payload (AgentTesla)", "value": "8e14f621a0574debe6556f55a867a6d7bfd92cd97690eb0be8c6c729629f5f7a38a6a7e83c1b2ff2c4988081e906aab2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113012, "uuid": "11efed25-4eb4-48ff-b70b-d4bf8f76e4c9", "value": "T178E47B063398CF21C11F15B6D8A2C2F81327BE41DD449BDB76C9FF1A39B32A66951583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113012, "uuid": "a538bf91-6cc1-4800-85a0-a191b0d7533c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113012, "uuid": "58b6ce3f-852d-441f-8553-45ea6800694f", "value": "6144:gbOZAe6+wKx5PREHXg4XRBe/3ODL1KcANemXbUGFPw8:TzfrxFRAXhi/k1QemXbUkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632113012, "uuid": "2cba0219-b901-48fd-8b98-6c628e2bc43b", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632113012, "uuid": "051e6e68-ab3b-4fa3-995f-5f274116a0d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113012, "uuid": "e864a1f2-9f3e-4b75-8843-7b15c28611ce", "value": "2021091800983746_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9885e5-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632146318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146318, "uuid": "39dffc96-5df9-41f4-b5a1-7ed9a78c577f", "comment": "Malware payload (Loki)", "value": "3bcf9f3ba357860a4d1bd73c93802ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146318, "uuid": "dbc9d78a-0f31-4354-9d11-e5301a9fe281", "comment": "Malware payload (Loki)", "value": "0dc6ac9a0255d8c726ea77ff4a7298ecc14552790389259c841e9da27c46e540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146318, "uuid": "1f000ac2-5355-4633-91cd-fc185dd4f6e9", "comment": "Malware payload (Loki)", "value": "af7f0e519116cfcc8c04aff5b637a95f293b661d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146318, "uuid": "901427ae-8220-4fc0-88fe-751ab7321761", "comment": "Malware payload (Loki)", "value": "3699a6c4ab5bb0462694f7d216972ed3889a0235ecf722f040d0fd305a95c32bda5309b8d8dc5a69139439ff37bb5a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146318, "uuid": "44788f72-14bd-4159-8540-34ba8697abc9", "value": "T11C441252249040F7E1F38930893AF77FFB7AE6580165528B8B7C2DFB3934EC2664A156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146318, "uuid": "0fd43f5c-73f7-4e3d-ac9e-419d7dae96b3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146318, "uuid": "20e91662-d129-4d9d-a007-422da8da867f", "value": "6144:Z8LxBnBRIjc5cwXF63iIi8fO1szmSfitntIMjR:EBRJ5cwcjO1wmE6GOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146318, "uuid": "44ddd83c-51ce-4ee3-bccb-202998de3ea8", "value": 258095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146318, "uuid": "da088228-2a9b-48aa-9508-ad98276238d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146318, "uuid": "d94f5f88-46a1-47b1-82bc-c44cd2867554", "value": "3bcf9f3ba357860a4d1bd73c93802ceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358cbd97-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632143464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143464, "uuid": "3a3709fe-90b0-477e-b009-24b604ecbf3c", "comment": "Malware payload (RaccoonStealer)", "value": "70d89cc2e50b67f9a9e2abdb36322079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143464, "uuid": "f6acdc43-c7b9-440f-a333-5635d7e3a7d9", "comment": "Malware payload (RaccoonStealer)", "value": "0eb895702062cc36d3e1558a08af9e6d5b3a12f838a2ec4566d2ac3671068151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143464, "uuid": "a640f0bb-50c1-4d2d-ac26-21d75e000e0a", "comment": "Malware payload (RaccoonStealer)", "value": "24cd43dd31615171987214da289078ffee10cb23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143464, "uuid": "973813a1-b811-4aa4-8983-a796bfcfcb7f", "comment": "Malware payload (RaccoonStealer)", "value": "576a924031d1b75a6ff9e71fc36d07c5afe69dd17b10466bc3a170b5ca42fd2e5e8c9dc3cb0709bce55ec83a272f9f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143464, "uuid": "1f6a29d4-e380-43e6-b3ec-c069c2b5a779", "value": "T17CB4D030A6A0C035E5B712F489B793A9A93F7E716B7450CB62D226EE36347E49D30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143464, "uuid": "eb57b959-bb43-417f-822c-dde0fc726249", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143464, "uuid": "11c8c59c-0746-4aa2-9c7b-f4637c2cb363", "value": "12288:nU5wKlwmr7PuRCeLvrDMEtLF/M1EIMa776LF35ISDGETYuJFY:n5KRryRhzrDMcFEd17SF35IIGEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143464, "uuid": "3f6f1165-5172-49c4-b2a7-2aa58e13976e", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143464, "uuid": "1e04cf73-0c06-4f61-857a-678db7f3e1e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143464, "uuid": "91a9dd9a-e416-4263-b827-c5e5ba14897b", "value": "70d89cc2e50b67f9a9e2abdb36322079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaaf1c6-19f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632131262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131262, "uuid": "2a3df0d2-09a0-4a2b-a861-6bcb3843f881", "comment": "Malware payload (AgentTesla)", "value": "fda43c5bb0663be23b0a309c74962da7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131262, "uuid": "e467a317-4ff0-46ea-a460-5c049e274ae9", "comment": "Malware payload (AgentTesla)", "value": "0ee61c1a15ade22d814036403466e28fb53e30885e62d61353828816a7ae06f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131262, "uuid": "eccf4182-a765-4d47-9a3f-8cdf719331f0", "comment": "Malware payload (AgentTesla)", "value": "30ccad8d168bc94469a5357f094619a75ce6bf84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131262, "uuid": "7580b7fd-0efe-439d-8aec-1ea75190e835", "comment": "Malware payload (AgentTesla)", "value": "89537c2f36f1440670e78c9275120ee38022e6240faecf95e3b6b3f0470b3fb3f0d4b3029d8c147560134b5491f29238", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131262, "uuid": "2e1bb8f0-9711-4020-aeef-5c8c9800b93f", "value": "T104A423C1527287F0BA0A052D3267D47709AA4498FD9C527D8F27E1E2AFD324A13997CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131262, "uuid": "a225e7da-2d69-49b2-ace5-abf62b5f8d4c", "value": "12288:J6md1PsIcsI48126/sYQABO4i7p7FZQnJAe4Azz+K:T0IcsIjY6K54ilQnCtAzaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131262, "uuid": "4dc4a7a5-c5cd-4df6-923d-a6555a9eb34b", "value": 477540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131262, "uuid": "b267be9e-8064-4fb5-9b16-4cc0a462ee8a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131262, "uuid": "ac5538b1-5e32-4654-b194-59aee630758f", "value": "4023- (BC draft for PO67282.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b6c6d8-1a48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632165930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165930, "uuid": "6438079a-f7bf-44c0-bf2a-b8f06347fc64", "comment": "Malware payload (AgentTesla)", "value": "4e2e9f752d0cf2a0bf4a31d03b05e3d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165930, "uuid": "df4f1a8c-f36b-4fa6-96ab-8f27d62cb5fe", "comment": "Malware payload (AgentTesla)", "value": "0f2e8543de737b222739c606ca2742ebdd3701e7c259d49ec6e2745ada7cf4a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165930, "uuid": "79294c38-08cb-4ce9-b3af-4305d8d75c34", "comment": "Malware payload (AgentTesla)", "value": "dd713e7f0122c04928c68723861f8af41de0da8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165930, "uuid": "de80a78c-5899-421d-ba0e-556e76d0092e", "comment": "Malware payload (AgentTesla)", "value": "7d5021087ea0104ac00a721f4df2561b5c0a0c1b43b7dcc8000cce59f26e5374b459944ec75ed952470ec66143140627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165930, "uuid": "aa42b85f-71f0-42dc-86a2-6f1933aeefac", "value": "T15005ADC17D47D89BF4DF2AB3986FC4201165AE8D9161C73D2692BA2B55F3302309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165930, "uuid": "28b98320-e608-478f-8d49-6ef69b46cad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165930, "uuid": "18fc0244-c4aa-4562-8dae-52e8afefcbe0", "value": "12288:G5MTdjW4fHsmtiK5oyZMNKnw/S1l+69MBM87gFCHkEQPF4ifKqSt:Hu+FodNKwK1lRM687VkXd40Kft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165930, "uuid": "2139c92b-ce93-4e75-8a98-bef79cd63815", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165930, "uuid": "7ca1da61-7816-45a5-abca-ac990ea54d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165930, "uuid": "fe6599bb-e55e-4551-848f-31f7424bb62a", "value": "4e2e9f752d0cf2a0bf4a31d03b05e3d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb54d132-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125220, "uuid": "0ebc1e2f-4a1d-43a0-b296-7a92a24f6084", "comment": "Malware payload (Dridex)", "value": "5e73f289f58c3ea392f118d17560aa57", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125220, "uuid": "0e42d4ee-cd9e-4974-97a8-ae378ed405a8", "comment": "Malware payload (Dridex)", "value": "10da3665cfc386036e93f12513f2f29f35b9931ac5fc2335447f8a5c74264793", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125220, "uuid": "77e38fa3-d21c-4fa5-a7fc-561f2ddf5182", "comment": "Malware payload (Dridex)", "value": "413febc2013244386b589d85f57f3247012fb874", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125220, "uuid": "20d4f26b-a567-4be0-b395-30874ed082d8", "comment": "Malware payload (Dridex)", "value": "350416e8c29035f147a8a037f3c42f1158f21ac40246a09fe609aa020312891a48e41ac2800028a6a074ab3480bf832d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125220, "uuid": "ab1ab20b-699c-4a5b-996c-9f88347f7df9", "value": "T197A5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125220, "uuid": "9dca2310-8a47-4957-9b61-43be6bf52a46", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125220, "uuid": "73a4807c-6c65-469d-ac90-dd398f736c12", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125220, "uuid": "12b5d2c0-d57b-41c5-b84f-b8fd9542e7ca", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125220, "uuid": "87693314-0576-45f8-927b-74e304423d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125220, "uuid": "b839353f-713b-4430-b839-11ce9571660b", "value": "10da3665cfc386036e93f12513f2f29f35b9931ac5fc2335447f8a5c74264793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50c05b2-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Neshta)", "timestamp": 1632151945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151945, "uuid": "10653de9-8508-42b2-a36d-fa0f3fa8a2d2", "comment": "Malware payload (Neshta)", "value": "6081759506cc8cc4aade4e617b019a1d", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151945, "uuid": "8884669c-f345-473b-9177-dfaa3371182f", "comment": "Malware payload (Neshta)", "value": "115a683b3b8b8b83c691c3fc65ce2e72db2525db43bd27296ee54e967fe386c6", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151945, "uuid": "18e5be3e-fd50-4117-a2d1-68db63ad4cfe", "comment": "Malware payload (Neshta)", "value": "25157cf5fac85a628ad9e60196714623040576d9", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151945, "uuid": "eb68a520-444a-44fe-a0e2-dfe2706acd39", "comment": "Malware payload (Neshta)", "value": "9bce6f00a067418072b2427391f5d728a27f7544b6cb377565ce082af9021b6bf366d8ca75ed5c3b13bb4b6a765e8f96", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151945, "uuid": "18c9b3cc-3d32-42a1-8725-b16c82d849f0", "value": "T1E584C0F227B2D518D30206B25E56C053E35ECE3967548A950CD8FD6BFFF22182A8D639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151945, "uuid": "1228d482-e298-431a-abbf-52f507911cd7", "value": "6144:aXOvZDlt941bolyx27Jg8aq6S4mWrdyylQVOIvtIPB9ikvCTnTsX1DV35gkCdO1:SOvZDlY8aq2NrPlQUDSkvCvsX1xp041", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151945, "uuid": "ebc10aa1-5c23-4289-b975-1742e7d8a9cb", "value": 372200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151945, "uuid": "10088cd6-922e-4ea9-95e8-6a3fc15f35bb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151945, "uuid": "e20ca178-3c76-4292-b4c6-2ee8689d4354", "value": "Request for Quotation - P75(D53 )- FATP- RF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e547332-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125493, "uuid": "1d187336-f409-4f22-89d8-86068366b8cd", "comment": "Malware payload (Dridex)", "value": "da5ff39340874543d13e7b7f32169f2b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125493, "uuid": "f70ae246-835d-4ad2-b313-33f57a3253ed", "comment": "Malware payload (Dridex)", "value": "119aaa3f5e64afff57f50b3813d2023ab4df9d093c5a50bc757d2b0eded743f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125493, "uuid": "e1333ecf-0618-4e44-92a2-e1cf88e1c207", "comment": "Malware payload (Dridex)", "value": "066e15bad04df2aa33e61a8c090efbe1f7bf0de5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125493, "uuid": "cc30fb6d-bd15-418d-bc27-3ddb942699bc", "comment": "Malware payload (Dridex)", "value": "5e06ba97f3db5664fd4902360227ed6e0fb5f0c34be8a7cc9364ead47cd1efbacf26543435268de967a218fd9be5306c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125493, "uuid": "a4a8b380-cdb1-42a6-a2dd-232b06618a2f", "value": "T17695D010FE69EDE6C6B99F3E9408352317B93D74130D618CC392604F6EF82546E3E99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125493, "uuid": "1ab9d317-f689-4c22-b6d3-d74fd1ceea4c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125493, "uuid": "342d1777-06fb-46fc-8a08-99a10535558d", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125493, "uuid": "d94ecfe5-2fe5-4907-aba6-acfb18d98f32", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125493, "uuid": "fff32521-2c9e-4ffd-9800-d1c60094d533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125493, "uuid": "edbe1911-e4d2-4c60-8018-492c3cf7a7c6", "value": "119aaa3f5e64afff57f50b3813d2023ab4df9d093c5a50bc757d2b0eded743f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e3ff02-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632151873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151873, "uuid": "50812566-8a26-49bd-a176-1c6b2960ff3c", "comment": "Malware payload (GuLoader)", "value": "5e6ada0c527fc1bd3b5238b32ff09e14", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151873, "uuid": "978ee8f6-71f8-4a51-983f-fca1bffc56d8", "comment": "Malware payload (GuLoader)", "value": "11fab8af9ce7779077bead5f3b85b3ef485f367cc7e88f009a9698b3e75671c2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151873, "uuid": "e89a7736-39b3-4911-b27e-4632be247474", "comment": "Malware payload (GuLoader)", "value": "807c4107e7204e80b6206bd31296dfdd7473e9de", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151873, "uuid": "0b6003b8-8dfe-4807-b0be-89488fc41125", "comment": "Malware payload (GuLoader)", "value": "29b0c1b93b5fbf99d888c181169af4a8f3e82266d947e4faa1ed5c623642395ac507f8975161f3109f26b505b2b468d9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151873, "uuid": "26ff83fe-77b5-40c3-a97c-bd3d1111c673", "value": "T107D4F17175899E49DF4D287B82E0EE61CC27AC29EF06486A5B6870F84075F73891F8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151873, "uuid": "0f7e0503-d153-4d1d-95f2-44d7ee759623", "value": "12288:IOwkXSpIlVRVexKhWkOSOSxGjMc4K5gzQOpblb8XbvgEi8ODMKsyqq:XwzybSSOS0Mcd5gzbpbKbdIcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151873, "uuid": "3078ff68-623b-4903-835b-0aa060ccda6c", "value": 601688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151873, "uuid": "d3c3cb5f-903c-497b-904e-864410f90444", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151873, "uuid": "013d61d0-5565-4a4c-9dee-441d8d7c9c71", "value": "ITEM LIST 20092021UOC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c6c775-1a1f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632148163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148163, "uuid": "53f10f6b-2c92-4102-963e-6bbfd379d8ad", "comment": "Malware payload (Loki)", "value": "88f75a26375befa941b2b57d7e302c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148163, "uuid": "c7c31646-05bc-49df-aebc-dee60c1bda5e", "comment": "Malware payload (Loki)", "value": "12021fc0d383f24539b8565bb873b36cd84e16ad126588336300a5039bf85093", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148163, "uuid": "4cc12b5b-0ee4-49af-b66d-e3db2d48797d", "comment": "Malware payload (Loki)", "value": "747f16cc7a7b4c108bc28d22e8b70e9e2e58ba9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148163, "uuid": "adfb8070-8528-4c20-9d0d-98cae9895dc9", "comment": "Malware payload (Loki)", "value": "a47aed430f768e1c6e48d58a3a43904580341766311f14a38304c150ea5ca47ab1e1c28cce86a5b53642359251f254ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148163, "uuid": "5529adce-f526-4cc2-af6b-a85caf32ee15", "value": "T1D1F48CC13D47D89BF4DF1AB3986FC12011656E9D9161C73D2682BA2B59F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148163, "uuid": "1d9f9138-6a04-4ec8-a7d7-9ad5bb3312f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148163, "uuid": "bd4a283b-1ebe-4105-bcd0-201a785facf5", "value": "12288:N5MTdnK2esmtiK5oyZLpX1XZiVy86pyM68my3vHXkeXk5gqmQWHAS8:E5+FogTV8Ry3vHUehjQuJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148163, "uuid": "f78050bd-5c93-45fd-a244-7b6029a9332a", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148163, "uuid": "8761ecb5-d89f-4321-b8fa-fd55403d3499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148163, "uuid": "6498dce8-8e56-4dec-bf4f-1ecef3c877b5", "value": "88f75a26375befa941b2b57d7e302c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2720190f-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125401, "uuid": "54e3c4bc-357e-4b82-a557-b77cfa935c93", "comment": "Malware payload (Dridex)", "value": "81fc4e81c360dffe18b666ee5453be81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125401, "uuid": "111c407f-25a4-441c-a47d-f4232b42bb97", "comment": "Malware payload (Dridex)", "value": "123452614826080968a73fb36868153c5694f8010d52d795b47d6f3880cb757c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125401, "uuid": "ebdc4d48-bbb5-4841-9631-c735b901fe2a", "comment": "Malware payload (Dridex)", "value": "e57c271140b7bdfc2b47a3721322f97a782ad3a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125401, "uuid": "1bb2518f-10fa-4682-bcf4-cc4682c9c3f4", "comment": "Malware payload (Dridex)", "value": "784fd8cc6a633798ca8e4fec866115c406e64b3b68159827686411ff8fcc2d44ab78d7bd542d1bee041b1a9e2d91446f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125401, "uuid": "69a4d936-4846-439b-94eb-6ea05e6d954a", "value": "T12E95D010EE69E1F6C6B89F3E9408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125401, "uuid": "badedc79-5278-48f6-8ee2-332fdfee9e5d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125401, "uuid": "c6756a1e-93d0-48b1-a0a4-bc1105160428", "value": "12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125401, "uuid": "aaa4c101-cdf9-4a89-aa68-b0d57426734d", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125401, "uuid": "e4af3124-1b10-45c9-9169-20f0c9f933b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125401, "uuid": "c08626b0-d1f0-4c89-95ad-d3abef7a8bfc", "value": "123452614826080968a73fb36868153c5694f8010d52d795b47d6f3880cb757c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ffc9b3-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125452, "uuid": "9295130d-290f-49ac-a971-d56eb815d899", "comment": "Malware payload (Dridex)", "value": "efc0db9b03e2277a3b240e1ec63c3249", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125452, "uuid": "e9a32bb3-46ee-403e-9f32-ef4f4f3c1d51", "comment": "Malware payload (Dridex)", "value": "12e8eb15665dc0b03eb9cad72da532ccf6bb5d1493f391877f7fa63894e0b836", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125452, "uuid": "3df18957-53da-4851-bf4b-5bd3c769cf41", "comment": "Malware payload (Dridex)", "value": "b80424e057723386d5ca1bc0f0eec8da54fc0d34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125452, "uuid": "238495b7-889d-4c01-a5de-cd1e3bdb8008", "comment": "Malware payload (Dridex)", "value": "7e5ae7c609de424a4b50a025a6b505918b0d017c55aaaf023e6a12f9eb206ccb1eff865f98021d4738491d28a29ed479", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125452, "uuid": "a5728752-74ce-40bd-9826-20c796338a79", "value": "T14D95D020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125452, "uuid": "ae6efdb4-6716-4b26-8ab2-12d547178519", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125452, "uuid": "c966695d-95be-4e7e-93c7-128067df8c32", "value": "12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125452, "uuid": "9c52aa27-3b18-4291-a931-39bdf055b8e9", "value": 1994752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125452, "uuid": "5256e87a-7ea2-4ff4-bb3e-8f403b9f9f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125452, "uuid": "31b371ad-28ff-46a8-90e4-9e00f6b3667e", "value": "12e8eb15665dc0b03eb9cad72da532ccf6bb5d1493f391877f7fa63894e0b836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a5e067-1a10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632141670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141670, "uuid": "3bc6f55e-d8bb-4796-bb4b-557620475ee5", "comment": "Malware payload (RemcosRAT)", "value": "d07ebcc834688f1df95f6777dd9f962f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141670, "uuid": "b7bcae80-33cf-4be6-a8c3-a77f83e578b0", "comment": "Malware payload (RemcosRAT)", "value": "132ea9184746c10670a218d440d49a94345bf81dfd46337a87532080cdc1cc2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141670, "uuid": "87f4b0ab-eb5b-4db2-af76-241d61e3b00a", "comment": "Malware payload (RemcosRAT)", "value": "122045e943bf9d24ec60b0032965c47c1075ea3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141670, "uuid": "4387ff47-dd2b-41a5-98be-e27c5fdc6b07", "comment": "Malware payload (RemcosRAT)", "value": "b7c720595ccbd62edeaf12cf8806511d987fa04221f92d6bf6950a2cf96b2b56be7ac67cd57a34623a21a918f13480d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141670, "uuid": "4aba2a14-70c5-4049-8853-16e765ded565", "value": "T106E47DA592900FBFC12305B88D6B7AABA031FD001615A1DF7DFC7F88CE36979262D255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141670, "uuid": "32ee2429-4064-4c24-ac05-fb1f4b79e488", "value": "830382fd5b7a73f0620211f8c0ad9dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141670, "uuid": "a103c552-256f-436e-9c6b-5b44d5a97a57", "value": "12288:w9uZ2lK3ox6/ktmA1ZzgirJFarpvozH9ZgE5eDW:sMxox6/ktmA1hgMsr+H9ZgKeDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632141670, "uuid": "4d0ecdd3-a6a9-452b-ae0a-b98052e88bf6", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632141670, "uuid": "25d031b2-04f9-4104-8f70-518a5831482c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141670, "uuid": "e2301498-b1a8-475a-960c-ab6c223690f9", "value": "PURCHASE ORDER - WP011182,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab7d5f8-19fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632132842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132842, "uuid": "589cbaf6-0776-4390-b65c-35c6bb528670", "comment": "Malware payload (AsyncRAT)", "value": "1a217d1abef2e5b157a4ed42f82f3612", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132842, "uuid": "c8cc0ee4-59d9-4d49-af32-f3d107e57381", "comment": "Malware payload (AsyncRAT)", "value": "134970a4894d8c7cfd33a8e26f8d4fe1397cd249d0d864f7e50530c051c1cf8d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132842, "uuid": "abb983ba-944c-4acb-91dd-9f0d882a24de", "comment": "Malware payload (AsyncRAT)", "value": "68f67e09b48851337a210275c521b7c045285e6f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132842, "uuid": "369f3d3c-84c8-4e39-8a53-c63559f2f5dd", "comment": "Malware payload (AsyncRAT)", "value": "aaca7683415b6a74bf24641e77451910908f987c58932b149522742405ca27adeefdc67c61242d693fceeb9d48aeab78", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132842, "uuid": "ebb4bb24-911a-44e9-a5fa-05fbb557fce8", "value": "T1C84103C3FBE843A56CC0D8E4511C576B54BAC02A3CA860D6C7F181ABB0FE85838F5174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132842, "uuid": "5e309217-fac8-492d-8f0d-ef459cda0b37", "value": "48:6YCH1I5/cEoOeUypPK/c6vHRqiMPihZefY1YKbtxG:4VYc9OeUCWc6wj+OQxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632132842, "uuid": "f19d9a5f-7ed1-4622-85a7-0970feddca9f", "value": 2161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632132842, "uuid": "390f2fe2-56b5-4fcc-ac49-58975136becb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132842, "uuid": "36904af2-1292-4817-8137-725b73c467bb", "value": "detail.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329cb842-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125420, "uuid": "11493ba9-2bae-4b14-9414-86dbaeb165d7", "comment": "Malware payload (Dridex)", "value": "2ecbba31219055eb9e1b320d4a996451", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125420, "uuid": "f6bc8120-599b-4837-8c88-96fb39fcf1d6", "comment": "Malware payload (Dridex)", "value": "137217df7ea04e975a263ef2c67368f63f7cd877a874ba6fe86dffec1031540d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125420, "uuid": "b43121e1-d6e9-45c0-b3d0-ef9bb1a1ee91", "comment": "Malware payload (Dridex)", "value": "15e6c63d30d15bb4dc94e2590524515f45e924c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125420, "uuid": "3d7012e6-2b0a-4c57-b7f6-7b146bfc2161", "comment": "Malware payload (Dridex)", "value": "0098e695c9b9c4e28b639bda640942935799619c4e9c18f9fc4a124ebd70db143e570b5d0eed8763417c6b49a4c8f342", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125420, "uuid": "4d742e23-197f-4a13-907b-3dc19bb08f50", "value": "T17995E020EE69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125420, "uuid": "b60b0cf0-e1bf-43ac-8e98-0d6412c232c6", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125420, "uuid": "80216962-b23a-48c5-ae22-de56f8ee955b", "value": "12288:aVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:HfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125420, "uuid": "5bf0bae6-fd45-40f4-8281-4c910d7bc737", "value": 2043904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125420, "uuid": "0a9b8360-b37e-4985-98e2-c040fac4e5a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125420, "uuid": "f0cba0d2-517a-43f3-bec4-73bc7e6cf226", "value": "137217df7ea04e975a263ef2c67368f63f7cd877a874ba6fe86dffec1031540d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d544434a-19ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632111949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111949, "uuid": "cb4dff52-e4cd-495e-ae69-9e740b8d0003", "comment": "Malware payload (RaccoonStealer)", "value": "34641dfbfafe68166b5c0c69bc65222d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111949, "uuid": "cbfb29f0-d092-4b51-9af5-90ccf9df7c07", "comment": "Malware payload (RaccoonStealer)", "value": "13d6a16d6626f7c0967e4dfb75112b136eb97a56f50e2239adcfa4f97dad8a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111949, "uuid": "aa98b26b-421f-4dab-a2f0-bda1ff851579", "comment": "Malware payload (RaccoonStealer)", "value": "00dbff47c1f0b5c75f3d29cd6b4e3bfa806bff1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111949, "uuid": "9be09132-9d24-424a-b030-52ae392775e6", "comment": "Malware payload (RaccoonStealer)", "value": "978ec34c9006af38de228445bb7b689aabdaac6fc2546f55021354f45a86e96458fdd0115a0f487051c0fd254a880835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111949, "uuid": "00ad8efb-b6b0-484e-b9d4-62c832c2d377", "value": "T1DAB4E020A7A0C035F5F712F85AB9A3A8683E3AB15B7440CB62D616FD1634AF4DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111949, "uuid": "94a1a69c-d92e-49c2-9851-8a3379a75730", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111949, "uuid": "d5ecb4de-1056-4079-b0b6-9cb699634c56", "value": "12288:nZKv58iUe3A2r/7Jr45x6mMUxRuOXdLFX2v:nkv5818rGxxrPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111949, "uuid": "1d428b98-4667-4d77-bfb6-d02686d8c0b4", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111949, "uuid": "64e70d01-ebf1-457c-924b-8803da54cb73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111949, "uuid": "4811dc81-e454-4a75-8f89-c572022d11a0", "value": "13d6a16d6626f7c0967e4dfb75112b136eb97a56f50e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35582b34-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125424, "uuid": "ac245477-ae07-469b-9a32-d02c744370ba", "comment": "Malware payload (Dridex)", "value": "0af9875389fc726189dfa7e18a960475", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125424, "uuid": "44124f89-663d-407d-a6d8-24c566d53931", "comment": "Malware payload (Dridex)", "value": "147cc5db716aad32875822f996c2136fa6899187d7bcf7c3a4fd447435eb3bd4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125424, "uuid": "b41bcad3-2fd4-4a82-9d3b-278dec42720c", "comment": "Malware payload (Dridex)", "value": "0ed554a8358c4cb9881079a8b7c865960e91f7fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125424, "uuid": "4f8e2895-3c89-4b0f-952b-ae0c72cbaab1", "comment": "Malware payload (Dridex)", "value": "e0064f7914fad85c1606af705837b9a1e330e31d2598fddb3496921568be534059719c7449be2c9b41d016aa82b0b415", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125424, "uuid": "4413180d-ab8d-4814-8df4-a2cab4473cce", "value": "T1DC95E020EE69E1E6C6B89F3E9408352717F93D75110D608CC392708F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125424, "uuid": "d3308e9b-eb14-4c8d-aea0-5ab69044a57b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125424, "uuid": "03abed08-ae5d-4509-9694-bd5f6eb22967", "value": "12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125424, "uuid": "c6cd69c3-cf7c-4300-99b3-224795508c12", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125424, "uuid": "a2e90d6e-f4c8-4cd9-a234-eea465549546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125424, "uuid": "184952c5-e5fc-4ee8-b947-1d152cb7b8db", "value": "147cc5db716aad32875822f996c2136fa6899187d7bcf7c3a4fd447435eb3bd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ad3f59-1a0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1632139273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632139273, "uuid": "1bf048b0-28b9-48df-88de-04899416f26a", "comment": "Malware payload (Gozi)", "value": "73c53c1b8c185a9fc8e0b5556170941d", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632139273, "uuid": "b02e28fb-ebd3-4100-91d4-ed966c997f27", "comment": "Malware payload (Gozi)", "value": "14a748a512469ac740b93fda94f95dc9051b2029621bbd72b431338d13448c4c", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632139273, "uuid": "61f05cf3-a2b3-48e9-bfe4-2db8cf5a0ae5", "comment": "Malware payload (Gozi)", "value": "2562d8a2a575c392db65f7ca4b68d2dbe6e3fea7", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632139273, "uuid": "d9b8e244-9f23-4206-87ad-94a080651087", "comment": "Malware payload (Gozi)", "value": "8c94ed7f49af03e64e5818be8e4fdb5f823b97379360b07b4dc3b113482151bbaef9c01fe0b5ec95ef44b5d07e700119", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632139273, "uuid": "501fa7d5-fc69-4dff-b8e3-9d71fb5e9762", "value": "T157A395227A97D8C6ED1F433A0CD286D62221FC067E56DFF73232B72E1971594C91225B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632139273, "uuid": "cd9a0765-9487-434f-ac9e-376aa69b5ffc", "value": "3072:NhlYkEIuPm3fNRZmbaoFhZhR0cixIHm0g0gFCwMdCL:XlYkEIuPm3fNRZmbaoFhZhR0cixIHm0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632139273, "uuid": "86cebd52-8a30-49a7-92b4-cb6d8ce7a4e4", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632139273, "uuid": "089ad968-ff25-42cf-828a-adf7d1bd947b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632139273, "uuid": "f0adf3d9-b524-422a-859f-3ba19e107e24", "value": "2021_DDT_0008606.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87879b7-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125322, "uuid": "0460d40e-4508-499e-9a37-fd556e1a846d", "comment": "Malware payload (Dridex)", "value": "1029b724b93571cb1e3f8c6cedeedd68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125322, "uuid": "6cec42ff-3ace-4fc8-babe-5cfe3b598d4f", "comment": "Malware payload (Dridex)", "value": "14d39196be29ef978e887bd1c4df33ef72bb779a7310d2505b8aaafa8b08e0d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125322, "uuid": "528c61ff-3b74-447f-a0ea-dfa0b3e683ae", "comment": "Malware payload (Dridex)", "value": "a72b716c8fb1a0c07d732a1ab91fe3cf5d8631dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125322, "uuid": "88afccf8-2244-42b0-a49f-05aa98904e4b", "comment": "Malware payload (Dridex)", "value": "3f0600b0cd3f1e6f2a34f7a046dff77917888de72fe53d1120d3c8f2c295b309ec9b3c171d8d9f54e79cfa989c433e59", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125322, "uuid": "1e34cf09-9bce-44c7-8121-2cd760405af2", "value": "T150A5D010EE69E1E6C6B89F3E9408352727F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125322, "uuid": "be22f193-4414-49eb-b2d1-009f330acb11", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125322, "uuid": "f73720e6-4ce7-45e6-85ec-ae0d6838388c", "value": "12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125322, "uuid": "88afcf8c-775f-4cf5-838e-829c0926f28d", "value": 2080768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125322, "uuid": "1aee2084-40ac-41a2-9f33-5a06f2ee87c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125322, "uuid": "d2975227-5f23-4c74-af25-fcb3d015a3e6", "value": "14d39196be29ef978e887bd1c4df33ef72bb779a7310d2505b8aaafa8b08e0d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d38579-1a32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632156534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156534, "uuid": "a85d8b3f-66c1-4f04-9d10-569b332e10b4", "comment": "Malware payload (Quakbot)", "value": "5f8b22e659bfc7db9a7043a828da7675", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156534, "uuid": "b092f35f-61df-4d38-a156-05279e5c459f", "comment": "Malware payload (Quakbot)", "value": "153862cb79a2312f54a2307460872006138a649cdac6525df1d04c093c8b1454", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156534, "uuid": "d09ffc77-5ca0-4484-b848-f0518ba31c57", "comment": "Malware payload (Quakbot)", "value": "91a30a2b1b936ab508b37a713ae35358b3c24150", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156534, "uuid": "b8b317ca-28a7-4358-b8ca-e77d39caf04e", "comment": "Malware payload (Quakbot)", "value": "c50ca97e185bbd1bbf86cdc2bc1a785d5c529e3fc561772513df597e2ffc63742fd68d5d8a606e7bfa5d530c472da124", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156534, "uuid": "9557688a-196b-4549-9d66-22064f969629", "value": "T17505D02A7ED6E191C83C5D7988E1C8E67238BC686D28961739E53F3F29F30D1584909F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156534, "uuid": "662c9210-0096-4d0e-bed1-ed83ae25c397", "value": "fcecb109cd51f9ec6659a40269cd21c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156534, "uuid": "402c0d6f-2374-44ac-94f3-592df78bc5d7", "value": "12288:b0y2ZOB93YJh6kwi4eYHc+12GPUhW1brsZCesX/OkSAIV5TQi/c+FI2PXCkp5:b0y+QFViB7IOcesPIVVZQi/csInk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156534, "uuid": "5c98655e-7dc4-40c2-a614-a6eb483beaae", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156534, "uuid": "e3f0656b-5e82-47b9-92e2-791c15544f6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156534, "uuid": "00ff53b0-2e7d-4678-8415-25ecbc6a229b", "value": "44459.6948533565.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41e5b38-1a0c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632140347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140347, "uuid": "5a3bd6ef-88ee-4818-8b6d-33eca23aa572", "comment": "Malware payload (Formbook)", "value": "80917a81c89d5f741f6b1056642f912d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140347, "uuid": "b1d80d80-18c0-4ef1-bc6d-a7f6a7022e06", "comment": "Malware payload (Formbook)", "value": "157b65691069af6dacc64c99c9ae93a36377a97bf4030480ffc1f507db917a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140347, "uuid": "f5383055-35c0-4fa1-a33a-51dfa87cc56d", "comment": "Malware payload (Formbook)", "value": "83f9d9018993dc3057b90e9dd893961b63a32fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140347, "uuid": "d8728a60-5146-4829-9366-da6e2768dc25", "comment": "Malware payload (Formbook)", "value": "2ae97f623f6a793af29366dd23825e56d23706a750bd3e7687cafb52d36f090196de060dc5d2226c013f949014d30c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140347, "uuid": "372cb282-b7bf-40d2-9872-6488340384fe", "value": "T138059EC17D47D8ABF4DF2AB3986FC12015656E9D9121C73D2682BA2B55F3302309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140347, "uuid": "b33f1247-c206-4814-bf8b-78ef1a61b725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140347, "uuid": "572faf20-863e-47e5-84ab-419f047578a9", "value": "12288:q5MTdNL87smtiK5oyZv848cJd5uKxE26pIqBSjDk0q6gqvt:dB+FoM5Jd/6qq40IgCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632140347, "uuid": "55658ae1-4a98-4396-abd6-50401abcd957", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632140347, "uuid": "8a619c6e-cd88-4f09-8cae-71fbc92eeeca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140347, "uuid": "556992be-3ce6-4b60-aff0-fed3dd9ced1d", "value": "\u0e04\u0e33\u0e2a\u0e31\u0e48\u0e07\u0e01\u0e32\u0e23\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70698985-1a2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632155159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155159, "uuid": "5144fbd7-0d9b-48e4-870b-890855c62f54", "comment": "Malware payload (AgentTesla)", "value": "c4e384654cc25dedf537820645cee075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155159, "uuid": "9eac881c-4b34-49b3-9db1-623c97cb5ca9", "comment": "Malware payload (AgentTesla)", "value": "15847f9993b6a9c7102df708444119c3b5cd47ebab19becbf4fd28f1a9dc7dd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155159, "uuid": "489d6748-9383-4f97-8177-275771ff85db", "comment": "Malware payload (AgentTesla)", "value": "a6f0f91ee81603b44fca97fa45ff10c51a6abf3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155159, "uuid": "fa5d777e-c823-4a02-85c4-8d639764fd1c", "comment": "Malware payload (AgentTesla)", "value": "a4bf7d17839ba5c874467c76a15ad9a392f59e290cd57ae9bdde06eb3cfe381edcd16fd7b39a3b2f2a030f8eb51f831b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155159, "uuid": "010b0033-44f2-40dd-a17f-175e13593568", "value": "T15505AEC13D47D89BF4DF6AB398AFC52011646E9D9161C73D26827A2B55F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155159, "uuid": "70d26893-0875-4732-aa43-dbf952c92b09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155159, "uuid": "4a7ddfa5-5713-4ed2-8497-a6dd2795c282", "value": "12288:U5MTdgHZ/smtiK5oyZhAtKiDic1jxnlqVKN2xxBBm0OLItkGxQAqBO:Sm+FoBtT3NQjPy0OFGxhoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155159, "uuid": "5e842547-08b7-40b6-b3a9-345e9d806bfc", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155159, "uuid": "b07dfd6c-54ac-4bcb-a490-fc1392ca1644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155159, "uuid": "b9e5dd69-54c9-45f7-99af-ccfee6409227", "value": "DHL On Demand Delivery No_88393790.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85efefa-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632121859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121859, "uuid": "df174022-5545-4721-b230-37de9a234177", "comment": "Malware payload (AgentTesla)", "value": "4e56fff1797e9e676ea58bf316e5b8f0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121859, "uuid": "d51ea2b7-4a02-4fa2-b7e2-b3632ab8d447", "comment": "Malware payload (AgentTesla)", "value": "16d4439cc4b200bb545feb89bccf1e8e9defcb618cb88ccfdf3d092e53e7161b", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121859, "uuid": "963e615c-e5db-4c74-939b-4bbdb81009fd", "comment": "Malware payload (AgentTesla)", "value": "63541837337d3df60d9c1baefd553b2c06909636", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121859, "uuid": "62c33688-fdfa-45dc-9a32-5347fdfd196e", "comment": "Malware payload (AgentTesla)", "value": "99294cd8f1af39a5a7b13772374e7f724ac99afbe9c793fd2e67b0bac08fb65cc8f1fb9aab485e9819c9a6fe6142c10b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121859, "uuid": "e351b969-7f73-4870-9cc6-16b7d685e43f", "value": "T1F1D4235E8F62242761174F70D2ED99BDA787A3827F1A4D7392431D722A003FEFAB8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121859, "uuid": "2ef39d68-b10c-4642-859c-2f5dbd99eb97", "value": "12288:AAtRdYCgEtaB4qkXYQu+P8ilClSVOmSWgjn10q:zgQYQTUajsvbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121859, "uuid": "788555b1-5d35-4a88-a500-bcfde999fd63", "value": 645759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121859, "uuid": "49611df8-009a-4865-a7ae-93eb3241b6dc", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121859, "uuid": "0dd17c26-e311-493f-a5ee-d2b3330f4862", "value": "Demand List.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1f6adf-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632146535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146535, "uuid": "9e704a2f-93ea-4b99-a8f7-4c3552acca80", "comment": "Malware payload (Formbook)", "value": "26a4277ae3b166a366560cdfdcd33dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146535, "uuid": "d384ec34-fba4-4d4a-bc61-d40ad1ef85a4", "comment": "Malware payload (Formbook)", "value": "16e9e1b6560d4566dc705cf7504391ae585affc16a7cd70fc8c881e25eb230d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146535, "uuid": "747bc5a4-ec92-4b12-bb2d-79a454a72b00", "comment": "Malware payload (Formbook)", "value": "027bd03d54499449fe61189cf65a476dc61c7786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146535, "uuid": "29260dbd-f5be-4ddf-bf3b-068dfccd4b95", "comment": "Malware payload (Formbook)", "value": "f3c1f00c28e4e9aaaf2d501f6da9c8a395ec4811195a3ea4a84a83ea9d48cf2570592885e4cd32d3fbcb8079ff8a482c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146535, "uuid": "82f085f4-32a1-4bea-8930-270cff05f5ca", "value": "T1B115CF242218D519E5FAA73BC8A698B0D73FFC87A465D5AF58C278DE0D317E08017B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146535, "uuid": "97226408-a451-432d-8dfc-5600f9f4f076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146535, "uuid": "14f8e552-88c0-44f7-b32e-7cc4daa34ce0", "value": "24576:os+U3NFuzmJWyzRXfIBl11cZNlB+Fond:33NFuzmJt1XfIBP1YNlB6od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146535, "uuid": "b83b7454-9048-4a2b-b4e8-60ea1a130430", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146535, "uuid": "afd3d419-fe76-4085-a591-caacfb43ef6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146535, "uuid": "640c899a-487b-433c-93c3-703c814e4900", "value": "26a4277ae3b166a366560cdfdcd33dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ecb21c-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125581, "uuid": "31a0f90c-4b04-4382-9d9f-c73c0d5efb9d", "comment": "Malware payload (Dridex)", "value": "0751b054a4b6cc527fe88bf7e027324f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125581, "uuid": "cf648338-52f4-40a0-a810-22701229de74", "comment": "Malware payload (Dridex)", "value": "172f09a69a43e81bc62cc834212e5dbac7fd509d77e5c681b588258478863531", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125581, "uuid": "14bf353a-3e0b-4c79-9906-7df9b7eb63ea", "comment": "Malware payload (Dridex)", "value": "b0b0f50741506692d89b00e52718ad6adaa65f6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125581, "uuid": "764c9da1-e4f0-4542-aa4a-b1451c7639b1", "comment": "Malware payload (Dridex)", "value": "7b93d995998a53b7afd816b00775e453c6c79ee846f61d882122b4707e3c449247a6eaf3042d39b1cca6abc766052511", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125581, "uuid": "b94079ca-c068-4a25-ad4b-60ffe685a30d", "value": "T18795D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125581, "uuid": "93c57a03-34e0-44e9-aa93-5d3fb4bf583d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125581, "uuid": "418f8d4f-0270-4a17-b916-53a9244c672b", "value": "12288:6VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:nfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125581, "uuid": "28ba479a-9ed6-4c0e-ada5-b1a4c502185a", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125581, "uuid": "da940701-dc5f-48d9-90c7-4c328eac49de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125581, "uuid": "05ace399-3c16-4f89-862e-8fec5b3b387c", "value": "172f09a69a43e81bc62cc834212e5dbac7fd509d77e5c681b588258478863531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fb5798-1a42-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632163386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163386, "uuid": "ad8345bc-d543-470c-bb5a-6baf2bfa97fc", "comment": "Malware payload", "value": "86e23a23cfe74c3076103ae580c0621c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163386, "uuid": "4b659b44-b0dc-4ce8-91bb-d506238f3160", "comment": "Malware payload", "value": "172f52d186481e782dcbfa1145d8e8a6b81ee898c895037d914bd258c0796750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163386, "uuid": "6870dc76-4b80-407e-a9aa-40db103a291e", "comment": "Malware payload", "value": "38bc807edf0d8f9b53bcd69e60eb18ef845e774e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163386, "uuid": "73a212eb-d035-4078-ba18-d8934719f427", "comment": "Malware payload", "value": "ce5a8aa1cc219922898813fd896e5a1f083ba9c70400804518afc0c6a645f16735f5db416bb7ecf5cfc3ff2411ef89fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163386, "uuid": "0a6812de-f006-47a5-ba95-edf0aba8f6e9", "value": "T19A9533A8A32E6DE9CBD8E73028FBDD5B4F1C3165DD985849782BDF33B5421403492D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163386, "uuid": "f0f37e00-976c-4b97-a282-202097cad1ac", "value": "49152:OzfjjxX5cPH8GalMlvWXAlv/T9J4vynBtXI3oxES0qTTKJjbUB:OzNWPchlwvL4WYRJc2lU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632163386, "uuid": "d4171cba-e730-40bd-9aa2-e3c384b41dbe", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632163386, "uuid": "92d224ed-761c-48f3-ac1f-64820832f949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163386, "uuid": "8ced419f-124f-47ce-ab74-be0cf8e74893", "value": "86e23a23cfe74c3076103ae580c0621c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d13c9d-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125378, "uuid": "e602e3ba-6052-4436-8530-81a07691e66d", "comment": "Malware payload (Dridex)", "value": "94d6102f74a5d146ecea0fe202df38c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125378, "uuid": "487255af-20e5-44b8-8d59-1095fe8df4e4", "comment": "Malware payload (Dridex)", "value": "178abdcd3ecb0f9e7ccae9a74c3884f143d6de4c53fc63cd8f620740ca647da6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125378, "uuid": "cd5bb6a6-e104-4584-ac62-fe4c5b0ab066", "comment": "Malware payload (Dridex)", "value": "f063a8e02d8ddeb478664274feb9fd9af2c91e95", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125378, "uuid": "3046d178-0822-4765-a739-bf6684726c5f", "comment": "Malware payload (Dridex)", "value": "2f9120fbe81c579db8334753e1a6016eacaa28f8b6d9d6bbb4cd5e11205dadac64743f6043f225c8770bd4e55f39cae9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125378, "uuid": "fb76402c-3fbb-4b7b-b841-7f511c3e2fae", "value": "T1EFA5D010EE69E1E6C6B89F3ED408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125378, "uuid": "b2a8c7d0-2253-4445-9846-19a6d0929e46", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125378, "uuid": "26e4a87a-0851-458f-a6bf-29d03e377e5e", "value": "12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125378, "uuid": "66990947-db0f-44a7-88e6-9ca4739e582e", "value": 2068480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125378, "uuid": "6becc4a3-db55-4852-8e9b-8416a7d8b0a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125378, "uuid": "553fbbfe-2306-4334-a81c-3f686399a5a3", "value": "178abdcd3ecb0f9e7ccae9a74c3884f143d6de4c53fc63cd8f620740ca647da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17285e4-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125311, "uuid": "8b273034-4671-4087-b5f8-228d84bff4a8", "comment": "Malware payload (Dridex)", "value": "ecf9f92bd0bcb2daf3b8568f1872c6dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125311, "uuid": "49a01c6c-84f9-4342-b740-9f2a60e74cdb", "comment": "Malware payload (Dridex)", "value": "17965024ffcb1c93adb3a7fb2f5c8bf746b1af8241cccc25ea31f4d9a3ca3578", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125311, "uuid": "b3998601-cd02-4ce1-bd31-d7b9566b5a53", "comment": "Malware payload (Dridex)", "value": "028a2b4cd4c6487e4fef2f62a441b73350330468", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125311, "uuid": "8725ea40-e9f6-46ae-9067-3efe1dc965dd", "comment": "Malware payload (Dridex)", "value": "0454ffe991c447ab71c8314f6dffb757b0b65491a047d9051c3a0525aab0ea0728ba64241167515882d5f063988ee0c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125311, "uuid": "f07a3928-848a-4063-a4aa-d826d58496bc", "value": "T10AA5D020EEA9E1E6C6B89F3ED408352717F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125311, "uuid": "dac7e1dd-050d-4052-97f8-f737592e85a1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125311, "uuid": "1393d75b-796f-40c2-889f-733af7c69dbf", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125311, "uuid": "b36c9168-8429-473e-afb6-eb2b9aea4db3", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125311, "uuid": "f0b94df1-8084-422c-8f0e-b24aa76e1f2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125311, "uuid": "309d9015-46dd-4177-8ef4-59af6ea2cda6", "value": "17965024ffcb1c93adb3a7fb2f5c8bf746b1af8241cccc25ea31f4d9a3ca3578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ff39f2-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632143483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143483, "uuid": "28d9ad5b-c869-4f23-afa0-e0df0160b800", "comment": "Malware payload (SilentBuilder)", "value": "3152459f291226374aef89b376666c02", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143483, "uuid": "c221fa7e-05c8-4a28-a26b-5569b4c88773", "comment": "Malware payload (SilentBuilder)", "value": "182a11ae9b66c9abcd9fd9dbd7a0176a5895f354443e31ab3258182ca62d3a47", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143483, "uuid": "41818be4-43c0-4a29-81d8-323f02a802b6", "comment": "Malware payload (SilentBuilder)", "value": "c0df1029fe79a5d42f24c0ed9459b2a8104e6120", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143483, "uuid": "2631f919-0e58-427d-ab69-7689238c36b9", "comment": "Malware payload (SilentBuilder)", "value": "bb94684038186b701bf75bd75e888a3c3e327c4d7d2cbf2e66192fa140cad9da9991b006779f55fcede31e5584465ca2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143483, "uuid": "fb8245e5-f067-4e00-af33-4af832890a47", "value": "T15144D02636A5A41DEC2D2B76A8BB53D02337FC504FD38BC77AA772263F726914D22405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143483, "uuid": "a75f8a6e-235b-4624-b6dd-ae12e88a6058", "value": "6144:mKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+knfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmE:kj7CqScwoRZ9bSXkh/nLKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143483, "uuid": "faf39c4e-e5bb-483f-b062-2edef21a65fa", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143483, "uuid": "f6e7dea4-ba6f-44df-985e-e999065d683e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143483, "uuid": "00893fa8-fa4d-49a0-85c2-61a25aa36276", "value": "diagram_689237355.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab831b9-1a40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632162397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162397, "uuid": "1d344fd6-e781-49e0-a708-2657d1df6db0", "comment": "Malware payload (Dridex)", "value": "0f0140c33f1daa9f268a64687bb0d6fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162397, "uuid": "6b3094fc-53a8-4a1c-a37e-4bd5de59442d", "comment": "Malware payload (Dridex)", "value": "184b692e8d04966338989a4a2cb1cf79fa4a5012748a967b97c1dbfd4f11b010", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162397, "uuid": "a6c7b5cd-ba75-4a6f-a464-454a831d5379", "comment": "Malware payload (Dridex)", "value": "2d378ac309dca95e9dd1de3a291e36ba87ea1f17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162397, "uuid": "79792031-79d9-4105-bd9a-213b3a0eef9f", "comment": "Malware payload (Dridex)", "value": "4c9caeb17f95d0ecea3778e7fac1c7e160262635244b5e6be05cfacf9f4e8ee95ed0266cc6b7c9f45626a4e5d2f333f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162397, "uuid": "f3313489-8a1e-49f5-81d6-fcd4b8dbc139", "value": "T19A14E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162397, "uuid": "e65df522-f4cc-4600-9b3c-4d32980f33e7", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162397, "uuid": "99d4aa01-9581-4e12-956a-f2e198839c8c", "value": "3072:v9g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCesJC:v9g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162397, "uuid": "ccf9bf50-d269-425b-a5a4-00752d0efd1a", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162397, "uuid": "0116eba6-c057-4cab-a09a-b5c5e87edb12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162397, "uuid": "33281c94-6b60-4b35-b813-6e727f7ad185", "value": "0f0140c33f1daa9f268a64687bb0d6fd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d077cc30-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137711, "uuid": "4156c3c8-d135-451f-9802-f8216789e8b7", "comment": "Malware payload (SnakeKeylogger)", "value": "c9a9a0e731bfaccda38a9ae33ecd3829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137711, "uuid": "e6293741-c9b4-4b19-9c4b-f8dc8a9f6a53", "comment": "Malware payload (SnakeKeylogger)", "value": "18ea5ebd8331a357b54d5ab5b08db0bce05f8c452cabca6ff56fa2264525de9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137711, "uuid": "276b6898-9d13-4afd-90ac-402421a2bf31", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed0b7b0fc1a0a94536d0172a10fc5f61f1bd559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137711, "uuid": "3980ba6f-3aa5-4cbb-9eac-51c635159a6e", "comment": "Malware payload (SnakeKeylogger)", "value": "e854b6621c15634d069fc12e59de9b8a1aa4e00d87207a33506f05bb2f3747fb0d214ff4e698f16acf03e68a35733d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137711, "uuid": "f30eedc9-e7f9-4ccd-874f-2447becf3623", "value": "T15135CFC17D47D89BF4DF5AB3986FC0201165AE9D9161C73D2682BA2B55F330230ABB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137711, "uuid": "59ad3aa7-dfe7-4321-884c-efe43ed5eb60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137711, "uuid": "b100e2d9-d39d-40f0-a9e6-bad53d559276", "value": "24576:4d+Fo1CUqSWCImx0h7qrVLrkXB5kmu+CNHoNgIQri:E6oBWhmoctm5qyRai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137711, "uuid": "d1fca527-c8f0-42b7-b2a0-69d94f85e639", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137711, "uuid": "efd0e800-0667-4143-8a35-17220012a770", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137711, "uuid": "53053fa5-2d81-4dc4-bcad-e0f20528ed0b", "value": "0875PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ff4144-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125457, "uuid": "e51f5f7a-8f55-45ff-987e-0585868977a7", "comment": "Malware payload (Dridex)", "value": "d544a09bbec7f1b092ac0c0236ea6fe1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125457, "uuid": "b5b92506-6f42-4439-923e-18194afaff1e", "comment": "Malware payload (Dridex)", "value": "1913f9e687e4bf59b567be4d13a8bbce8436ad3ef0d4940758e39008507023b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125457, "uuid": "fb2720a9-0e13-4887-8b1c-cc8d57978444", "comment": "Malware payload (Dridex)", "value": "3651583ccba3382dd92955077ffa20a5f04fe134", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125457, "uuid": "8837964a-85d4-4b66-8299-4024a9a2c378", "comment": "Malware payload (Dridex)", "value": "da416e25ee04caf6724055c20d56f27668cdf262a4026a428302c6fd6b514234ff66d8b3b586331fd402e4101239c807", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125457, "uuid": "e2a86369-c243-43a3-aaf6-ae3e19bd1ceb", "value": "T19395D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125457, "uuid": "e5774bbe-6720-42bf-84ce-e1696e2ab9e4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125457, "uuid": "041fcecb-539d-460b-83a7-94cfc3e2768b", "value": "12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125457, "uuid": "364ba9cf-a2b9-4902-9848-65d438535e9a", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125457, "uuid": "d2b4e041-bcd7-4bd1-b030-eb13aa041aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125457, "uuid": "a5329aee-8b2c-4758-bfaf-38ea54a7cd11", "value": "1913f9e687e4bf59b567be4d13a8bbce8436ad3ef0d4940758e39008507023b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fa70ac-19c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632108049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108049, "uuid": "110b9c34-3f9a-4958-9c6b-cb9150a8fc75", "comment": "Malware payload (RaccoonStealer)", "value": "44e61e772bf265fd237fa5af9151ce4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108049, "uuid": "3614c7c9-1abd-421d-9e30-1b087ba6a236", "comment": "Malware payload (RaccoonStealer)", "value": "19d47c7108f49e1e5c9e6437d3deef5274dde24eedafe76f1ab97aa5f0a223c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108049, "uuid": "fc67edc5-a708-4c11-b558-3fd9e2532816", "comment": "Malware payload (RaccoonStealer)", "value": "bfcf3e74556215560a5982edf3c12cc5f3578b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108049, "uuid": "254b2bb8-2673-4164-95b2-3e9578e74982", "comment": "Malware payload (RaccoonStealer)", "value": "9a355b42d9bb3856bd4e16852d8496f18f6dcf2b2aaaf72a39ae4cca05410c1d107378a14fc2c5733a3de8c0bbc61690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108049, "uuid": "ba56b579-9c79-4b1b-b8b6-850730da31fd", "value": "T108B4E020B6A0C035F5FB02F989BA8768B53E7A719B3440CB62D616FD66346E89D30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108049, "uuid": "7774ba04-1f4c-47dd-a17c-c5371c1a6c70", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108049, "uuid": "d5f52b1c-df3c-49b4-8c1a-ac84f01f8387", "value": "12288:xZ0evmcyUDXQZ2HRs4Zl1N1OCE/cbkWF0q:xOevmcGs6A1XOVEt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632108049, "uuid": "8dee7d59-7c1b-441f-9dd6-baf94eee440d", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632108049, "uuid": "1cafff16-b89b-4f86-8c8d-ce1b0a3cfa71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108049, "uuid": "319a6479-890b-4347-b358-df00bd24266e", "value": "19d47c7108f49e1e5c9e6437d3deef5274dde24eedafe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d4c4fa-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632160216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160216, "uuid": "267773f9-ea7d-455f-a8ac-f8cd0dadef65", "comment": "Malware payload (STRRAT)", "value": "c8b52d9488aed4c8ce9b82ce28a7b2be", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160216, "uuid": "0e8f46d8-b8a7-4420-9366-27bbd4548a9e", "comment": "Malware payload (STRRAT)", "value": "1a69de0a19c5a9983e1bb13abdc5fd9baac5ff6eeebb7f34e60e9ecbdd65d3f5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160216, "uuid": "af67e0db-7a29-42c3-b998-6a3ca1d66dd3", "comment": "Malware payload (STRRAT)", "value": "ef363072dd8e16f5f82a4007d6449992e6f3fd1e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160216, "uuid": "954cb4ed-d8ad-4b41-856c-06fc3d4ce641", "comment": "Malware payload (STRRAT)", "value": "153f884762824b01a11e126c5f605be4ba5aad79d3f77baa7606c4e41e68e7da63110b48d1bff8b5cfbb5f92fe81c1f9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160216, "uuid": "df683d9c-f82b-477b-bb66-ad0ee537f774", "value": "T18DA3E09F7CEAA5B5E14B043B818D8066E78E45A8C546622F16FC168C0F70D3D4B47B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160216, "uuid": "12baa65a-e79b-4722-a8c7-9b1afa23adad", "value": "1536:s4yotY7d9LOEZKc9CP4W7rWtbC/xgo/bqIxSDNy6RCm1x+OfMuNAmf+TaTYGgz:sBotY7Nn9PWPWtXo/biDk+CmSLafGFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160216, "uuid": "bdb1fdcb-60b1-490e-8303-37f936cc04dd", "value": 100719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160216, "uuid": "d7029003-2fb9-4fb5-b535-f275761126a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160216, "uuid": "9234bd8d-0e4f-47f9-b7ce-20970ed22a34", "value": "payment slip.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221a4a34-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632118091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118091, "uuid": "ac443d74-04ef-41ae-8077-aae8ae251601", "comment": "Malware payload (Loki)", "value": "d283980d7f07d06dd148e52f349d128c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118091, "uuid": "f1db88e8-a78c-4777-af7d-41269ca85f1a", "comment": "Malware payload (Loki)", "value": "1b11a705dd4082fc2f5fe7e1478ef7e9e2a071b27740007b45ac17d807797b57", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118091, "uuid": "c3404883-ad6f-4d01-a933-bde61e595c2c", "comment": "Malware payload (Loki)", "value": "9350b60baa670f2599f161b280e77cb39fd31bc6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118091, "uuid": "96b38a89-ffde-4285-9ea0-0ad115783962", "comment": "Malware payload (Loki)", "value": "316d5d76f09cd2a243a03abdd869c2b351d9c42b27de506e4ee70432c7fb7b0a65a22c7766bd275d4f66c274d7dc7175", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118091, "uuid": "c36c672d-67dc-4ec3-8f34-21d3bb7ea77a", "value": "T160D4E08D5A616F59CE2A2933CBD20A645FFFED2589F0F84664E47E9D82BB3D45C30801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118091, "uuid": "663a73b3-4f71-4db5-8330-f531b1e1b6a7", "value": "12288:8mEStXmr1CPtDzJkPHYEnzDECaqcF+PgMpDbPRp3+cJq6Ns8ztC:8+skPtDzetzDpaoPgM1Rl+cJq6JzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118091, "uuid": "77f4269f-53ea-43d7-b76f-28198b96a553", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118091, "uuid": "61377d2f-72eb-4b54-a4d2-57b8f6f57c0a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118091, "uuid": "854bccbc-f380-48c1-bb12-7d527531148d", "value": "_PO008011_Shipping Docs_CI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b124d60-19fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1632134078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134078, "uuid": "d62f47d7-09d0-418c-83c0-90e6bf635e98", "comment": "Malware payload (Gozi)", "value": "743e07c4c2ccb80ab58c041d6388e685", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134078, "uuid": "5a71cdc1-0db6-4618-b2cd-7d283f20a580", "comment": "Malware payload (Gozi)", "value": "1b13ca64d43c95a3e8fea7a7c41fab2d1a0bcfe80575145d4342c3672428f307", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134078, "uuid": "6e499439-de87-4321-9f70-3f34e8fb25fe", "comment": "Malware payload (Gozi)", "value": "c5af42bab5d14e63c1cc257989ad25337c8f137e", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134078, "uuid": "322808e2-1635-48a1-b878-a9ad68fee9f9", "comment": "Malware payload (Gozi)", "value": "43aa831493cd36633420818e34e6d36652103f11d54e1c3fda483e4208a358443cc807ca3b3a860fd9263d7e4b447f53", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134078, "uuid": "a342b50e-74fb-4049-be70-ba0a81f9ea08", "value": "T149245A6AE7E40595ED6BC6B5CE52D61BE7F274452B24D30F43B0CAA62F07322B21C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134078, "uuid": "1258d1ff-5ba0-4c3d-9434-518fd2800bf2", "value": "6144:7oHf/B9KBbOwf8Ngow+vlubIvhxwB5I6F:7oHf/BI9OgKXw+vwIZxw3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134078, "uuid": "13a77668-73e8-434e-b2d5-0602893f1e3f", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134078, "uuid": "f86c99c4-e18a-47c0-ae9c-93d4d5cc2a6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134078, "uuid": "f1b21352-8dfc-4ec1-91ab-5e73df03ee9a", "value": "8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ff6095-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125046, "uuid": "4c6e2acb-43cb-47ab-988a-044152e390e2", "comment": "Malware payload (Dridex)", "value": "73e6907f8736e94f1aab22c138d439a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125046, "uuid": "9d877862-31cf-4633-b266-2d292a7aa83f", "comment": "Malware payload (Dridex)", "value": "1b1d6fb4287b81972665663c2db8962d2a38c35fab55e3a0d67ec7e19add14e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125046, "uuid": "6dc8280a-470b-4f44-a3a3-8133367f8c16", "comment": "Malware payload (Dridex)", "value": "9f9b354fa68e5f295daa8728afae5de37282e498", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125046, "uuid": "15ce6250-069e-405d-a838-3b246c50617a", "comment": "Malware payload (Dridex)", "value": "9713c22db0a22f524fa835851a5edf8dcb3009d91e0698a87f62bc40ae74a79433e3283477db5af272152af4ef56a88f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125046, "uuid": "0ad8b4ca-7549-4cfd-8cf8-c0d70060186c", "value": "T14595E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125046, "uuid": "03d306df-23be-4d04-b764-86aa4b0954b8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125046, "uuid": "04fadca7-b1d6-4b20-af88-b9ec4253a37b", "value": "12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125046, "uuid": "758e1cb1-0e99-44fe-8da6-d850cf61154b", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125046, "uuid": "ca8c4ef2-743d-4876-8b04-517a6e146159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125046, "uuid": "d4a1d7ce-72ba-4baf-9ac9-c534eb2f9fae", "value": "1b1d6fb4287b81972665663c2db8962d2a38c35fab55e3a0d67ec7e19add14e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e529ad-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125051, "uuid": "39ca2bd9-c47d-4387-873d-921e44e38b1f", "comment": "Malware payload (Dridex)", "value": "09dfd4cdb2aca3b8f5293b937aeadec2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125051, "uuid": "23958d7c-bf93-42a6-9546-1b9f15971035", "comment": "Malware payload (Dridex)", "value": "1b4e4ed18e7f6f5e1b155ffb234d43ca3ad3420a7be64fcb865cc56623b790ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125051, "uuid": "2a558f3b-fbb1-43e0-8cf7-b8bfb9dec826", "comment": "Malware payload (Dridex)", "value": "a3b0b18f9a95dbfafd16c9240092ce82fa56ff28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125051, "uuid": "10b73858-b1db-4230-b174-5eddd774cbde", "comment": "Malware payload (Dridex)", "value": "8053ed161584d3d223a1bbd4033e02da6064e327efc88d3f39a2c6cda45d080bb3d9b77722215849adf5e41a05e9912c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125051, "uuid": "d11addf7-ef73-4810-a9c8-b911866222b3", "value": "T1F895E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125051, "uuid": "643305cd-ecc5-4fa6-add7-b71fbddc4722", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125051, "uuid": "da6a753f-74f5-4607-9b24-3de1959dbc97", "value": "12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125051, "uuid": "afc2e4e6-e5cc-4bbe-9cfb-88ecfa5350bf", "value": 1896448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125051, "uuid": "0c20cf11-7a4f-4ecb-aa6f-3315bb69105d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125051, "uuid": "36c7169a-c207-46d0-a841-abee967bfc09", "value": "1b4e4ed18e7f6f5e1b155ffb234d43ca3ad3420a7be64fcb865cc56623b790ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2a5805-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632160816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160816, "uuid": "dfabb8b8-eb9a-47e8-9df6-430f7b27ba37", "comment": "Malware payload (AgentTesla)", "value": "722235b69b44bcc7ebcf84c4356923a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160816, "uuid": "f4e1c465-3cde-4a8e-9713-f11145a27423", "comment": "Malware payload (AgentTesla)", "value": "1be14c1ec93a3160287140e53417e3f7cbb30644e5330504ddb76bdf5766d11d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160816, "uuid": "41f8fb5a-6d89-49f4-9703-8a904c4fb38c", "comment": "Malware payload (AgentTesla)", "value": "8d89b4e80a0a8c0d9be9543bb29c8f5cb3bb2cfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160816, "uuid": "a507746f-91e7-4d51-be8f-5d2372fe0290", "comment": "Malware payload (AgentTesla)", "value": "528d74ccb3c23a8212fd67348abad64dbb4a1d4b28354b05077eff156317aa1ef4de91d1d590b98e2cc38c1900bf2163", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160816, "uuid": "faa1b7f0-5bb8-4bc2-b7bd-16493b8f7871", "value": "T11E059DC17D47D89BF4DF2AB398AFC02011696D8D9161C73D36867A2B65F3312306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160816, "uuid": "74cfc666-ab2f-4879-b855-aa2f1d22d64e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160816, "uuid": "eded2f97-b539-43f7-b4ee-a9eb7fe8343d", "value": "12288:kJ0+lsmtiK5oUZxDUGJrGH/9v4bEWAi6ojLuqskGQK:kJ6+FoS3dGFvGEWA3caqskZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160816, "uuid": "3c0ec4dc-e826-46f9-ba2e-d5bf567cb152", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160816, "uuid": "d993a954-eccc-44ee-9638-a59027d11017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160816, "uuid": "bbcba019-392f-41b1-8def-aac999042437", "value": "722235b69b44bcc7ebcf84c4356923a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d9a430-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125056, "uuid": "cabc58dc-be3d-4de2-b2a7-8213eeac54e0", "comment": "Malware payload (Dridex)", "value": "61f4c7a7ebf0c0b3413a82c3982a605f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125056, "uuid": "1445c722-dd7f-4900-b31a-e1d5d834ef00", "comment": "Malware payload (Dridex)", "value": "1c3bc54d1cf0f57192ce216be3c7da7ce4ea60d75b2cf28c1d638f3e2d221413", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125056, "uuid": "9ee2d9d5-29dc-4a57-b28e-4328fbdc684d", "comment": "Malware payload (Dridex)", "value": "5e34a794d917527d70035997006dd556d29298c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125056, "uuid": "68b2d4d6-e188-49eb-a0fd-e48c3a6a05c5", "comment": "Malware payload (Dridex)", "value": "b77fe9236ba8fe914f70f7da250564f7d9df80a22511296409565d787e5c32b97f0314d79e093bfe84a8bdd7e7b5a128", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125056, "uuid": "c745febd-4a36-4e0d-b32e-7dc571b13696", "value": "T1B295D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125056, "uuid": "9c21eaad-513e-4f5c-90d7-70ea2a482b71", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125056, "uuid": "52e9856e-e43d-4ebe-9e65-3d596b32229c", "value": "12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125056, "uuid": "4ac6657b-2495-4581-88b5-31875b46080f", "value": 1990656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125056, "uuid": "dcad3e88-b549-467c-80fe-86163da0ad83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125056, "uuid": "4e80933e-7b31-4e94-bd8c-825548e834de", "value": "1c3bc54d1cf0f57192ce216be3c7da7ce4ea60d75b2cf28c1d638f3e2d221413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b49b1c-1a42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1632163378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163378, "uuid": "fa27da0b-3634-4d82-b771-df18e89a1e68", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ecf71fa2ca799920065fe94b214d4f0a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163378, "uuid": "b06cffd2-1458-4160-8161-f900da0808ea", "comment": "Malware payload (CoinMiner.XMRig)", "value": "1d136937763204fc0a997d98108af4c145a91f481cfc87bea6bd940341e47417", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163378, "uuid": "5077158c-3f9a-4174-ab2b-6889ba1341dd", "comment": "Malware payload (CoinMiner.XMRig)", "value": "83aa4f044912ccde6dbc4fb7c0320b837d8dc5ec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163378, "uuid": "7028049f-97d4-494c-b989-7dc0600e9761", "comment": "Malware payload (CoinMiner.XMRig)", "value": "09cf30d8a1990e98c7e55025403b829751e1ce2518114999f45e753d9aebfbecf507191f8e7d7a266e0293e19fb7ae0d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163378, "uuid": "9b8c6d1b-6b85-46ab-b7e0-21ffd1244c3a", "value": "T17794231649BC2437DB2435FF844288BA1F94F0953889FBEE7589F0B7E9092F18564A33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163378, "uuid": "dc9755c9-d524-4e00-bd95-b578c528043d", "value": "6144:QUx7kupN/0ysps2rVGvZOjq6BunF9x2e+gnmoTFHLnJJzVap843pzvAcIRXv:37kKN8w2rSz6BngnmyVVabIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632163378, "uuid": "f02ef25d-a703-466d-907f-4db06624a3a0", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632163378, "uuid": "2519a273-434d-4dcf-9f23-2785772d9b8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163378, "uuid": "877a89da-d792-45f1-825f-caef41acf398", "value": "ecf71fa2ca799920065fe94b214d4f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61104f7e-1a12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632142678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142678, "uuid": "54104b90-8381-403b-8dc8-6a888cd99f50", "comment": "Malware payload (AgentTesla)", "value": "12df0efaded48631aebb434216d56f9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142678, "uuid": "6f22e3b5-27d5-48dc-98c4-7f4cbde6735f", "comment": "Malware payload (AgentTesla)", "value": "1d737dbc9c74ab06191e2a2878312b7656f93cde64d893171f9599620a9c77d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142678, "uuid": "493af2d1-4f00-4fc7-a82d-54c860f3ade9", "comment": "Malware payload (AgentTesla)", "value": "f80b306bd531573a8a1758bb5c2dcf92bd5d46ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142678, "uuid": "47707f06-2439-46ea-9bd6-4005fc1c7a3b", "comment": "Malware payload (AgentTesla)", "value": "bcbe842b46a46876aaab4abf01c33049536723846c1484056d4b3bdf53a65f4112841dc6639b9980cdd973a127921ff8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142678, "uuid": "69146f31-7cbe-4fda-ba13-760c92e06b8b", "value": "T1D505D0202364C62AE1FBB778D4329471CB3EF986A03AD95A5DC3C9DA0D25341C51BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142678, "uuid": "2c56658e-f7d1-4c3b-a060-519241e9ace7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142678, "uuid": "f989f602-6845-40a2-883b-69275eda7314", "value": "12288:FBGiY6H/FubadIvROeNJx83gdG/7wsjS5FtjoBbWRbzmtiK5oX6b:FA6fFuGYzX4gU/TWLtkbc+FoXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142678, "uuid": "c514717f-bf56-44ec-9dea-70bfef002a59", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142678, "uuid": "f5b9af65-7190-4576-bca8-20f48cd1879a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142678, "uuid": "8bc619ac-f8fd-40c6-b28e-60251ec275a1", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1cb089-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632160787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160787, "uuid": "5dcc5ab7-821f-4eb0-80e8-416395368ae2", "comment": "Malware payload (RedLineStealer)", "value": "88b7faf82455e5327c3102779677b5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160787, "uuid": "6f5f6bda-b81f-44d9-b6d0-b806b9be8a9f", "comment": "Malware payload (RedLineStealer)", "value": "1d91ab82e01d7682deecbeef7b441f26e405c0053e0354e92fdb5cfe61b097b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160787, "uuid": "2f596ba3-cfcd-45b6-9db6-25f4799d1492", "comment": "Malware payload (RedLineStealer)", "value": "0893f2bea5dc53659f96122798c632b67d45804c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160787, "uuid": "a099331e-cc4c-4390-9bd0-810634db69dc", "comment": "Malware payload (RedLineStealer)", "value": "14a8ebcdb16bbe9470ad3dbf9e65a28c0488a18183faf6f11aa39411c86e5f96afd0a1571b0c3cd41a2a95ddd8b1f815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160787, "uuid": "67a73db1-3915-42c1-b0c4-4aec09413bdb", "value": "T1FE74AF20B690C035E5B711FC5BBAC3A8A93D7E709B2050CB12D666EEAE346E4DD31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160787, "uuid": "604ae26a-151b-4629-ac0f-d9d086c36eff", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160787, "uuid": "b858ed98-f0dd-4eca-bb8e-888688a5ee67", "value": "6144:Gw7AZGWoSvIb16ryqGQSuk9L7RxxTlHHk1rIvn7JojwG5+cOsa93Z:rMboSvc16rAPukp9TBk1Ev7JojwG0c6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160787, "uuid": "cc8eba0f-c852-440e-9a32-688aebf458cc", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160787, "uuid": "9b7bd704-b25a-49b0-878d-fd15f9bb93c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160787, "uuid": "b38089f6-5b6d-421d-afe0-9468c5903664", "value": "88b7faf82455e5327c3102779677b5de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da7f7ce-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125063, "uuid": "b99063df-37db-412b-9666-09474008f05b", "comment": "Malware payload (Dridex)", "value": "b178ead89bc1a707c12641a76c82337f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125063, "uuid": "a2a8819a-0092-4bdf-a078-fb3d6a1472d1", "comment": "Malware payload (Dridex)", "value": "1ef6acf91191a97b808c059d259621527f1b81640b2e366de83534ca61bb6f10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125063, "uuid": "34264b86-3611-43f0-926e-1280b9885513", "comment": "Malware payload (Dridex)", "value": "c913afcba2fc2c890f8bb0242c5234804fea6d1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125063, "uuid": "9c41f9ed-32d3-4191-9e03-ce2ec9ec4b4e", "comment": "Malware payload (Dridex)", "value": "a464024b06fbb1716370a4109e4e667c13888f8c7db8a103cf2e308f830df7c95930fe5365099e890ab505faa7cd48a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125063, "uuid": "0cdffc93-b16a-4278-9e06-09ab44d0a6e4", "value": "T13FA5D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392708F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125063, "uuid": "ebf14ac2-e1d3-41c3-8530-35b4b93a4c75", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125063, "uuid": "2e71ab42-c158-4a47-9918-bd55a28a7d7c", "value": "12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125063, "uuid": "70d9c773-af05-4a84-b436-3ce44f5891a8", "value": 2084864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125063, "uuid": "4c8030a0-0427-4d55-9ce8-c348a82d8686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125063, "uuid": "bc6dc2ba-b7ad-49f7-bd72-1be01202e189", "value": "1ef6acf91191a97b808c059d259621527f1b81640b2e366de83534ca61bb6f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db8def8-1a3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632161892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632161892, "uuid": "17db26d2-1f7c-45ea-9e15-29452651b233", "comment": "Malware payload (Formbook)", "value": "efe545e522545ef40bfcbacca20c71fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632161892, "uuid": "388ddc9c-59f4-42ed-b1a2-1b37d9dc9186", "comment": "Malware payload (Formbook)", "value": "1fad173e519f8c7cb34093e926807794765789e79d377e89ffe201ae8d76dd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632161892, "uuid": "e1bf58cf-72e8-445e-84d8-856385e1e128", "comment": "Malware payload (Formbook)", "value": "977ff6a2a699c8d10db1797334f0aa0ec5893a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632161892, "uuid": "356db80b-7ab9-4e64-a384-f1b2361de7ac", "comment": "Malware payload (Formbook)", "value": "580700fc544a47434f208bef80afacba472f3891951bfaa1d96179b6cc08d60b674651f9c04048a731dfd46fa064547e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632161892, "uuid": "220d1c8f-18fe-4a6f-9fbf-9f8f13d1d2d2", "value": "T101059DD13D47D89BF4DF2AB398AFC1201164AD8D9171C73D26867A2B55F331230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632161892, "uuid": "1bc29947-7042-4084-8f73-1cfd5353879f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632161892, "uuid": "12da172e-6915-49b3-9879-919595f859a6", "value": "12288:HsNpRUvsmtiK5oUZN3cIjn2YIGnraJk9JQW00aqvYqhAIWIGV5fnGQK:HeUU+FomMIjn2pJkU0DlA3IGV9nZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632161892, "uuid": "c2bb208e-1d22-42ce-8f4e-47d2829ce743", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632161892, "uuid": "341a2006-0644-4f85-bd12-a272e217e685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632161892, "uuid": "e17594c4-cf0f-4749-93de-bbcf770e2626", "value": "Payment Proof pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed81391-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632118112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118112, "uuid": "8b90e3b2-b68e-4905-9925-da3838e24588", "comment": "Malware payload (Loki)", "value": "95ae137753cdadd0d11fc71dcf77aa10", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118112, "uuid": "90ad0028-30fe-4323-9c4b-060514644303", "comment": "Malware payload (Loki)", "value": "205ca05566f009fc0422e6d852ff916190eb70a076f8502a95031fb49a25143e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118112, "uuid": "d5cea3f9-76cc-4b19-b252-fe72dc51268f", "comment": "Malware payload (Loki)", "value": "6edda6fb3be524b5246ceaae906e83b19843266a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118112, "uuid": "7d840896-c898-4262-9935-df51acb27cf1", "comment": "Malware payload (Loki)", "value": "cb928e50d9d0ec978476e49d0ad7a121b6fd7219b682cefe0d3cb871ff16b3ded123596481286aef6ba8c9182a276190", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118112, "uuid": "beaacc55-2c4a-48bc-89b2-54601c8a35de", "value": "T1AFD4F1A25A450D5BD28773F1AD88B02CE85DFC17DED49D5262B2F93CE9319BE20BC940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118112, "uuid": "122ee9ea-74c4-4a25-b1c9-82256e8e0ce0", "value": "12288:u5CWEMMJGAB1XZ6ALjy9LwtXKi2X0Ig3YHb78no:EdEMMJGAB1Q8L2XrGI78o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118112, "uuid": "c62cabe7-20e6-4dad-95e3-8ebcfa4372f1", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118112, "uuid": "7794e5df-6e12-413c-aaef-475ddcebad63", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118112, "uuid": "9cefa1c4-2e77-4a68-98e4-0f744ea0fb43", "value": "TT_2255124.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4c6d8f-1a42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632163368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163368, "uuid": "d1ed269f-4a50-4f25-b71e-cc6c6f2bcb75", "comment": "Malware payload (AveMariaRAT)", "value": "c102429375f69ded5cbb8dd55039feeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163368, "uuid": "fd56aebd-a3f1-4731-81db-8556344cec4f", "comment": "Malware payload (AveMariaRAT)", "value": "20848f043b222e670dd7373819912bffefb44e2c8b23c4b5e325128f2b93a906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163368, "uuid": "0d1822fa-3476-4422-b5bb-ef3b2b26098f", "comment": "Malware payload (AveMariaRAT)", "value": "949f36b1b8c2765b494a9186cc0ad14c98bc7066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163368, "uuid": "f669d339-f9c0-452f-bb17-7e64d3e056d9", "comment": "Malware payload (AveMariaRAT)", "value": "932ef2d336202894f2bc8659df42b06da408e04e242bd6dd2b4bb1108c8e7bfd8cd6a0077d9125cf18d302cb7b2e2856", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163368, "uuid": "5a07e693-eee1-4a19-af84-35853f4b0633", "value": "T1ED54AE331364EBB5F038B77DA5A3542407FAD127D32ADE637CA550C9C892C8907D3A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163368, "uuid": "b0dcf192-6f2e-43a7-9d04-27bd8fe097cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163368, "uuid": "440a9b18-f209-4d94-9e7c-fe86212de95b", "value": "6144:0R0hCbjJieaB7jiR7YwbGReKIGvDwuQ0Mde601rAR/:0R0OhQihlboeKIGvDEo601rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632163368, "uuid": "53be9adb-f460-4b06-86a2-74e814b314e9", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632163368, "uuid": "4803d481-3800-42e0-a968-458d6dfad312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163368, "uuid": "a144c9fe-42d1-4847-849a-5cd402116dc7", "value": "c102429375f69ded5cbb8dd55039feeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9b2754-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125599, "uuid": "9c226f79-0282-4160-ae3a-1470f598a802", "comment": "Malware payload (Dridex)", "value": "a610cbe6a78608af369bdc2c0fc8ce2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125599, "uuid": "1d124a47-8b55-4fab-a660-6b416b987fbe", "comment": "Malware payload (Dridex)", "value": "20a4bfb8a7b9c5cbb852cdd09977f21b0dadce16db41650ba0694f6a46348101", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125599, "uuid": "cf7586fd-5c2b-4496-81db-0f41cad2a590", "comment": "Malware payload (Dridex)", "value": "b9ba078e686ef9aadbf444a66fcf3168022df263", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125599, "uuid": "e1acc1da-9082-4b25-859f-3e81f4e4d198", "comment": "Malware payload (Dridex)", "value": "971783f40289d53d7717f65368236f8a5c8908d8172b7ae34ddb558df9df7401506569a50598f305a92da64cc74fa6be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125599, "uuid": "4e4582af-bf71-4ad8-beed-ee6ebd3fee61", "value": "T10F95D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125599, "uuid": "97bca31f-7f84-4842-8de2-39d41007fe5e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125599, "uuid": "1de2f453-093d-4d1a-a7be-69e59719d686", "value": "12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1s:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125599, "uuid": "d7914f14-cf77-4803-9f01-e4e87adb5690", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125599, "uuid": "ead8d336-1ccb-4fcf-a242-2948a625581a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125599, "uuid": "ca690482-cb8a-4c46-b220-6cea166c7670", "value": "20a4bfb8a7b9c5cbb852cdd09977f21b0dadce16db41650ba0694f6a46348101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577aabdb-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632148675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148675, "uuid": "e137f5d3-9e8a-4ebe-85ce-51f33d5e1429", "comment": "Malware payload (GuLoader)", "value": "2ba3d3f36945ba613b420ac3f75b28d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148675, "uuid": "46c33d61-6ab0-4182-9e9d-1e7f23c0776f", "comment": "Malware payload (GuLoader)", "value": "20a6a6e3b03ae7c22fbd9a664e07ef3f43c47759daf2755be1bfac87eb404baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148675, "uuid": "3f52f9d4-f0aa-4253-92b8-a21ce36dd4d5", "comment": "Malware payload (GuLoader)", "value": "ee246cc1ca1d9e448c881d9941c3f2f31f8e1c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148675, "uuid": "9440942c-4f4c-4797-8800-6d9bbd68a98f", "comment": "Malware payload (GuLoader)", "value": "2c3d5e85e0b4f7739bc381b9da5346213495b8b64c4336d96bc84448e2a7414645c482ab39574de63ce8ea116179f99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148675, "uuid": "ee678363-3bd7-4713-9fe1-befd61c79482", "value": "T108A36B6272F0E018E0D6877DC1EE86BD4921FC66C952480F2D507E4EF932F45A69E62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148675, "uuid": "c015bf48-5118-4adc-a0ab-b58f84932b68", "value": "46a3f7ddb0f0c8119624bc2c421c65ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148675, "uuid": "564387ed-368c-461a-8fae-48552abf740a", "value": "768:4wDpcT7kK6WKX/OcFNgSJy2SbnegiJVGoM+1OL7sWui+cip9pjxvUCu5P4NDK2VH:nDpc2702C4J73O7MBxsDmNDK2VvxUaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148675, "uuid": "f088a8d6-551b-4f90-9672-a78dde341868", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148675, "uuid": "2a671094-4e44-457e-8de9-51ac9b45d5c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148675, "uuid": "302c18e6-547e-46e5-b933-a227461bd8ab", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a02bd2-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125606, "uuid": "5342e2e5-1f08-492e-9063-9447365b0b3b", "comment": "Malware payload (Dridex)", "value": "a7680c8e3395e9351002385bd9967b30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125606, "uuid": "d8282412-292f-44ce-b7ab-79260f6aa388", "comment": "Malware payload (Dridex)", "value": "20b8fafa90179246421d2fa1a3db5d4380bfe4ed204376f88e54e1727b77b138", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125606, "uuid": "f163a727-60c6-49c4-8dbc-c39abf031e8e", "comment": "Malware payload (Dridex)", "value": "99963a4e5f0680fb5bdc6e26a257c4df4c46b510", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125606, "uuid": "3556ed72-042e-49ca-bc69-798badff9a0f", "comment": "Malware payload (Dridex)", "value": "ed2130b03df5b17deee7f6453323ecc8f06aa2f305658d41b5e9caea9eae0f2bf7bbc62a5112aec186c32229d0dc5d9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125606, "uuid": "ff91c4bb-bb33-41ad-91e4-d07d6f138990", "value": "T12995D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125606, "uuid": "7bf61cfc-81fd-4895-81bd-febc983aeea3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125606, "uuid": "34e17d63-31b1-4132-af65-5a7aab6b84ee", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125606, "uuid": "17720559-f33f-4018-9906-a91cf434aefe", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125606, "uuid": "e3eef9e7-684e-4432-bdf6-41dd9e896a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125606, "uuid": "7df0289b-43dc-4cea-b7f3-9038f836bd37", "value": "20b8fafa90179246421d2fa1a3db5d4380bfe4ed204376f88e54e1727b77b138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b747ae72-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632146258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146258, "uuid": "b5b243b8-b2c4-4f74-ab72-84dbb95cc302", "comment": "Malware payload (SnakeKeylogger)", "value": "9a2baf76d80f9c34fabe57282fa41172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146258, "uuid": "4c95d0b7-b066-4150-855c-2fb44b7d7f31", "comment": "Malware payload (SnakeKeylogger)", "value": "229a81a3b6e087abf33c1efc636c1d53f16edcc38d85a4b770eea39b89450bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146258, "uuid": "d0bf8a15-8972-41da-9272-6c8d15df8117", "comment": "Malware payload (SnakeKeylogger)", "value": "b3690581b89867c747f847b39630c61f1a683354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146258, "uuid": "8c3178ae-6f80-4184-8621-739862d7b471", "comment": "Malware payload (SnakeKeylogger)", "value": "1539b922800950bc0040dba4217e3ff88cfcb73c26c5ef017b9a1908ce9c73d1877f4465d36fcf5628408ab6b5415365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146258, "uuid": "91f3006c-1672-43d7-b20a-1afaf9d0d8d7", "value": "T144F49DC17D47D89BF4DF2AF3986FC42011646E8D9165C73D2692BA2B55F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146258, "uuid": "cf74de63-a9bf-4828-8830-6e69b35b7724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146258, "uuid": "503f1cb1-bb18-44d1-b1eb-0d732a64d15c", "value": "12288:55MTdKCTZsmtiK5oyZ7vj8/dGB4cbhf9b/BV6Ic1OVckQ/4ueSc:BZ+FoWvj8YnBp/BVMIVckE4u7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146258, "uuid": "e5611eb8-838f-4a34-a059-651a6de19bc5", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146258, "uuid": "5851339e-3c6d-41b8-a748-3bbe264a7a6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146258, "uuid": "a31e92d0-816b-49ca-8e31-2f99c1fb49b3", "value": "9a2baf76d80f9c34fabe57282fa41172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde3ce02-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125224, "uuid": "c1af871d-d7de-4ce1-9361-a3dd4df5fe24", "comment": "Malware payload (Dridex)", "value": "196894e8e1b104b90d2bda7bbd506aad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125224, "uuid": "2f88ce65-d494-4ae0-a556-7a7dda02e9c3", "comment": "Malware payload (Dridex)", "value": "2333c2d09ff9f77f6059834fd49bc59badd21e667947573673d57899a8ffde4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125224, "uuid": "e694f521-0925-46e3-a7d7-d156bd382d29", "comment": "Malware payload (Dridex)", "value": "467a853dda47d1c2006082197e020b10230c07c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125224, "uuid": "cb2015f7-8328-44f4-ab30-a5a709ee8b1a", "comment": "Malware payload (Dridex)", "value": "233a08b3f0b0f3807635d9c16bbe6e95eac8e6033e39de7dce53d069296c0632056646b590627fa3def26f64f87ca080", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125224, "uuid": "7f0c74e8-ba87-43a3-b7cd-d93d031670eb", "value": "T17FA5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125224, "uuid": "05d905b1-f8ba-4733-a834-c031c74b8c2e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125224, "uuid": "aef29a30-b4b4-46ad-a958-e54bb04304ce", "value": "12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125224, "uuid": "62e6d199-471a-4a3e-aed2-8cdebcd87cbc", "value": 2129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125224, "uuid": "555fca92-d51d-4f7d-b548-1b03c542eb59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125224, "uuid": "5115dea4-6109-4789-b2ae-e44bad3ea967", "value": "2333c2d09ff9f77f6059834fd49bc59badd21e667947573673d57899a8ffde4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7173cc-1a39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632159638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159638, "uuid": "505c04d5-6b6e-493e-96fa-a13412555a32", "comment": "Malware payload (NetWire)", "value": "2a41ef7c698c0fb98b23387ccd1314df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159638, "uuid": "c9402601-9c33-4ac9-86ef-b971cf1b2060", "comment": "Malware payload (NetWire)", "value": "23f943791b5757309e0fa0531c4f347ecba3d45d568cd1aae3f6828af0c0ea1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159638, "uuid": "31e61dda-2512-49d0-bcfd-a0ba081e43e8", "comment": "Malware payload (NetWire)", "value": "104061e6bb2457cd2a9578e2d52e262e5516066d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159638, "uuid": "4d966293-205d-4773-b25b-cda52e371cdf", "comment": "Malware payload (NetWire)", "value": "dedee09673ec1b75a50419dd6890f9288e155fa3e41b9a4c63ff560ed824e70b5cfc852dfc0498b600e09418ba610128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159638, "uuid": "842235e2-2cb4-4498-87aa-ed06c82da862", "value": "T11E05ADC13D47D89BF4DF2AB398AFC4201165AE8D9161C73D26927B2B54F3352306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159638, "uuid": "09f887ab-2a91-452a-91ac-fcba2d2bd97d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159638, "uuid": "466bebbe-f623-48e2-a1ab-e0ab7f07ad42", "value": "12288:GqDijoMSmtiK5o6jZ4VhkOM1eDd56uYsXFVBHxyAXPXekGQK:Gs+Fo3cOagVXFP/XzZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159638, "uuid": "f1fa1d69-cf95-4af0-ae4a-d6b93e5719fc", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159638, "uuid": "e31851e9-9046-4bb4-9ff5-11b2caf328cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159638, "uuid": "d99b907b-04e2-46f6-9390-87da011b6340", "value": "CON#8735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8abab7f-1a33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632156971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156971, "uuid": "8635d3ff-edf6-44dd-867d-ca646d2a35d2", "comment": "Malware payload (Formbook)", "value": "2dc75823d888ef5f49a42ae0ec52e7d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156971, "uuid": "31e9b6ed-5047-4ea7-b1cd-6daa065cbd88", "comment": "Malware payload (Formbook)", "value": "2519d3c81b62ad689a15a96d31d15c353558f78b4b64af3eff67c93c22a86df6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156971, "uuid": "8985e1ac-6334-4e97-a913-d675e7de2e22", "comment": "Malware payload (Formbook)", "value": "1149cf97632f315d2a0119910946c7a2ef5cd52f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156971, "uuid": "1a77aea7-668f-4da9-949d-98de74698a2d", "comment": "Malware payload (Formbook)", "value": "cdc04b487a902fa05a081dd19793ff5de7fadb92c26399d0c5a5f5b5095ab84c0093165d4284e3bdba907620878be5c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156971, "uuid": "9a3429e2-9ebb-4f51-9cd1-700fecf066df", "value": "T154D4390213D18B84D67D7734B674960493F2F1EB6A62DB2E8B4150E66F633825F4F32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156971, "uuid": "a5e3fa59-db72-4e31-b1c7-c55bf11bcaa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156971, "uuid": "d431c2da-e9dd-4d36-9ecd-615975ffde41", "value": "12288:tjFqR3EG3wHKJbawLLsPDE+GTVKkKFai:pFqZE8wYbNLsgxV1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156971, "uuid": "bc722c1f-b4e6-4c3f-9cfc-0b883b136c60", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156971, "uuid": "d1355589-b86d-4639-8584-3fc5f50f3e17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156971, "uuid": "9decb8b8-ac05-4540-872f-8070735fb42e", "value": "2dc75823d888ef5f49a42ae0ec52e7d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff51e422-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632160982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160982, "uuid": "809b8387-27fd-4026-a279-ec6f6e764d1c", "comment": "Malware payload (Dridex)", "value": "8b22df205e4c8fa137cf4535c17f9615", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160982, "uuid": "4eef000f-10c6-444c-ad58-64fe1efc4485", "comment": "Malware payload (Dridex)", "value": "261887acf9e4803b4eb8bf23c0d70a2f3c7ec9cdf0696a1eb64a34bdff646ea9", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160982, "uuid": "2f353a0d-f4f9-4651-8c0f-fd6cb6056215", "comment": "Malware payload (Dridex)", "value": "311c64f4c153f4195e45e5592ad1b03a82d6ef06", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160982, "uuid": "03b25267-912b-4212-9b93-2dc4cf08c69c", "comment": "Malware payload (Dridex)", "value": "40721dd64fed703951a4341c45c68db6b6742d8d781d3a115a2e4ed39c1f365bcf9b9d179d368fd6b693d9d3fd771627", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160982, "uuid": "73a7a466-ffb1-42f8-ad35-05e9e6017465", "value": "T13614E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160982, "uuid": "bf3c32fc-8b2b-487b-bc5f-63cfd3f5e908", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160982, "uuid": "1a2ba3e0-4a71-4e9b-88fe-511130a0be01", "value": "3072:39g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCesnC:39g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160982, "uuid": "e4814550-684b-4985-861f-ecdbf683fc56", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160982, "uuid": "96814687-fe21-4a70-87bf-200a615a55d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160982, "uuid": "d8e7143e-71d5-4352-acd4-381e338e4a52", "value": "3_System.Diagnostics.Contracts.dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a889cd68-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143657, "uuid": "bb4d15be-6ad1-4aff-91e3-44a995245f7b", "comment": "Malware payload", "value": "cc9962573b5d49b484722318f0b23aed", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143657, "uuid": "35ecbe1b-51f1-40cf-8a3a-2724dd880bc3", "comment": "Malware payload", "value": "26be4f02b3c9548cad098dfb7d41aa57d420168b27130df0491ff0f6966ef307", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143657, "uuid": "ff85305f-cae5-4e28-a947-20b0b20d2195", "comment": "Malware payload", "value": "a1c0f16ee2fafb7af528245e3fead06276b72bc7", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143657, "uuid": "1c5f2679-e0d9-4a0e-9e0e-19e002e1b58f", "comment": "Malware payload", "value": "2a3fd155e26d1c22079e4e4cae6707a0e1e581333a0227648eb827ffaa6f30d9c3376e92063f08ad0e3ee36aca37ac4c", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143657, "uuid": "219a1169-79ef-4b11-be75-efa18f43e83c", "value": "T1A131FC37B486CE52F879B9B71C90B5390267D8702C70D4E9CADA8E9349B0B0A81E4AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143657, "uuid": "8ac064f7-ebfb-4846-b2ae-a70b65793306", "value": "48:wuBmCvWCJFLC3gXbCyCvW8tz5Dta+JsTAdHLsyQ+s:rFpQBa+JOsLls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143657, "uuid": "dc9f4139-0abc-4b00-a26d-8bd4b323d0f7", "value": 1740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143657, "uuid": "6fddd263-a443-4082-bc2a-f47e56cea258", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143657, "uuid": "d239ba8a-5875-4f78-ab63-5b48a22b3eaa", "value": "xbxcv.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75185a7-19e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632123039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123039, "uuid": "7ee7553a-c3d1-48d6-ad1f-117172cf438a", "comment": "Malware payload (ArkeiStealer)", "value": "614b81adda4b77d484362d08ac506502", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123039, "uuid": "67888dca-cfe2-46fc-901c-6caf28989e70", "comment": "Malware payload (ArkeiStealer)", "value": "27f1cb676fd7024b4fb99e610372d4434c598feae92decc398c86a91915dfc43", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123039, "uuid": "4559ce93-1120-461d-a10a-c0430ef0916b", "comment": "Malware payload (ArkeiStealer)", "value": "d99183886b6c3a381056afff3e9e847468a6db9a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123039, "uuid": "216735a7-459a-4956-9a02-7f9b1bfef522", "comment": "Malware payload (ArkeiStealer)", "value": "e9a3328809738552399f7f87627553c7314be0302fc3ca484c104815424d5e8b1ac1663f3e15c2ed554d280c9003e435", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123039, "uuid": "5cde432c-4e03-4afa-aba1-c3dca7eaf8fb", "value": "T126E4F120BAD1C035F1B712F859B693A8A83E3DB2577451CB22DA17FA16346E8DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123039, "uuid": "e332474a-0802-4589-a2bf-14d4003ccaf6", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123039, "uuid": "ab3df67b-529e-4784-a739-096d9e45b8a5", "value": "12288:WZMDIYHdG2WzXiYL6zjgsGvIjSlHVCR7ERb5b2W7/kCm1qJ:W6DIYIPaGQjgHJRb5X7/kCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632123039, "uuid": "82a96752-8375-41cf-b57b-fd7d7539e8ab", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632123039, "uuid": "e63e2180-bef7-4428-a2ac-29efae464428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123039, "uuid": "029e421c-29ab-457d-aea6-9f749bfd31a7", "value": "614b81adda4b77d484362d08ac506502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67347959-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125508, "uuid": "53258e64-6b5b-47b2-a093-84313ec90e58", "comment": "Malware payload (Dridex)", "value": "41284221720333e5cb401d885f13d7d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125508, "uuid": "3e995725-6017-4816-b9fb-692f8bf0c3c6", "comment": "Malware payload (Dridex)", "value": "27f2971b1ffb8ab4107ae0ea03f6780de4e07a5e9b2ddd861eeb34b97e58f3e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125508, "uuid": "0c2e0d20-49c2-4ccd-9e62-4a315ca69cce", "comment": "Malware payload (Dridex)", "value": "239a54e9b330a9fd3ce84f098e4ff9a3317dfc8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125508, "uuid": "84e26b10-35df-4e64-88dd-05bfa86e84a2", "comment": "Malware payload (Dridex)", "value": "82929029b48baf223ced150a219aebf5ba12d87787473c29f21692a4c3b8964c68492bc81629619b3f96801cd3d88a47", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125508, "uuid": "dc3455dd-a7b3-4b0b-90b6-372d215a481c", "value": "T1B195D020EF69E1F6C6B89F3E9408352727B93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125508, "uuid": "f6e260f2-965e-4c3a-835a-a30ba3f3fa73", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125508, "uuid": "7cf3fd69-b4e6-4ec6-b822-1d2faef23e59", "value": "12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125508, "uuid": "58c6e5bf-200f-4d89-bbd4-e9e4ff23b926", "value": 1937408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125508, "uuid": "8e777e93-2b0e-4f8d-94d6-f04d2f512c55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125508, "uuid": "4a4db9ec-e464-4aa0-bc57-b7b6d00c529c", "value": "27f2971b1ffb8ab4107ae0ea03f6780de4e07a5e9b2ddd861eeb34b97e58f3e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de2ce11-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632146484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146484, "uuid": "25e57080-401e-413c-903e-7c68ad3e4e5f", "comment": "Malware payload (Loki)", "value": "a96ab325cb199f7130a1496e377cdb58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146484, "uuid": "d6e62f54-9b1b-475a-a2ba-66f6f6ee2629", "comment": "Malware payload (Loki)", "value": "2820be3e65b99abe8dcf1a8eea93b6e34237371efa4198b1237bb17a606ca407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146484, "uuid": "00a95340-6bca-4330-9296-15532c8793ea", "comment": "Malware payload (Loki)", "value": "8d0da5e8ad78bc60ae438b27f2c3a75cc7393640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146484, "uuid": "907e5b35-d2f3-44b5-87ea-0e84f39c4997", "comment": "Malware payload (Loki)", "value": "f23859de2730f5f85cdc933504e3ffef3c246edddecad7fa31017ec4858fb20763f05de4b1b95ee1f855171104666ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146484, "uuid": "fc3d8a4d-2b00-480e-8c50-4aa3fc7c49ca", "value": "T160F49DC17D47D89BF4DF2AB3986FC02011656E9D9161C73D2692BA2B55F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146484, "uuid": "008eebc6-a543-43e5-b838-22472d489e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146484, "uuid": "10e4886e-8e54-4244-8c36-744c1708395e", "value": "12288:H5MTdPWVZsmtiK5oyZvhjouNqZXBboiQjOL+McjKKmJbKgIoeG4AS8:ev+Fokh8BbbjQ4+M4JWbKbJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146484, "uuid": "a885f54b-b8f5-41f1-90f8-72ddb1b4e9b6", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146484, "uuid": "58c16097-13bc-4692-a9bb-e8ad8fb37ccd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146484, "uuid": "12867331-e57a-4eff-9f16-c2bf5ff51a73", "value": "a96ab325cb199f7130a1496e377cdb58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f20d574-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125387, "uuid": "e65cb544-3c09-4289-936c-195a836c386a", "comment": "Malware payload (Dridex)", "value": "fada20f8b947c342eb529c4b62b74819", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125387, "uuid": "3169d3f3-0926-48dd-b1f7-023ba2f7dc0e", "comment": "Malware payload (Dridex)", "value": "284bcca9042149b3146f06137813f1d070beea3d20575f354935782a3c7021eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125387, "uuid": "0df8bfdf-160c-47b5-addb-c9ae63ec1ccb", "comment": "Malware payload (Dridex)", "value": "7a37a6fe91a510abd05333b6a966062670f9d8b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125387, "uuid": "8d69181f-2b5e-4ff9-ad26-5af932369fce", "comment": "Malware payload (Dridex)", "value": "451233fda9903d893069f290ff733beed2c132c918173615fd83c65d1c38c027db615353c34dcf4f1930de05de8febe8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125387, "uuid": "a2abb64b-3600-483b-a1fa-d5efc96c6229", "value": "T170A5D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125387, "uuid": "941d17af-7ba4-4085-b1af-24e84c25a26d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125387, "uuid": "6f7a94d3-0598-448d-a825-fd0657df2234", "value": "12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125387, "uuid": "decb1917-d721-4319-a33a-6bde59ef92f9", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125387, "uuid": "f5972c6a-16ba-4652-8c1c-283962976828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125387, "uuid": "c908a0bf-0324-44bf-966c-626276a936b8", "value": "284bcca9042149b3146f06137813f1d070beea3d20575f354935782a3c7021eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcf97c2-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632145249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145249, "uuid": "d82d6214-13a0-43dc-9cc4-03ca82c6784a", "comment": "Malware payload (SnakeKeylogger)", "value": "8558ee81ee676e88db41bbe72f339f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145249, "uuid": "944452cc-622a-494b-a02f-1b2b82196dd1", "comment": "Malware payload (SnakeKeylogger)", "value": "290c8950d6cce06c3299c4fc36f25312c11a19abd0c1ede6809b764da15d4951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145249, "uuid": "d1b24260-703d-42ab-974c-fa27426263d2", "comment": "Malware payload (SnakeKeylogger)", "value": "6c7e5d9108c3fcaa6946011e56bdaf20fde69a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145249, "uuid": "23e64f53-09f2-4599-8da0-43a3d6588495", "comment": "Malware payload (SnakeKeylogger)", "value": "837f48300787972df8a0ed7203a8f8997d3c23aff724e168ae386b15184281422e72cab4eecd16c16fd4d6cac7de15b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145249, "uuid": "e0ab7b3f-554a-4456-ab9d-ab1fd91aae0a", "value": "T1DF641213F2E443F3D05618B50127B679B77EC305A05A0A43473CAFB11AA7BC9563AE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145249, "uuid": "9f5730b0-1871-4ae9-a2e8-2aba0dae7605", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145249, "uuid": "c8b929fd-aef1-4f4e-9f17-c1d3fe4b876d", "value": "6144:38LxBpKq+b3EiHoclEFsS8vgtKioVL5Mle3asMo6NqlSLanufldhs:UKq+gMn2P8vgxzleKsWza6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145249, "uuid": "4823a93d-0ee6-4e53-a4f4-6c19e2deda52", "value": 310797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145249, "uuid": "ec53f170-51a0-463d-a105-08b910fee238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145249, "uuid": "0114e455-17d6-472d-96e5-91dd04761b1c", "value": "245898643234998765457890-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ada3dd-19e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632122976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122976, "uuid": "85056a9e-8176-4bd7-99d5-313ef53fa917", "comment": "Malware payload", "value": "08526aeea012d110fa280c27d67c1b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122976, "uuid": "e80ff6a5-c9ab-4fad-8730-54974892629d", "comment": "Malware payload", "value": "293e9d691076d1b23090f9df8a3605b61448dc83126990cbde71ff97563bbc1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122976, "uuid": "2a117060-9479-4fe0-a1fa-25ff1a1fa000", "comment": "Malware payload", "value": "e61cfc69f91e7b8c5a3589cfd7d236225e54e979", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122976, "uuid": "d110e3a5-fa33-4bb7-bb80-bdef12f3439b", "comment": "Malware payload", "value": "31c4fabca4ebf3b54223290900aa2734d5aeeadd1c9f08dd840e2208f1189efd414ae4a34b69c31dadd8f42fedaa2de7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122976, "uuid": "55ea843a-8cd7-488c-863b-e3f60d2db652", "value": "T10854DFF323448EA0EDBA0B7281A2F6548776EE662C20E137F1C971594B3F7978E83545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122976, "uuid": "54d5244c-7728-4106-bfa5-9df0aee84c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122976, "uuid": "1fbac778-7703-41c4-af22-dc64875a883c", "value": "6144:7npHy9ncstDPLhhx8m7EN4pbdOe4eUL1KxgoPzygx8Xoa8:zp4D18l4pRO5eCUXrygx8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632122976, "uuid": "e52ea9ef-564f-447f-a8eb-3fa9196df6eb", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632122976, "uuid": "b6af10fc-c8fa-4178-819b-606ede895d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122976, "uuid": "b3024ba1-8348-48dc-87aa-90f9d7431a5d", "value": "08526aeea012d110fa280c27d67c1b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7716bae-19ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632134770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134770, "uuid": "3ade6845-347b-4c22-abc8-81508d89f2cd", "comment": "Malware payload (RaccoonStealer)", "value": "c4f267cb881e0a7f999b3e639772b351", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134770, "uuid": "1b2a887f-1cbd-4af6-8914-5a03e3bfc55a", "comment": "Malware payload (RaccoonStealer)", "value": "2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134770, "uuid": "9d032c5b-a6dc-447e-a879-245f7b1fa880", "comment": "Malware payload (RaccoonStealer)", "value": "bae6a97dd1fb9cf5c2372ff92588a2b59efd953a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134770, "uuid": "2cf871f2-9d86-4dfd-94b9-64bde14f0bbb", "comment": "Malware payload (RaccoonStealer)", "value": "5410a8af8265f1ea32b14fe4c54062964f1507a1ec6309e8f54af46e72c586187a0241a9e5baebb81ff8ce8c1481cfaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134770, "uuid": "03eccea2-9bed-45ec-9f07-1664e0a32ff6", "value": "T1A1B4F130A6E0C035E4B712F855AA93B9B83D7AB15B2445CF62D64AFE2734AF49C30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134770, "uuid": "7ffad57b-bce7-4975-ae03-930d36c5385c", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134770, "uuid": "3d63a4d4-44ef-4482-b34e-20f4bb8db989", "value": "12288:9Zat9/AuR4MbEqtz2hmNEff6a55TKEpqtz2c55xHQ:9It93yqtz2lfrlqtz2UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134770, "uuid": "50c8d4dc-7150-4d79-9b6c-2dcd1f5e9c90", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134770, "uuid": "ec711b4f-3e16-40c8-a2f9-c0dedf04eb9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134770, "uuid": "2b6115d9-7f44-4747-8234-95cd7e4aa5e0", "value": "c4f267cb881e0a7f999b3e639772b351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bea103-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632160721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160721, "uuid": "38315908-de5d-4d69-99b5-95a48fceedf4", "comment": "Malware payload", "value": "5486c033307d5da84082fbd9fd3598d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160721, "uuid": "a4affe27-1f9e-4316-aa8a-84c3552055d5", "comment": "Malware payload", "value": "2aeeccf99a72c8ba21ba9263a9536121f5c103730b30c4013a594da60628cac6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160721, "uuid": "03f91fe5-a284-444f-867a-94d817b1a530", "comment": "Malware payload", "value": "925ac527b579a56eb75083a004a9f735d90cf1c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160721, "uuid": "c714835f-8c0b-4cee-bc5c-1373c5352089", "comment": "Malware payload", "value": "685d3c52571b2c31ba15a4e7cedd406a90b317221993078059d07fe81b61c9003c9733566097ac7a2230d7c6797164f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160721, "uuid": "90725b37-a840-43b0-a65f-a5da14866449", "value": "T11F545C23F6C5D57BD16A0A320DA69D94E93FB6203B474C57AAF40C4CCD6D2813A29B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160721, "uuid": "2def27f6-4bfa-4355-a170-998d0556af3f", "value": "6144:JbQ2tBjyaN/ZDVMfLY/UiiOPdFIKQlgUG6inu9+:JccFyQh5cKdJP/KgL7u9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160721, "uuid": "a2786292-fb9c-4dcf-aa8e-998a604f772d", "value": 295119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160721, "uuid": "3c9a1886-d3cd-4dd9-94d4-041005fff095", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160721, "uuid": "26fc9bdd-2579-4868-b257-b5b0600cbc3f", "value": "5486c033307d5da84082fbd9fd3598d3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ed5ab2-1a40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632162357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162357, "uuid": "269c20ec-0611-4464-bc74-b28b4a6bfe3f", "comment": "Malware payload (RaccoonStealer)", "value": "42850c36ca17f7e775e87a95dca744f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162357, "uuid": "c75ba080-193a-4733-a76c-fa748d725094", "comment": "Malware payload (RaccoonStealer)", "value": "2b02adf3804e5619fd773ca23b73b96b30441ae42fbecab2d08fa0e3e3794cd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162357, "uuid": "31a4ee5b-2434-43ae-91cb-0409a4c7afc3", "comment": "Malware payload (RaccoonStealer)", "value": "fed5b0b9dd60ba96e2a51627e85c9eb0af2b2c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162357, "uuid": "37b86012-eb99-4835-83f8-d0719ab74f09", "comment": "Malware payload (RaccoonStealer)", "value": "12fb7a0a698f43c023ebb4dd177be395ebbfc2d4b865c4849875a2d7f3774d94d0bf3b14604acbd4f1d541298cd991a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162357, "uuid": "c2614854-cb87-4e34-985b-5a0a0568de22", "value": "T1E0B4E120B6E0C035E5B7D2F49979E3B8A83D7DB19B2051CF62C526EE26346E49D30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162357, "uuid": "72ee8bee-399f-4b84-8364-d1faba555611", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162357, "uuid": "402fb0fb-54a3-480a-9687-7d74ab84cebe", "value": "12288:ZHqe1Gw6rtPqtTYKf3ov00ae6QS3zInpNPvp2ImS:ZT1WrsBYW4HgHInvpdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162357, "uuid": "7bfee2f6-bcff-45e1-8aa9-848479e50aa9", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162357, "uuid": "90268fcb-e3c0-4c6f-81b8-56ee96ef3c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162357, "uuid": "b61e286d-9d2f-4b63-b397-55ab038e3a27", "value": "42850c36ca17f7e775e87a95dca744f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2e0bea-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632146347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146347, "uuid": "f676b454-8049-4d7c-9e64-d03cd32d4a27", "comment": "Malware payload (CryptBot)", "value": "2defac4bad28d2dc1851969d7d08b2bb", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146347, "uuid": "d1668689-e993-4ed5-ba31-b7d49d7b041d", "comment": "Malware payload (CryptBot)", "value": "2b6e1de5e6b89cac7c0fe12c764fc37bc18340303844b1bdf83cf01a71a4f61b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146347, "uuid": "602a6569-bf24-4bdf-9004-8ab8fad4e66e", "comment": "Malware payload (CryptBot)", "value": "f8b6e502f6eaa82a64f44574973d26978675ef85", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146347, "uuid": "4b1200b5-a2c3-48eb-831b-035d4069670b", "comment": "Malware payload (CryptBot)", "value": "f01884805840a9e9a3bf8cf1a5fd5fc45b2ecfee611f1ada08e7de46f29057a3b9fafe1b93ce0552251725c66fd87f25", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146347, "uuid": "a139c20f-4424-4a10-aec4-bd8edb6b55f0", "value": "T19074CF20B7E0C035F1B712F849BA93A8A53D7AB19B3091CF62D616EE62346E4DC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146347, "uuid": "b774cb9b-4384-4cf0-b835-e4469e52b974", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146347, "uuid": "76c77825-67ad-4f81-bd2f-47e68069a492", "value": "6144:rXZQNQN3lTev/uWwFuPyOd7AvlBWnSKNFfJfu6z3GI+8:LZV3lTev/z5PyOtABeS6jfu6zG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146347, "uuid": "72666aa2-f60b-4d8f-ae56-894c9795f722", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146347, "uuid": "e0e82798-ab62-4865-b925-c33d116e869c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146347, "uuid": "40ebaa87-bb36-4c24-b289-e3b9f78cd922", "value": "2defac4bad28d2dc1851969d7d08b2bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60439b93-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125067, "uuid": "f62165b6-a6c1-4773-b77e-76ad502b7d7f", "comment": "Malware payload (Dridex)", "value": "1c00d70ce31282f7c0defb03f7508a8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125067, "uuid": "920ee2be-bbe4-497c-bb2a-4ea8da09853b", "comment": "Malware payload (Dridex)", "value": "2b70301c0ff77c1a33c0cb6953ea7c7936ba0194d48b6f318435a12d9991db8a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125067, "uuid": "9abf8a9f-d101-4ffe-bfc7-cc55891db771", "comment": "Malware payload (Dridex)", "value": "90281ba2f97706950832506a82cd4ff63a985396", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125067, "uuid": "97389f1f-40dd-49ff-bebd-15d6faf001ec", "comment": "Malware payload (Dridex)", "value": "1d43f95f3ddab24990019cbc74ac3b5855c0d14c841e5b520eb50bf1155097ad4696cc2c3bf602d88a531bb34d100c32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125067, "uuid": "8f08c4dd-4b4c-475a-99f1-24bdc3563701", "value": "T1F295D020EF69E1E6C6B89F3E9408352717B93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125067, "uuid": "2ac26aaf-a66a-49e9-933a-571b0414f2e4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125067, "uuid": "2d3057e9-c393-4975-ab2a-63cafd073b33", "value": "12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125067, "uuid": "44a9cda1-7ee1-426d-a95f-d8d7f071a058", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125067, "uuid": "8834fc24-9a24-42b0-bc83-1ff2513e867c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125067, "uuid": "057e3b6d-e7d1-4986-8e15-557c9e6738e2", "value": "2b70301c0ff77c1a33c0cb6953ea7c7936ba0194d48b6f318435a12d9991db8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64adf379-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125074, "uuid": "f36ab235-8586-4df7-b068-868a49d65047", "comment": "Malware payload (Dridex)", "value": "257eb3e0a04dc3f038f911776ce516c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125074, "uuid": "dfa69c11-71a7-42d5-a5ae-ac44d44d6a78", "comment": "Malware payload (Dridex)", "value": "2bd8e47f57db1d4a2b48fa5cfc32965d01815aa96ebea53482090d27db2593da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125074, "uuid": "527b9c8c-c53b-4327-99b3-71cd7d70a200", "comment": "Malware payload (Dridex)", "value": "2fa2c6849a69377c3e82d5819139d814c5e216d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125074, "uuid": "26831e42-057f-4ad0-9fa9-5d63bf9c7979", "comment": "Malware payload (Dridex)", "value": "01e53361832b0c722d40f55a0df3fae57f9dc2637f1d1530b861237c7aa2aba52264dac7849276a3a3c9c9ec1383b538", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125074, "uuid": "1d129817-a5d9-4364-b39f-922d00097d25", "value": "T11EA5E020EE69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125074, "uuid": "aa5208d7-1607-4302-adef-d6d3914183c7", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125074, "uuid": "3c73067f-dd20-438d-a009-c3590b588de1", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125074, "uuid": "564975c8-b802-4ea1-ab50-f53220cc6f3c", "value": 2125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125074, "uuid": "188f6a11-6a29-44ff-bb08-c300d44ffb48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125074, "uuid": "89725e0b-2c52-4a37-be70-f2a1908e7998", "value": "2bd8e47f57db1d4a2b48fa5cfc32965d01815aa96ebea53482090d27db2593da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c1071d-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632155884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155884, "uuid": "e9c2541c-16a5-435c-adbf-b637c92a7e33", "comment": "Malware payload (Quakbot)", "value": "f002ca6169a457ccb1cdae83bee5ab45", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155884, "uuid": "0402da98-c365-4a25-8452-b32e1b0bdbb3", "comment": "Malware payload (Quakbot)", "value": "2c0b53d4da93978758d513176e8064e29721d271fbba9f5b55a83fbfbe8a8ff2", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155884, "uuid": "2ed3b0f3-e419-4561-99d7-33327c903bfe", "comment": "Malware payload (Quakbot)", "value": "7694bafacf352ca357f4921b006e969a52704801", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155884, "uuid": "708e7ef7-3bb0-4a68-ad47-adff3d3874eb", "comment": "Malware payload (Quakbot)", "value": "298c5cdb7071b2d9afda29fb9ae93c46633b9750354ff39361e33cd3e19807761257d6da3d6e5f611ef0b3fbe8dccf81", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155884, "uuid": "33b966d4-b36b-421d-9998-946e5743173d", "value": "T1CE149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155884, "uuid": "921e8018-f830-4267-8498-7b0fad1daea9", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155884, "uuid": "41c2fef4-34eb-4a20-a0fd-0efe3b839ff5", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155884, "uuid": "3d005021-13ad-4d0b-b750-e8419b82df9c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155884, "uuid": "e24b745b-2f80-439b-9828-bbd2108f759e", "value": "Document_143276485-Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a4e6b5-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125079, "uuid": "5f2d31fa-8ecb-4540-9792-f21eb9717c43", "comment": "Malware payload (Dridex)", "value": "43ba598562ba216ecfc70e4059066bf9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125079, "uuid": "729ca357-2926-454d-8ba6-22d962ba31df", "comment": "Malware payload (Dridex)", "value": "2c2f6bb4eac275ec76cb7c318bf86e35f8ebc424389a4bad4b1e4cabb1e1cf52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125079, "uuid": "8549e30a-79cd-4bd9-a2e8-afc41777ae23", "comment": "Malware payload (Dridex)", "value": "4b097ea7aaa7ad4ab273298e10bc631f91f990d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125079, "uuid": "dfce16d8-e1f4-4009-9caf-c51688e23bb4", "comment": "Malware payload (Dridex)", "value": "d2ddf6b4c7d6a9af41c54578f1b934ed68f3cb7b8b894b3b6675fd9e881487de52f26e734e374dd4d8f461d467a905e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125079, "uuid": "93ae395d-eca4-4bfb-818c-be0b61285c2a", "value": "T165A5E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125079, "uuid": "8f24f162-6ca7-4ca9-87c7-1c384ed49bb8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125079, "uuid": "b8b3fd99-021f-45f1-bb93-7385b7e9afb6", "value": "12288:oVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:9fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125079, "uuid": "6a5199d8-86f6-4e51-bf0e-fdeac2c35cda", "value": 2129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125079, "uuid": "6121fd3f-b9f4-4b27-8511-630cbed33fa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125079, "uuid": "3ba6534f-266f-430b-9642-1f8ecf6432e1", "value": "2c2f6bb4eac275ec76cb7c318bf86e35f8ebc424389a4bad4b1e4cabb1e1cf52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1d323f-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632160520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160520, "uuid": "74da0841-1abf-4eb7-9950-faad40c89c33", "comment": "Malware payload (Dridex)", "value": "43730fda714b3131edfd918ab631ee10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160520, "uuid": "886e374d-6e55-4408-a528-739d3ac8c791", "comment": "Malware payload (Dridex)", "value": "2c78b9a081efaf1bdfa896f3339a9900356c263bbc98d6544d43ba37c535e216", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160520, "uuid": "c9e933e7-4e0f-4a89-aa13-b3e5efc4b411", "comment": "Malware payload (Dridex)", "value": "42e21b0f6c2bc932a28064010b1771ca5a868e25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160520, "uuid": "ee9b9976-b074-4cc9-91a3-cc3a928144ec", "comment": "Malware payload (Dridex)", "value": "088d1224460a4cd275362f5bcb183a235d5613bb2a31a7f71174db1f328e7402fbbc40722cc85d91d7fe11aac1b94866", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160520, "uuid": "f9b7f6b2-29a3-45ae-a852-44fffe63dfcc", "value": "T12914D04BCC8A44DDF6363C366BBF2D7A5F2E07214A28DC29CF54D515AC2370AE45A1B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160520, "uuid": "67441787-dfcd-4c69-ad03-ce49226ef8c2", "value": "2640864aaa54b312b8f622402aa35be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160520, "uuid": "a6c95b16-f56a-48c3-a24d-6875d1daab94", "value": "3072:VCbhexUt6JzasssssssspciikZxitibxt1JQA+ONSfqJ/DkBD87dI/lyYZvCsssw:Vihe+lKibx6isqJ/DkB47QlyYpBxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160520, "uuid": "434a2c32-f5e6-40d1-a660-411e90432c92", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160520, "uuid": "69821299-5987-4f31-9420-6e33c5fecb52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160520, "uuid": "85b008a9-494a-43ec-bd28-7bd21e31d69f", "value": "43730fda714b3131edfd918ab631ee10.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e097170-19f6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1632130754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130754, "uuid": "4afd7e76-0db6-442a-a44f-a571d04f0172", "comment": "Malware payload (Gozi)", "value": "9a024750ca83441f6a1eb0357207f832", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130754, "uuid": "94999916-c04a-4c89-8343-17d8cc997e75", "comment": "Malware payload (Gozi)", "value": "2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130754, "uuid": "c2bbf3bc-f468-4ec6-a2cb-548d4da5ac08", "comment": "Malware payload (Gozi)", "value": "98451fe991746d4fb0ecade9a0bd318ba4eb9b6a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130754, "uuid": "ab81b7fc-9efd-446b-a06c-c121364388f9", "comment": "Malware payload (Gozi)", "value": "ab645611b4f60fa1a6ff233c50e7f138e84f2f41b0a5c09343d201e4a6c3fda653e7b33ec6fc2b1d84e45c9dc00a734c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130754, "uuid": "82ec09be-3682-48fc-8776-d9b578ef185f", "value": "T1EB84DF2BBED3D075C82D44B5C891DCE23678B8466D28C6937AD83F3F19B34816DAA14D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130754, "uuid": "329c2cde-fcdc-4794-bec8-d5c35f184ca1", "value": "03249db4bbf4306f07943f77d1f8b898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130754, "uuid": "49518683-952c-44b4-b349-6d68cbb08efc", "value": "6144:E3XNL4UBjlWzkeFxH3+umm6M0luIbNlPo5EbpB0d4R63SBe4+R8Slg5hL:S9rjlWznxXvmhM0lugA4vPR619mR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130754, "uuid": "36ac5cb5-3115-4a9b-b8fd-bf8aa96a799d", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130754, "uuid": "8998f9ff-ee7c-4585-bbef-a760f38c77d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130754, "uuid": "b31710a1-707f-4700-a1d7-23aee98f9fba", "value": "6.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21d54b6-1a23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632150115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150115, "uuid": "124cd81d-8968-4616-9e00-3b4f29c291cd", "comment": "Malware payload (SilentBuilder)", "value": "a4a5a716ba5413b0e58daf24ad20828a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150115, "uuid": "31c186cb-fff8-49a3-931e-235ae12521e5", "comment": "Malware payload (SilentBuilder)", "value": "2e92647a2100b6125b2261b7ac39557e59719cab558a7ed477f290cf21c1e94f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150115, "uuid": "c382dd26-9a51-4cd4-abd4-8a10608b5959", "comment": "Malware payload (SilentBuilder)", "value": "3d8edfcf69a0dee026439f239cf1dd0d9cf2643b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150115, "uuid": "a2ad310f-48ba-4e8e-aa10-69322a8d4589", "comment": "Malware payload (SilentBuilder)", "value": "4fb7407da787a96f418fd883d992c39a8fe3df9d19357d3dbfb3d9c60bb7e16d39d92acc62fed2db42a0e798cc3bf5af", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150115, "uuid": "4d5b140c-77aa-40fc-885e-407f20403635", "value": "T1DC44D02636A5A41DEC2D2B76A8BB53D02337FC504FD38BC77AA772263F726914D22405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150115, "uuid": "68bfab83-b411-453f-97ba-3e7332681a33", "value": "6144:mKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+knfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmU:kj7CqScwoRZ9bSXkh/nLKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632150115, "uuid": "153bf1d3-8d99-457a-a10e-616780497f0d", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632150115, "uuid": "2f67373a-1038-40ec-a224-da43301f9b5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150115, "uuid": "98942f1f-32d9-4217-9b15-7d2f598c80df", "value": "waffle2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca707f25-1a12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632142854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142854, "uuid": "6d0faa9c-e0d7-4f48-87c3-dbcdbf47e575", "comment": "Malware payload (RaccoonStealer)", "value": "cac6ea9f6ae2643141b2871eb17e1275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142854, "uuid": "dd286e58-1299-486d-a68e-3e67e38d536c", "comment": "Malware payload (RaccoonStealer)", "value": "2ee558d27a472efd85b46f58f827de607e5e631cb1212065837a52c2f19c8f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142854, "uuid": "0e58867e-c1a9-49d5-82f1-d32f59853aa8", "comment": "Malware payload (RaccoonStealer)", "value": "48ac91e4e83ae3b1a47a4a4183cfc73a537601f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142854, "uuid": "95bde9e4-6638-4c73-96fe-290fd7915a2e", "comment": "Malware payload (RaccoonStealer)", "value": "78b0e7348a30c779b390b50ca44ef8b2e195d1b81009b8f6994cbb9718537b2b8a97aa5cb2b0fc54290ba2fbec3d1d08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142854, "uuid": "5dbb5b1d-6b17-45c2-9903-96f4e5ff4461", "value": "T1DDB4D030B6E0C035E1F702F499B993A8A929FE715B6440CF62D966EE5635EE4DC30393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142854, "uuid": "54ecc296-bbc1-45d8-a9f4-e52176a6e816", "value": "e603d9ce78d3b843ff0481c06148bc9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142854, "uuid": "33c0426b-28fd-465a-b431-350553ee3346", "value": "12288:FXM5E6LDGeJwotLEqN7T+64P98P7AJR/k7WUSFwKaVKytMmCKu:FXC3fNPxPcJdkyUDKll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142854, "uuid": "1819dde6-7425-46ee-8337-1e5ad6759393", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142854, "uuid": "46a79b10-76bf-4bd4-9cfe-55ef416c8236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142854, "uuid": "0ec7356c-c58b-4df2-961c-1ba78fa76fc6", "value": "cac6ea9f6ae2643141b2871eb17e1275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152bb224-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632121076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121076, "uuid": "cae41fec-6ea0-475a-a7a9-94bdb9bd4709", "comment": "Malware payload (Loki)", "value": "9f502b3211bfe6427a8f15b28bfe3ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121076, "uuid": "07b6ea74-238a-42d6-9535-80b99ae32210", "comment": "Malware payload (Loki)", "value": "2ee8e4211b1058608bc165bda66fe8e8109aa14770f6a4085c3bc1c84ad386a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121076, "uuid": "056070bb-92ab-48eb-980a-36aff5e73007", "comment": "Malware payload (Loki)", "value": "d323e67c7380001488b594edb0f536c87fb41abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121076, "uuid": "ac9ac4b3-57c1-4e7d-a257-07313fb5ac85", "comment": "Malware payload (Loki)", "value": "fc6449c03c08c0b269f334bcffaea109a6c1f449d4a4fb4e83a1f07a04e52b44e2d02f5c8c54b6ecc96d3194f541a3cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121076, "uuid": "5ac56339-0361-41c7-992e-2156ab0b1745", "value": "T19B44121353C12967E3528BB0197AD32DF3E9581401616E4707D90FBF6EA67CE9B1222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121076, "uuid": "9a978ba0-713f-4dc5-bfa7-4040c66b1efa", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121076, "uuid": "d1905280-9a8f-43b4-9304-5ca84fcdfd66", "value": "6144:J8LxBegrTMNNUArpa1/DgAKpgZ12oc35tkc2koROUH9cIWrSimqxj:hSMFrpa1srIgoc3fkZkUOBhBxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121076, "uuid": "3334149f-1dae-4a18-8825-b8049a7734aa", "value": 255862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121076, "uuid": "bc1bb148-d8bc-41a0-bad0-0b6c0d03d0fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121076, "uuid": "04e14d09-818f-4e9a-96e9-51dc621d5182", "value": "9f502b3211bfe6427a8f15b28bfe3ff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bab0cd-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632121372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121372, "uuid": "7215f374-7b94-471d-9a13-be197445c7d5", "comment": "Malware payload (ArkeiStealer)", "value": "1f8093aab9bbb3facaa46ce260118edf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121372, "uuid": "c2e43d6d-ae49-4303-8f9a-c012cd29008f", "comment": "Malware payload (ArkeiStealer)", "value": "2effb8de90adbf31a46138949b9a52ef29a23f400aa08c0ff3149f44727a16fa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121372, "uuid": "606057b5-502a-4565-b62c-ddd0dc8fde43", "comment": "Malware payload (ArkeiStealer)", "value": "e55e2239b0b2dec74bd8e8500dc96458d59164dc", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121372, "uuid": "65099e9e-6ab7-4186-8165-212aa33065ca", "comment": "Malware payload (ArkeiStealer)", "value": "2b19bf23fd2785923c5b0755932183ec750d5326168cac89180ab5211391239d9c81c6dc6b4ad498b5fcd3578391d4c9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121372, "uuid": "1f8cf309-40dc-4b4d-ab96-3702a03e6be4", "value": "T13D95B023B2934433C67F2678BD3752689825BE112A38648A2FE51EDC5FF46413B352DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121372, "uuid": "c7ffc2ae-c1c2-4255-84fa-854e251538b8", "value": "ec88d30de283c50d44daff3be84036bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121372, "uuid": "a86fdda8-66bf-4c28-920f-d3a71aeb333b", "value": "49152:k7IMK8HmWcdf8luYj6zT9SrajsO1CsSGGKE:k7IMK8Gtf8YzzQrjsS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121372, "uuid": "078a567a-d5c9-4339-abb8-f6c8f179f07a", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121372, "uuid": "2a5e8429-b19a-47aa-9c25-20ef84af2d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121372, "uuid": "65c21a09-809d-41d1-979f-990d93d38ee6", "value": "1f8093aab9bbb3facaa46ce260118edf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf0a4e2-1a41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632163069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163069, "uuid": "99b3e8ef-d194-43d6-ac4c-5df65230b19f", "comment": "Malware payload (AgentTesla)", "value": "688a6c4ade0ff2074caec678c6abe257", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163069, "uuid": "c86a1acf-8c6d-47af-9d7f-b1f4ceba8666", "comment": "Malware payload (AgentTesla)", "value": "2f583ecda67b58e78819a7a31e9118c7a67291a90febb4f54c53c34bb2d35235", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163069, "uuid": "8e100908-55b7-4093-95f2-adb610225b7e", "comment": "Malware payload (AgentTesla)", "value": "b4408e9aecf776cf8c9578f0e62613077d798cea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632163069, "uuid": "df5fb30f-47df-40a4-8be3-34936c322b27", "comment": "Malware payload (AgentTesla)", "value": "a9460246f2a85634ad190a0e10cf7388faec57110f17bc78e81e00604e64bd979c3c9696ca31bc9d21dc2d27ee0d6d3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163069, "uuid": "fa02085a-adaa-469d-a895-4b425d0a8549", "value": "T1FA949B90B7CCC437E49E3271CAB7D56AB2279C68D985C7D7A3D0BA5E28390418D0F369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163069, "uuid": "c54ec39b-8b85-47ab-a28e-0229ae1950df", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163069, "uuid": "9ce56416-5174-4367-87b7-d06e174e9c84", "value": "6144:w8LxBYCsCUDz9NPDTgQlgITSX29F06tQS519tJQoyMcWrVfoNa:KnYQlgfI065VJSMcOloNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632163069, "uuid": "eff74510-994f-4d67-b701-b37b00b1c4b4", "value": 412740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632163069, "uuid": "70f0ce48-0b7a-4dde-97ac-eb1606b5f61d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632163069, "uuid": "aa67f528-da48-487b-a381-aef62f103cbf", "value": "INV NO 60385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97622d35-1a3a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632159949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159949, "uuid": "6e5e8f34-4a9d-4084-a28e-8ca6ab9964ee", "comment": "Malware payload (RaccoonStealer)", "value": "06e12205d7591a15a09984a1002eb612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159949, "uuid": "55fc6286-94f7-44a7-8b8a-2f8b1715bec4", "comment": "Malware payload (RaccoonStealer)", "value": "2fb51e6703b097776bf6612dcb9c07caa122762bb77703b4372fa426790894b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159949, "uuid": "f6c48fc4-d6b4-4d7f-a2ef-399915e3b9e5", "comment": "Malware payload (RaccoonStealer)", "value": "7595f54aa1a3023eb35b1df326d40782b8a718bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159949, "uuid": "fa2bab6c-b9dd-4c63-9f86-3d4aa4b81066", "comment": "Malware payload (RaccoonStealer)", "value": "035ab9aaa5f8a3bb6c0925ec01df7f5f179d9678ba9eb29c3b2ffdf0bc9212c9ee20e2879bd56fe9b6c7bc9febade567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159949, "uuid": "8b998db4-c3fe-4997-91b4-ebbe1a069cf4", "value": "T154B4E130BAE0C035E6B711F845B9D3A8A53E7EB15B2450CB32DA26EE17346E49D32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159949, "uuid": "9f5cc589-fd09-42f6-93ce-bd44db538d26", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159949, "uuid": "0bf3dfad-d581-4249-a062-2ad4632dc80f", "value": "12288:DKE8FrdarWPBISBhKk0LvxAK+sQ3f0UCXBaI5QnBSYZ:D2F8rqDwuK+xspaIGSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159949, "uuid": "0d9c29d3-5868-4c28-9200-f2dffe4f257d", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159949, "uuid": "e33b6dcc-9f61-4458-9ce2-44321ea31b9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159949, "uuid": "e2446e60-0ab1-40a9-a9ff-02d573eb614b", "value": "06e12205d7591a15a09984a1002eb612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8be706-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125084, "uuid": "5addcb43-e2b9-4d8c-8fa7-ecbdd7cd92c3", "comment": "Malware payload (Dridex)", "value": "02312ff0b3e01dc7cbbcc7e2dcbd9e30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125084, "uuid": "67635982-9605-455e-9f5c-7373ea33170c", "comment": "Malware payload (Dridex)", "value": "2fc71bbf53f3158b6f57ad938820666d68699800e812d4f2f6cc7fc70bb7afa8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125084, "uuid": "f8d461b3-842a-4b13-b948-a4d17673771b", "comment": "Malware payload (Dridex)", "value": "6f7cbbed456cb65e0616939bded9188566ade2d6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125084, "uuid": "bbfa8541-9980-48a7-8730-e89a71d9f2d5", "comment": "Malware payload (Dridex)", "value": "e39bb4bed545eda3529f22f72f4ec197c1f86fd4c6d9fb64eb8a21c5cfec82429c27983e00b5d5daa2328ebe293fe942", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125084, "uuid": "646eaebf-2c71-4d30-b6df-0eac189aa17e", "value": "T1B2956B10FFF205C3C09DF739789D3415B2B3AA64811F8A5D824F131E6CA5B512EAE99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125084, "uuid": "a31fd9fc-5ec0-4123-8c00-e1ebfeb1d408", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125084, "uuid": "b1a0e2d6-2230-4580-966d-a158a6cf69c9", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Q8jg:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnbpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125084, "uuid": "3ec037e7-cdda-47b7-a2ce-20513efd4743", "value": 2043904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125084, "uuid": "bcd0778a-31f8-4f8a-8cb6-0e1ddf947c2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125084, "uuid": "0cb8a4bb-baa0-4a83-9d89-6f0f01faa70f", "value": "2fc71bbf53f3158b6f57ad938820666d68699800e812d4f2f6cc7fc70bb7afa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d3be01-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632156032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156032, "uuid": "24971e14-b644-4b31-97d9-2efb763dd430", "comment": "Malware payload", "value": "84988f8e8d923673a26c009b55825bf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156032, "uuid": "efb945f7-46ae-4f6c-bb7c-2286f31dc715", "comment": "Malware payload", "value": "2fdb6f86925379ff52bbb5a5bb7ab5b53dc40d828d4a5f52c0189050b1dcb847", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156032, "uuid": "ed877d25-1f70-4319-9e67-d823e5698bcb", "comment": "Malware payload", "value": "7432dee3986c34bee9a4ee75f54adfb6437ce57b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156032, "uuid": "caf61dff-6989-4e19-9fb9-fe1953d93d14", "comment": "Malware payload", "value": "ce5f786e95c24c8af1b7644556acb26b466f3caa5f6d015c43d3f632bb24bb78cf06f89c85c4bea852fccf7ed2c06fa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156032, "uuid": "d0674b89-05d7-4d35-bc50-b315878e5428", "value": "T16C64BF20B7E0C035F5B722F849B597B8A93D7EB06B2091CB62D526EA56353E4DC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156032, "uuid": "c87475e3-d206-44da-9670-3ab11bd5caa7", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156032, "uuid": "f2caf3fe-8170-4cf3-a8cd-2f27c03b7551", "value": "6144:Dk7VukLGyRV2IdqrJqOQS2kV8GwvLqzZ+RGrFVoFyYJaQl5c0LBXOsoSr:w5fRV2SqrVP2kGGwvWQcrF05Jf5nLBXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156032, "uuid": "4abc30a6-c9b0-4870-9717-80324e2bf9af", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156032, "uuid": "69456e09-0306-4fe0-b931-0c737bd196c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156032, "uuid": "418a5c42-10bd-436c-aa5d-163f9ae3bc4a", "value": "84988f8e8d923673a26c009b55825bf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c316ce9-1a08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632138294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138294, "uuid": "f66ac720-970a-41d3-8aae-6f058f895b8f", "comment": "Malware payload (Squirrelwaffle)", "value": "69c9b5e0c3e6346f468ed148fc318529", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138294, "uuid": "3bd4869d-3fac-4af7-a904-f59ecdc1c369", "comment": "Malware payload (Squirrelwaffle)", "value": "3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138294, "uuid": "56014ab4-008c-4ccc-bd45-04e25cfa29ca", "comment": "Malware payload (Squirrelwaffle)", "value": "4ad69a31a65172cdcaa6e3ea1afad7b4e30b88d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138294, "uuid": "69b8c8f5-1223-4b16-92aa-81f2fc6090f4", "comment": "Malware payload (Squirrelwaffle)", "value": "f15e51821ed9bc9536dac7877a41104cc4e4eb808aed1743287c97f9039395ae59276babf523f5a380a1640e7e2a032f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138294, "uuid": "742f4f43-e232-4f28-964b-e99a441b36d6", "value": "T1A2446F7DBAEEE1B6E5814578207A3EF157F60D30D8006461ED8CFDE82570DE2ABA0617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138294, "uuid": "ed8d7029-b678-44ff-aa03-1e68ef7b9636", "value": "ae58eccde50cf13d31ec71d58a5eb86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138294, "uuid": "208149af-c31e-43b6-8700-7bc24624ab70", "value": "3072:x4F3joUMzh1nR9SSvAnmbkym+3j0SuS9fy8fL+g1Eh4dLB5I0cGFiY8QqC2:VhI4A9C9yZJpOixQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138294, "uuid": "e4854453-c52b-4674-bf24-1365a108915f", "value": 255133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138294, "uuid": "cd512380-32c9-4d19-bcc2-af689b953bc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138294, "uuid": "91bbb943-317b-4157-be10-1219d859d3e1", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2740ae17-1a05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632136997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136997, "uuid": "fd2e7439-4f73-4332-9b89-c04feee82e23", "comment": "Malware payload (RedLineStealer)", "value": "840e26838e609bc01953a9d1562bccb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136997, "uuid": "b6607307-c03a-4cea-aadd-1fb1715bae5f", "comment": "Malware payload (RedLineStealer)", "value": "30838de592f17b3e50956281173e5ac5fd229ff3ed2c606a71ac48d9425c6edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136997, "uuid": "3655dd7a-07fb-4540-a201-760fa209c34f", "comment": "Malware payload (RedLineStealer)", "value": "4ced2abc866392b20e649e7bd3ad1448d36786dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136997, "uuid": "0a260c70-45bf-4a2f-b24b-c150f5b3e74f", "comment": "Malware payload (RedLineStealer)", "value": "a8cc8bf9736bdc4c39f132ea066520b6165b3af0b945ec48fa38759be28d4a78fb354c9ffe3047984adcaf56fbfed3b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136997, "uuid": "3ab45d87-5ddd-4391-977c-d12200527579", "value": "T126D3B467A1D4107AE3AFBF34E4633A0735A9E620294F7788B0DDB3DDDA1854C59F4228", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136997, "uuid": "189fb861-3c51-410f-b25d-e6e55e3ba278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136997, "uuid": "de9b235f-f5a3-413a-b226-acf949701f11", "value": "768:xP40hiaqmyXWS1LKdBmEtj5B1epaBGStMEtFWP3F0hfjXp54UFcf/IMyaEjalgPf:xw0h5qmyGS0yER5beWBhc5CXDrXXnRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632136997, "uuid": "de9ed108-2000-4c1d-8026-29c1c42570e4", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632136997, "uuid": "440d1193-8acf-4522-9d61-d27ee51db13a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136997, "uuid": "df9ce22d-c429-4913-af77-e3b10fcb109d", "value": "840e26838e609bc01953a9d1562bccb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197c094-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125472, "uuid": "dc4ede01-991f-4cef-b403-16013fc2fac9", "comment": "Malware payload (Dridex)", "value": "2533060fce6c7298bd64fbf12d6c8c58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125472, "uuid": "6364fb82-1709-4332-a3a1-cdcdc3f7bb9c", "comment": "Malware payload (Dridex)", "value": "30aff65471ed288debd2b2d7497470d941890fc37051d736b77609c79f05c0f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125472, "uuid": "75d6d9a8-aa35-472e-a1d5-58fb4394f428", "comment": "Malware payload (Dridex)", "value": "4a5b262c433c8396cc05a50eb279701de0a23e63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125472, "uuid": "a209883b-5b48-41fc-9e2d-a79538191c76", "comment": "Malware payload (Dridex)", "value": "dda1b9d23ddb68705a1121d977395881c41278b96e5e6f6f7dee25dffdcb146dd530acdd730ca982474844aae4c2ff7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125472, "uuid": "21ce8cc8-666e-4ca9-b3fe-596209c1e3e1", "value": "T17795D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125472, "uuid": "fbe35107-f322-46b1-828e-e85971298e77", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125472, "uuid": "260ebf33-c951-43ec-9b54-b8ea8fcecf19", "value": "12288:oVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:9fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125472, "uuid": "d31c160e-c9ee-4c19-afc2-39ddb0381b18", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125472, "uuid": "f7e61666-792c-4aba-94b5-8a2bb5b24d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125472, "uuid": "6ce7cfa0-3b36-4154-a163-1497efbff29f", "value": "30aff65471ed288debd2b2d7497470d941890fc37051d736b77609c79f05c0f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e726fddd-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632151922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151922, "uuid": "7eac9988-fc58-446c-9f86-807b7dcb5512", "comment": "Malware payload (Formbook)", "value": "d6bd548477d0730b36a7d34ebe016cef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151922, "uuid": "b481b3a7-578c-4aae-8b21-3b4c50d2dcf2", "comment": "Malware payload (Formbook)", "value": "3201c48ab657da583d6561d0c550d00e4b196c60a2dbb121c2cc90317fda66ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151922, "uuid": "b127f942-8118-4fc4-a7f2-9b299c07881d", "comment": "Malware payload (Formbook)", "value": "397140932d5663bb94e3672f7605cc0950e30406", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151922, "uuid": "c45f1226-d65f-4a2c-9390-1e4f5b16d174", "comment": "Malware payload (Formbook)", "value": "126b9c1cc5ab6f4c79657fb6df86bd4feff316bdb709de8e87ccb11b4ca6e516e821e2528601ff10624a7c576fa52db0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151922, "uuid": "e217a5de-92d9-4c45-8e07-6cb3bb9dcf45", "value": "T114D4F07DE32067D3C44681F3BD1A9DCC749CADB8B500BBD96EE472E8F93218A644225D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151922, "uuid": "4005a38a-a4a0-4bc7-bac2-8f94448f1072", "value": "12288:YHbOBk3dpPnkW+B9udbLuok7dIKtrEq5G929pj99LXSokl569:YHbfdtnknB9u5Lubh1bEovHXYlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151922, "uuid": "ec77b942-f683-4f57-b5fe-e013fc0e470f", "value": 602072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151922, "uuid": "bdeb4f9a-5b23-46d3-9073-3617fd40fd9f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151922, "uuid": "41ff6a55-0bdf-46f5-9132-18d3d48b0c6f", "value": "records.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61aa185f-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632146544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146544, "uuid": "641e6a9d-dfc8-48af-8ba8-b709c18a9574", "comment": "Malware payload (RedLineStealer)", "value": "62984c286c4ca88904222295246bbc34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146544, "uuid": "5237cdac-902b-4175-8e34-d50de9ffc63a", "comment": "Malware payload (RedLineStealer)", "value": "32bbafcfeb06498d54fd75c87947404055dc95c7baefb381fe49de79d4a47065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146544, "uuid": "719aaec1-8874-4acd-8f3b-c0e04c66f8a5", "comment": "Malware payload (RedLineStealer)", "value": "66e225dbccbb5749425dbdbca42e658486277966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146544, "uuid": "fdfa6c2d-2c4b-4fdf-bade-d30ba6e2ef71", "comment": "Malware payload (RedLineStealer)", "value": "d5b95e6e05b1564f8a5a98908c961d1bbea118fe12a1885a6a8150be38c7b5e1c6532aa3f0a1d2af44cf452c2060dd32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146544, "uuid": "b9599184-8415-44ac-a5dc-c353327c7a34", "value": "T147E509B02A4B51BFD25B087866C38907D3A426FF87149D09DAF8B436B5E3D031F99768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146544, "uuid": "309ed49b-9470-44ff-8e81-fb4f210eea85", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146544, "uuid": "5de9cb1d-b8e5-479d-8eca-d04bcb5cf7a4", "value": "24576:ujP22hD1N9LOuhmUl/8ERFsgwai1QtJmexXAv3X93x3hF9VeaouBrUXChMklk8a4:cPDhD1PLOiVFNoaY3fCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146544, "uuid": "efecd540-c0e0-4166-b398-1a0043a689ba", "value": 3266472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146544, "uuid": "2ffc32a0-1be1-4db2-8ee3-782ba06f8397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146544, "uuid": "090b9969-728b-473e-8892-7babbe1efd2b", "value": "62984c286c4ca88904222295246bbc34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774988ba-19f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632130260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130260, "uuid": "b6c8e248-bbff-4b15-847f-7ec4d1bf4df4", "comment": "Malware payload (RaccoonStealer)", "value": "b685b9ce1c30106dc2be540f6ae77244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130260, "uuid": "2859c4b1-0ef4-4458-ab6d-0d4b51428066", "comment": "Malware payload (RaccoonStealer)", "value": "32dc2cc868f77779293c23daa5353c6668735e55df7850d1ccbc43825f1fbf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130260, "uuid": "bce79dc4-855e-44b3-ba47-a90237ad2358", "comment": "Malware payload (RaccoonStealer)", "value": "46dd728ffa164db68b74d4031938e339e3025894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130260, "uuid": "03d6838f-f659-4156-9388-a55331ae1372", "comment": "Malware payload (RaccoonStealer)", "value": "f8c9c43c5a716b68b3d256595eb44a0e225baca7da4d621af41b7632505747f89f3cd9601d47ecad0f0bd6d374bda3d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130260, "uuid": "6aae780d-a7cf-4e48-902d-b950f8e67ca9", "value": "T10C349D20ABE0C035F1F752F859BA93A8A93E7A715B3051CB62D216FE26346E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130260, "uuid": "fec910eb-cb42-4326-8364-743be623b7df", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130260, "uuid": "f9c2a7ae-5cfb-48cd-8561-aa7204f872ec", "value": "6144:a0ZQBX470Yjt6uWYBFpHqOALgS4sdEFTG3lnLpyw78:hZX70Yjt6zYHqOcn4seFTG3NpyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130260, "uuid": "fe8d6af7-ae5f-4759-8281-b43ad77a24f0", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130260, "uuid": "90402cf9-5596-48a0-b614-96c7cf367b96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130260, "uuid": "341a3d6c-1cc4-444e-a251-2379a213b49a", "value": "b685b9ce1c30106dc2be540f6ae77244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8e1705-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632156016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156016, "uuid": "7c6b59f9-1645-460f-96f5-ad8a78b9df13", "comment": "Malware payload (Mirai)", "value": "33f957a038336891adc5fbc899c748fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156016, "uuid": "e941ea61-388e-4b35-bf80-501ca075c23d", "comment": "Malware payload (Mirai)", "value": "3315e68bbabd44e7a01bfb739f620f3e1e457649137ca6511a542444a8460ada", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156016, "uuid": "cedf30c2-d7bc-4a67-b1f9-8c4db155a43c", "comment": "Malware payload (Mirai)", "value": "a9b65d6c3234e59764d977da0c2e7436a7e7ed91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156016, "uuid": "a7c02405-974b-4515-a551-ce6a8135ab8a", "comment": "Malware payload (Mirai)", "value": "aa3bcfcee5955810feb5452708ea107dbfff5774f73d328b13e1b6b207c102f6541b763e21b4ccf2b88599b81b72c857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156016, "uuid": "c0de19d8-c77c-408f-b27a-a2d3bdc901a6", "value": "T114439E23C9215F18D2999AB0B075CE784B53AA5093A71F7B6069C23C9443DDCF52B3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156016, "uuid": "fed53188-257f-43bf-b0ac-ad4cbe601ec3", "value": "768:4m/m8J+WWjegNiQruQSelZznKH8JIazola2x/fCfn010fx4bzOtvN/hYLOLI4:tmCWjeOldlRKH8JTElF3CfB4yN/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156016, "uuid": "957d9d29-d8b3-4ed5-a809-f3ee0ee5230c", "value": 55232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156016, "uuid": "6cb077ba-3de0-482a-9d01-af034190561e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156016, "uuid": "852f5755-3bd5-4e6b-8e12-5d0fc5bb8810", "value": "33f957a038336891adc5fbc899c748fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767fccc0-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125534, "uuid": "b1403949-67d7-4737-a767-ba67f483b309", "comment": "Malware payload (Dridex)", "value": "0c699faa235a59c644bcafae6b878877", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125534, "uuid": "667157b9-b9de-438a-8923-4cc3d6adf671", "comment": "Malware payload (Dridex)", "value": "334a6ef4bfe12e97ebad4af0474dff2b7a1333587b437944bd0bb1b64c9e2673", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125534, "uuid": "b319f3ad-8b35-4157-879c-0d1f31a54f5a", "comment": "Malware payload (Dridex)", "value": "f7f2faaa19198157a4dc3392541cc5446c10fc26", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125534, "uuid": "95bf3f03-3712-4e67-b3de-d9fd89ca11ce", "comment": "Malware payload (Dridex)", "value": "9df6124075b0fc811a3a032ddef23c036ba93432d3e90acdbbb4c85edcbe793df09d729bf432ca50eb697ec91726f569", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125534, "uuid": "6cd8c2b5-f7cb-4d97-847a-26d7b0b2c030", "value": "T12E95D010EF69E1E6C6B89F3E9408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125534, "uuid": "2c58c50d-09aa-4f95-bccd-31c58af37148", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125534, "uuid": "6cbf0df0-32e7-406b-917d-1d32a4c92488", "value": "12288:yVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ161:vfP7fWsK5z9A+WGAW+V5SB6Ct4bnb61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125534, "uuid": "ed64d8cb-c143-4763-8f5f-08151ff1cb01", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125534, "uuid": "54d2122b-66d4-474e-a30b-9d4d9ea25ff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125534, "uuid": "4b0826f7-8e02-4d63-83bd-122af9f37b88", "value": "334a6ef4bfe12e97ebad4af0474dff2b7a1333587b437944bd0bb1b64c9e2673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cb6711-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632121397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121397, "uuid": "f79afad0-cdf0-48d8-aff7-1937ff3058d5", "comment": "Malware payload (RedLineStealer)", "value": "4a93f552d9a2747b134be963c4d1b044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121397, "uuid": "e916b437-bb4c-44b2-a5f2-027063f72df6", "comment": "Malware payload (RedLineStealer)", "value": "33bb7d8584f1353b048c0227977e9531a4125188a960babbc2a26307ca158275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121397, "uuid": "5efc833a-8b18-46f2-b067-551e3f60d8c2", "comment": "Malware payload (RedLineStealer)", "value": "7b96e56bc6b7df56ac4d0cda72dbc2d9be65f0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121397, "uuid": "922e521f-4f31-4a8d-bf6e-3c08d57197d6", "comment": "Malware payload (RedLineStealer)", "value": "50610fb42ab183166994287535fc7d8472260aed21db84029ca241b95c517841f2e19b6b4aace60a4a1a345067f0236d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121397, "uuid": "33a96244-1a3c-4814-bc87-e6a7c47670ea", "value": "T1EB64BF20B7E0C036F5B712F549BA93ACA83E7AB16B3051CB62D616EE16346E4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121397, "uuid": "2615c59a-ab3b-4c2e-af25-71f9f7e5bf64", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121397, "uuid": "ca38e875-ca02-434c-bbca-7f0f54ccf2a6", "value": "6144:ehZQVpxfTh3eF7qA72caxx4/0NDRYpbX58z48jwb/KrROUYmA:cZQfTh3eFWHcarRDRYpk44UcOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121397, "uuid": "50438904-fa1d-4d55-8a44-c69380af10e8", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121397, "uuid": "290d4d47-f685-472a-ba7b-c4449d319b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121397, "uuid": "38fa1717-0ee6-448a-9419-72d18e659940", "value": "4a93f552d9a2747b134be963c4d1b044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9f7855-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125358, "uuid": "11d11750-e272-43aa-b0e3-238b566fbf7a", "comment": "Malware payload (Dridex)", "value": "21c8b595b22040cca41488ad3108bef7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125358, "uuid": "78fcba3e-38cb-4c3a-80ed-7173ecd9ef4f", "comment": "Malware payload (Dridex)", "value": "33bdea2774f3d73d2ff73cd7ccd668c57e757b35af7e0c341023e6a383b19254", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125358, "uuid": "477ccaf3-fbd2-4bf9-930c-9d77e33217e4", "comment": "Malware payload (Dridex)", "value": "f40bc65e49d71ade35131af6fe8b53509594a769", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125358, "uuid": "cdac45a2-d124-4607-b1ac-300bf71b0ce7", "comment": "Malware payload (Dridex)", "value": "769d58be4e3174aa1b6c7c28f17522aa5d9c0b91e59cd58f342ccb2fd211a2171ebd34c400761966d34968d3a8df5a37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125358, "uuid": "4525c58d-1c70-426f-9039-176ad8807286", "value": "T185A5E020EE69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125358, "uuid": "f3afaf2d-5229-43ca-95bc-fa4fa344a772", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125358, "uuid": "20e359aa-b492-4c0c-a9e3-57f54d788dd2", "value": "12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125358, "uuid": "0fae8640-852d-48c2-a033-91936484a6e3", "value": 2076672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125358, "uuid": "3cefc854-3ed3-4ef1-ba53-dff3a2959a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125358, "uuid": "25dd3949-dd30-4d82-9aa6-4e1cd3aff83e", "value": "33bdea2774f3d73d2ff73cd7ccd668c57e757b35af7e0c341023e6a383b19254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753066a7-19eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632125961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125961, "uuid": "0083902d-a548-4b12-ada1-acd6acc4106d", "comment": "Malware payload", "value": "37e8e14c99b820d0f042cd99d0853208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125961, "uuid": "ea8c7219-aa41-4e06-a8ff-7a54eaf7e80f", "comment": "Malware payload", "value": "340a20ce082c4ee7ec9f806adacfe43ce789b8eabcf81d7465dcc18419e55d8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125961, "uuid": "f4b572f2-9319-4d13-8e2e-a82d02a48759", "comment": "Malware payload", "value": "79206d6027b0d57b25ec96b041b68470b50d2e75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125961, "uuid": "d35c922b-4fff-41f2-a299-316521a4e0fa", "comment": "Malware payload", "value": "bddc350bf4a3745832902ab8e1550892b1da86e74d26850b35b3b40a96a370742b6cabb85dee588c2971524be1b5e181", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125961, "uuid": "939caa5a-def5-47ef-94f5-97b5dd84f185", "value": "T159159D8D6ECB1F88EFC4097D6F259B235E30D16071C3A3A766BC23345B9E3A41B85586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125961, "uuid": "aded6f50-4ce3-4470-9eb9-d486a092a835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125961, "uuid": "dc8134a5-a743-43b0-a7e9-5910d99ecfde", "value": "12288:7qn4G4XkEFRk8L0jaSoxh8kE3jiqJ8JBjyHZX0MQEXPNE+orut4HlmBpRT6pcbDl:7+4G4Xkcu8Auz8NDZ48L6CFsId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125961, "uuid": "af611b11-8550-446a-9717-e9027023956c", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125961, "uuid": "5810fa55-9198-4106-b0c7-8b539c5411bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125961, "uuid": "ae7bba1a-9f27-402a-a4f3-816e82c80bf3", "value": "37e8e14c99b820d0f042cd99d0853208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3a84e8-1a12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632142908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142908, "uuid": "ec291ad2-64ad-49e2-bf2f-847b07a989f5", "comment": "Malware payload (STRRAT)", "value": "2630d37f457913e206a7e22927cbc820", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142908, "uuid": "4fcced21-36ff-4373-bd79-6a2e36f1f561", "comment": "Malware payload (STRRAT)", "value": "3447f1267a9defef289d621c841d6ad136063d60f00d9540dcd050cc6d3bf889", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142908, "uuid": "bae127f3-92d8-4404-9cd7-df231c1e5eb5", "comment": "Malware payload (STRRAT)", "value": "8f592e4bb5203ae891fccb15be8ea005e827ee6b", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142908, "uuid": "3ffd8c3f-37f5-46c7-92d4-b9277f4874f2", "comment": "Malware payload (STRRAT)", "value": "7d2385646554ca7cbbe979c2191dd0d2abb746c7e06e88e04b5e3c0c98b6370e051141daaea3e8a12db5198b4c81648c", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142908, "uuid": "4e920f64-49a5-46bd-8826-2e2769109819", "value": "T14C93CF2B387BE078F5033872906966236A0D579CD9CD212F22FC445AAE34D6E5B176CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142908, "uuid": "40fee8d9-4428-45aa-8ccd-7241217d8900", "value": "1536:Ex/01AruP1I9Qq1+jPpcAOnGSVPs3Lu0ZpLDWjCT2sihe3mhHGvBvxAptHrb7:ExBruP18Q7jMGQP+LPZ9DWeTB3movgLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142908, "uuid": "78520978-3d07-46a1-8cc0-aaca27e6f8a0", "value": 94792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142908, "uuid": "ab0d7aa5-439b-413f-9fce-5b858075387f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142908, "uuid": "0c496b24-bf1f-45d9-a9fc-6af1e43e770c", "value": "rovwpvhmlk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83f8707-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125295, "uuid": "2268a3c8-cd53-45c6-a91e-765b364aeb55", "comment": "Malware payload (Dridex)", "value": "79c4f6dd502c0447e1812ede275117e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125295, "uuid": "756176f7-7989-446b-adfa-443ab7218a66", "comment": "Malware payload (Dridex)", "value": "34cb120651e526fd278ad35258b6517a3d939284f045b8c7e5c69fa33b84698f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125295, "uuid": "0a122a43-dd9f-453f-8214-12907b8575fd", "comment": "Malware payload (Dridex)", "value": "dc8ab5a47be726133fd51d8a0a1291c1b0eeeedb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125295, "uuid": "c3faf536-6bc9-4903-8082-202d35f3d15e", "comment": "Malware payload (Dridex)", "value": "1dcc52f0a6faec82d2bd66bf2426ce684a5213a96a5b82a695f678114351b8235798c8a0950a603a34871d715352df8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125295, "uuid": "6477e8f2-42d2-4f6e-a90c-4eea82c48b63", "value": "T194A5D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125295, "uuid": "d969b075-aa0f-40ca-a4b7-3d37a16f47e0", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125295, "uuid": "4d8d6efe-7387-47f7-9b92-372bbcfca862", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125295, "uuid": "376aff66-1f0e-4683-aa00-f7ad5fa0c0b4", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125295, "uuid": "1daf118c-01ca-47d1-9524-e393cbde8002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125295, "uuid": "9468b29a-bf56-4623-8aed-3b971b40b2dc", "value": "34cb120651e526fd278ad35258b6517a3d939284f045b8c7e5c69fa33b84698f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5ce6fa-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137731, "uuid": "0736e004-d00f-45ba-8f01-84a91d6010cf", "comment": "Malware payload (SnakeKeylogger)", "value": "95401ca1fb8b8bf0f43e1a61675f5e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137731, "uuid": "5606bbab-88b9-4f2d-bfe7-14e965922aa1", "comment": "Malware payload (SnakeKeylogger)", "value": "34cfa7e313ccbef955e0264af2bd9d20046db20b995c7ce9f7eb712aafbd9a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137731, "uuid": "dfdab3ec-b8e6-40dc-9124-eb17c205158c", "comment": "Malware payload (SnakeKeylogger)", "value": "3c23c5ae66bc1bae9ab5c2698a5f217ae9b01f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137731, "uuid": "8bee9e40-a3cb-4990-b607-bf60c8fac6f9", "comment": "Malware payload (SnakeKeylogger)", "value": "596915c73d21b74e82510e744790b22786336ba8080cf7cf51022463b2aa33905660914f784d404eb2eca111ea7946ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137731, "uuid": "074617f6-fc62-4310-8bfa-43e46ec6a502", "value": "T12C54E016A9F933E2E1BA4BFC5D25B21007387ED1188BEE5A1E8170DD1572B0252B1F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137731, "uuid": "a9a00572-7a7a-4aff-bfa6-e3e99bf94fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137731, "uuid": "61dee503-0712-4162-a941-f6d1a1565fdb", "value": "6144:zttvJ/xapAni6W2Au03YTmo7jHEm77JpfVvfKfxnA:z3Fxk6TIu03To7jHLHD9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137731, "uuid": "2d963a79-1f9a-47fe-b624-62ded0762434", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137731, "uuid": "9edceeea-cf8a-4686-a2dd-810b51fc632e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137731, "uuid": "2aa928e2-5db8-480e-aab9-9cc4716f8a08", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3035ace-19eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632126092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126092, "uuid": "d0b3783b-1419-4017-b890-c782bf53b2e6", "comment": "Malware payload (Squirrelwaffle)", "value": "0455195030f395efd863a6ae9c5acbf6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126092, "uuid": "325b2ac1-5201-4971-9b7e-e40ef4547173", "comment": "Malware payload (Squirrelwaffle)", "value": "354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126092, "uuid": "e05cf842-c884-4b75-b749-66b754662596", "comment": "Malware payload (Squirrelwaffle)", "value": "4d41dd344d23aaba495fcd84e687d1d18db9fdd0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126092, "uuid": "1532f817-2e45-4f05-b0f9-c69978562c40", "comment": "Malware payload (Squirrelwaffle)", "value": "08a13e554a041e833d7ebc148de8a9aa6a005580b1fcee63b204ddbe06bd9926054f36531481049810f699282cecea6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126092, "uuid": "87cd12e4-5ba5-4562-9da0-614a92559b9c", "value": "T17C44AE0ABEC7DC32CC3D08788861D9E2663C78565A60C9A33B953F3F5DB71C149259AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126092, "uuid": "521d8388-7486-44ac-af12-cd7661e90305", "value": "1b8854882478e8ab7439d9dedeec9966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126092, "uuid": "2ffa57e9-449d-41ac-80c9-8d1614f6120e", "value": "6144:pSYWZLzPgBi8L1UVdRU/MGRulllll/llllleI9ntib/xMSMi:pbQcUNtGRulllll/lllllo/ySMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632126092, "uuid": "3a8139ff-08d1-4986-8fa7-64f6a26421af", "value": 259765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632126092, "uuid": "884d604c-9cc8-443b-851a-1cb44b9d81f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126092, "uuid": "23894931-ea9e-41b9-9c31-8f046e7af995", "value": "www2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed5c545-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632145358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145358, "uuid": "11717863-9f40-43d0-867c-3a5edffabed4", "comment": "Malware payload (Loki)", "value": "7c75c42816ba9bbbdf663b3d49d6a96a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145358, "uuid": "3909eefb-965b-4475-b1ae-6554c2ec0e96", "comment": "Malware payload (Loki)", "value": "358f2a778fa197fc3b032f0b85542b882f681e38c4156881874d66fc2bf2bcb0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145358, "uuid": "9e0d1e08-648d-4037-b1b4-173b173e0efb", "comment": "Malware payload (Loki)", "value": "1a9be550cafb37e73d3e88cfd8a46554dcc22c95", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145358, "uuid": "a6d5fcd7-901a-48f8-a274-126506f2f3ca", "comment": "Malware payload (Loki)", "value": "dcc105c8ced21b68be69551dd36f714596edbeed0a094a12d6987e54233ca2d76de6f370d73420c23c5e9bc757726f50", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145358, "uuid": "b08bef27-dafc-4ecc-96f0-19965c0ff0ac", "value": "T1D56240ADD4A706988F466BB8672B6F4502CC3A6DF7889532727C973467C2DBB411383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145358, "uuid": "9ca16bd8-4295-4b58-9b0a-9d985b80e91c", "value": "384:6IywK43fIi9sXCO/ZleypCmyJIP5sYlTmA7:6Ie43f9sXTzPqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145358, "uuid": "7244a26d-3bdc-4c56-8032-65f8402433cf", "value": 14802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145358, "uuid": "416a19ab-16f3-4d91-8036-747982374d9e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145358, "uuid": "1e2b8829-3a91-49ac-94ce-b17b1445583d", "value": "Overseas Keys inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795c7fed-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125539, "uuid": "b1950b56-215c-4ff7-aba1-920193c96ab0", "comment": "Malware payload (Dridex)", "value": "ba99e02ad495e317473ddf52c831f868", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125539, "uuid": "840e771b-97f1-43d9-9faf-567fbb97b540", "comment": "Malware payload (Dridex)", "value": "35af7c873781f1bbe36672441caa81f5ae7d32c4b352f65ed7258e07f3deb319", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125539, "uuid": "fc4d316a-f4e6-4452-a79a-62fb2eed0f71", "comment": "Malware payload (Dridex)", "value": "45a403c4a262056c4210d8d7dfbf9d75725bb7ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125539, "uuid": "1108c485-9549-44c7-8676-0547ecb1d453", "comment": "Malware payload (Dridex)", "value": "7348ce33526c4066b8ad822d86f5da4e94607e6c9c9c9c092d6e38fb3cba2aa07df5387edb05dfe64054211eed687eda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125539, "uuid": "6dcb6a2f-ba46-4109-9358-fde63b44b091", "value": "T19C95E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F6EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125539, "uuid": "94a8bd31-7ce6-4ecb-8138-4fde4dc807d3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125539, "uuid": "9a01c854-7918-4528-b98d-ae36864651d8", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125539, "uuid": "6cfeb3c5-f4f7-48ca-803d-d36dd6522ccf", "value": 1925120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125539, "uuid": "a7355e5e-9b73-47b8-8841-2aee844c65ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125539, "uuid": "db5642a5-aa81-4874-bb99-de013ca71326", "value": "35af7c873781f1bbe36672441caa81f5ae7d32c4b352f65ed7258e07f3deb319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df51e33e-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125280, "uuid": "8e50e7a4-28ed-4694-b3bf-4fbb06e99946", "comment": "Malware payload (Dridex)", "value": "1eb0e5c91608c2dc73f7560ce8754fc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125280, "uuid": "7bb07e18-c8b9-44dc-9b57-3c75a97caf3e", "comment": "Malware payload (Dridex)", "value": "3613279c4420270cb63499064482fec2fbd69364e971399c7d9c8a035d572616", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125280, "uuid": "c642bed2-dc83-4bca-bbb9-b250a857cef0", "comment": "Malware payload (Dridex)", "value": "fed417f7993cadcc4bc3cd7de42b942f8a46b195", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125280, "uuid": "c79dc4c1-d809-4df1-a722-79564addecd5", "comment": "Malware payload (Dridex)", "value": "a306bf97770b1968cd1c7505868fda0076ce56159271d3311a615935e3721d8a875a6ab33bc7f888bf3f3f327a3b0e44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125280, "uuid": "f0890b2d-fe0f-428e-83cc-1d10fefc0a6b", "value": "T1CCA5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125280, "uuid": "63c40b4e-7b05-4854-be71-f599298b89f4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125280, "uuid": "b82fc4ef-0fc7-4a9f-af48-b374908efc2b", "value": "12288:TVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:CfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125280, "uuid": "40b51273-54fb-4de7-a802-0d999c2b6ae9", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125280, "uuid": "a49ab826-5715-475f-84ae-f5b7775263aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125280, "uuid": "d508ebbe-3ba0-4fee-a791-476a0c0292f2", "value": "3613279c4420270cb63499064482fec2fbd69364e971399c7d9c8a035d572616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e83c2a-1a39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632159309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159309, "uuid": "27386b04-b1a0-4daa-8984-bef1cb36eab1", "comment": "Malware payload (Mirai)", "value": "d138e9d39cefe939bf0e3e48fdee52f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159309, "uuid": "2a1c8b12-5946-4535-b772-03f25d8483a1", "comment": "Malware payload (Mirai)", "value": "372d3ca8a7abe7d1e834a548b4e1b19e4878a746c47ff74c649967c510c51897", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159309, "uuid": "5ebe7e60-2e75-4fcf-8dcd-c722660c830e", "comment": "Malware payload (Mirai)", "value": "1be86bb3c2671b43cb9dbc9b95a2abd61480170d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159309, "uuid": "efe50188-9afd-46a2-a283-a398edc11d80", "comment": "Malware payload (Mirai)", "value": "79a6c181e69ba8c1190afee7cc8b63f990fb0d573cd82f566be7733f309e426a515a50c6c640be6bd2ab7abb8bfd4f77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159309, "uuid": "e947d7a3-a21d-4d88-8365-911804ea9692", "value": "T104D2023955498E50F7B02835F82BC9C33A83B7B4FAA2328A42180DF64D490BE1E7CD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159309, "uuid": "f352c417-f2ce-4905-bcce-1bba112a7af3", "value": "768:JRFNhHxWJsAZiArxFRG/wpbT/c/euMoys3UozhK:zFNhsniAr3LpbT/c/eFovzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159309, "uuid": "1ce6793a-c6c5-425f-aafa-00d24b18cb69", "value": 30688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159309, "uuid": "b473f9d4-72bb-4c56-a5f1-f3f0bb181fe1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159309, "uuid": "c4f25deb-a300-423d-babf-bf50857041d2", "value": "d138e9d39cefe939bf0e3e48fdee52f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b0b4c4-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125616, "uuid": "0474a9ef-4a46-47da-a646-7a64a6399a21", "comment": "Malware payload (Dridex)", "value": "0219806788286b3c772eb30de292576c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125616, "uuid": "4e6ba43a-677f-4ed2-99d9-4efa42a5d5ee", "comment": "Malware payload (Dridex)", "value": "372fe189b852167639e5d5a40fb05617b4c73a79c86388ad39e72b5882880bbe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125616, "uuid": "b9039917-6042-4674-a2f4-535e9cb67531", "comment": "Malware payload (Dridex)", "value": "cabd2d7655304f09cd8ada9f773a0ab6a0c6655d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125616, "uuid": "726c0782-8692-41cf-a765-5ae8b3b08544", "comment": "Malware payload (Dridex)", "value": "7c34a74360aefd7d22835eb371a8fe6b976e4838299a2e8b4430500e0688181b2b5dfcbb7b9a93222c043cbde9d49694", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125616, "uuid": "cdc0a86b-75c0-497d-9270-f2cd49f44419", "value": "T13D85D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125616, "uuid": "35cbb251-9e66-4026-8d4f-aa12e2155480", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125616, "uuid": "c5781a56-6db2-4ae3-b269-119a0ba80624", "value": "12288:LVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:KfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125616, "uuid": "70c3576c-10f0-4e14-a0d8-50e214c5b3eb", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125616, "uuid": "47a12a1a-aee5-4aa5-a4b6-028a3e10d678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125616, "uuid": "b1c0b2da-04e7-4307-a3fc-472679d17397", "value": "372fe189b852167639e5d5a40fb05617b4c73a79c86388ad39e72b5882880bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a4f7dd-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137587, "uuid": "ed08d475-5702-45f2-a3d1-2e68888c0e2d", "comment": "Malware payload (SnakeKeylogger)", "value": "50567d78d169eccf7c68daa6b78cdd51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137587, "uuid": "f24838a5-a7ec-4e2b-ac2c-e7ba92ea034d", "comment": "Malware payload (SnakeKeylogger)", "value": "37b18fbedd8fdc5967ec39d5fd779304a403c4e5182ec833ede407b5f09b9c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137587, "uuid": "c47b9746-1961-4dab-ae14-a04990329b03", "comment": "Malware payload (SnakeKeylogger)", "value": "4b0f09b16e4c1e782afbd67a2193570e28c32f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137587, "uuid": "fd73e26a-c73d-48a4-a6c0-3195349999e7", "comment": "Malware payload (SnakeKeylogger)", "value": "b415f877eab65da3d45f4a72b99351916ea7516600865afedb921c21336319d1ecce0ff38fb4551c78330cb1dfc27acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137587, "uuid": "949a57d1-badd-4f8b-a764-043bdfdfe0eb", "value": "T10BF49DC17D47D89BF4DF2AB3986FC52011656E8D9161C73D2682BA2B54F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137587, "uuid": "e2753eb3-b90c-4f8b-a536-57b5077dbc14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137587, "uuid": "e990c841-52b6-4ffc-a265-83a14275e752", "value": "12288:t5MTdFUV1smtiK5oyZ7sfjQLLWF73+sQSixjDUibthIxq2sQ5p6sAac:6B+Fo7fcqFb+31xTeFz6sxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137587, "uuid": "9c8b6699-38cd-48ff-add8-db6d0805ad7d", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137587, "uuid": "ac0027c8-2db9-424d-8002-2f261e4fc8da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137587, "uuid": "73f7d153-d1b6-490f-8cd1-08ffa35e2940", "value": "bank in slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46badc94-19e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632123736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123736, "uuid": "9f5a0c7c-9ea2-4614-8318-019f2a9ae78e", "comment": "Malware payload (NanoCore)", "value": "c672143b798223594715e820afaca245", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123736, "uuid": "52bbcd2f-2562-41de-b01c-9b93bcae59ed", "comment": "Malware payload (NanoCore)", "value": "37fa55afb02c5531fab0f8d25e920f395d0d29547e534eb5b7484a398bffcdd8", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123736, "uuid": "ac593501-aacd-43fc-9cd6-39dc387292ca", "comment": "Malware payload (NanoCore)", "value": "926e13d5ff28bc8cac3c9783f561b26bcebe6def", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123736, "uuid": "ec13afc2-fff8-45de-abab-49fafcb3c502", "comment": "Malware payload (NanoCore)", "value": "9855db1ac04e2ed55c8d837e509dc3f7791ff7e79f1b185b95db5448f4803c7bf5a4df2953daf094740081f8aeab029e", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123736, "uuid": "a0e5e378-4a66-418b-a1d7-a10b83e6663f", "value": "T13935336FE74A8FF86A180F652B1390E15D86EABA900F7AD4C2C4447FD0D6C874917A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123736, "uuid": "48f03957-c6cf-4203-b88d-5ebf1f2ddad6", "value": "24576:gf/oaf9Sbskxe9Vm9zYTgbcOm8o8zDjfrgbD4:iAi9SAtDobbo8je4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632123736, "uuid": "26e24e24-19a4-4007-af13-ff215f1c6add", "value": 1070540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632123736, "uuid": "ced9a3ae-28c6-46b5-b741-86b12d26527a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123736, "uuid": "dca89ab5-29a5-48a1-a763-4fcd47d1546d", "value": "c672143b798223594715e820afaca245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973756d6-19e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632123012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123012, "uuid": "18fee01b-203d-4043-9509-f8fb11a19bb4", "comment": "Malware payload (CoinMiner)", "value": "7f34c12f88020dcc02f994529fb48222", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123012, "uuid": "a156bdc5-5329-4bdb-9e68-176e95f43534", "comment": "Malware payload (CoinMiner)", "value": "38582026970861e90f4f3f15da60fa5c8bc8759a2fab6c58a6c262d9096ac1e4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123012, "uuid": "ef18b65d-de90-4022-a644-55eb9b24aefc", "comment": "Malware payload (CoinMiner)", "value": "41446495e7817e0d5eb2a1c51a7f0984b56d36f8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123012, "uuid": "6120445f-f402-4907-a403-9aea0d3ab85e", "comment": "Malware payload (CoinMiner)", "value": "37355d0833fdb5d810ccc65b25b9b8e45891058652a59064337a1d1549e551eb4b90f21b6a333c7eba7c45aab751686c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123012, "uuid": "907c7a2d-1f8c-4861-908e-c43c6e3b36ba", "value": "T1E2E5332DCC329C5BF57C01F8910E9A19DB038F4E4748EF66BD7F86FBA00A650E615925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123012, "uuid": "7a8d5111-c936-4551-9b78-16f5caf731d6", "value": "41b3288a2205bc5372c72023ff2d0816", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123012, "uuid": "fa8d1456-45fb-4118-bd48-12574629fc9a", "value": "49152:bk0bv99hxRdJGfZNTtS7F5U9J5CLwLaT/TVQdhO08BA7uxb7aoaU9ZqlssK0BSq2:bfbF9vcZQfkIGdt8BN1nJ9MmsKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632123012, "uuid": "4d6f7a3c-5406-4dfc-bf84-88fd4d4267fa", "value": 3208104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632123012, "uuid": "e594acae-1656-47fe-b260-1ce5cc2a01e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123012, "uuid": "df27ba60-d9aa-4f9c-914a-1d18e76d4cbd", "value": "7f34c12f88020dcc02f994529fb48222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93273f7-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632146342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146342, "uuid": "bc9c7ad7-6a06-44c3-948a-23ba19273d6a", "comment": "Malware payload (RedLineStealer)", "value": "aa50acd8116fddaaeec779efeab5555a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146342, "uuid": "a8ac5c16-dbfb-4eba-b1de-fd1a1ce98893", "comment": "Malware payload (RedLineStealer)", "value": "39f5b13c60418f4bcefdd1df075a6fe9e8bd879340c42d12c8a5e636aa035e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146342, "uuid": "85b7a986-89e0-4c81-b2b2-7de45d3c696c", "comment": "Malware payload (RedLineStealer)", "value": "7312731a66c51e8c51f680aed1aee90c397b8282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146342, "uuid": "0093ccb9-a472-4b05-a76e-cf199ab82dcf", "comment": "Malware payload (RedLineStealer)", "value": "1853e4abc03bf0f83948a1dbc6345938f3c4ba673629c809b27a31fd48bd7f5ff736b5b39c63aa0a9a6ed9ac551f208f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146342, "uuid": "71eb1cae-b260-4b5e-add2-9bd2ac7b7756", "value": "T10475F00D6113B39EDCA0333B9A3AEF16D6F45C658962416D39C0BE37EAB5E52023C746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146342, "uuid": "757632af-de0a-46dc-a7b3-2e83d2bda490", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146342, "uuid": "f0bf04c2-f5fa-4dd1-9a85-10a1b26c0733", "value": "49152:ZPBt+n3sc03YZ7afGhCrgNgvgRkJthP81:N+n337AECENXathPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146342, "uuid": "eb9a29fa-b212-412a-a614-0965d21d2a80", "value": 1688513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146342, "uuid": "1c764141-d1f2-4f74-9d51-f90b6bd5b6e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146342, "uuid": "fd3eeb29-bd97-4f23-ac57-b59e368ba0cc", "value": "aa50acd8116fddaaeec779efeab5555a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c70906a-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632160655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160655, "uuid": "4145ebe6-f623-482c-ae08-5d5d25243747", "comment": "Malware payload", "value": "a71247a8a35dac0bb05a5d0f863b2948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160655, "uuid": "322d9782-59f6-43ba-ae37-2f12728a61d7", "comment": "Malware payload", "value": "3a443ce680f9e02c1ad1e7802c4cb1662e98bcf162487234aae2cb02cb3d9d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160655, "uuid": "25312bfb-9505-4fe8-905f-0e5b6b50d303", "comment": "Malware payload", "value": "8308832303ff2968c6813db7c127cbb976b113c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160655, "uuid": "e5460834-b781-49a2-a199-e2f0a999877d", "comment": "Malware payload", "value": "e585f10a239f4123297d34376736c662a4d3aa3fce5f6c2f0c3119883033292819e8239883ec5f1319eba850dfb6c932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160655, "uuid": "0212802b-10c5-406e-a65d-f0c121648c74", "value": "T142F439493D8EEB75C3DF677388F37A1AC364D85183DAF307048365A568863ABAD0A543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160655, "uuid": "1955cfd7-51ec-4621-8efe-b01153b918ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160655, "uuid": "e7572229-0efb-4787-9e9f-6218c71da7a7", "value": "12288:Al36/tTtTiTfT3TQKsrPmzIztfe5Gpqn41BlcwwhlkDfnyzyswNmj6L:DbMOt+41kw+KdsMK6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160655, "uuid": "4fd1c2bc-070b-4086-a8b3-f7992fc3e098", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160655, "uuid": "86812909-cea0-41d4-b4c2-6878fab03122", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160655, "uuid": "48b99f49-79da-426b-b314-f59af5fb2f02", "value": "a71247a8a35dac0bb05a5d0f863b2948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71924cd9-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632153013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153013, "uuid": "003069a7-6018-404d-b6dc-0ec21634403b", "comment": "Malware payload (Formbook)", "value": "817e0e2fcd8e6a5d7571bd135dc92ac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153013, "uuid": "55445c61-4ba9-4ec2-b000-4f1f25499194", "comment": "Malware payload (Formbook)", "value": "3a90232b1cc562fa333d9b401a6160d5de5b6be886768fae62bdae3d42ea42f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153013, "uuid": "be7d086f-853b-4d99-a56c-bd26e478b233", "comment": "Malware payload (Formbook)", "value": "c38ce84cedf4569f0510892b7d04e53ae6b2a986", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153013, "uuid": "c8158b74-cb88-47ba-b7f7-f629e1ba4a9d", "comment": "Malware payload (Formbook)", "value": "f0de64ebdd6b949e2055c0c11b07b02a62641ed882ab51da3b97bb9176ebaeafc202303be812617f369a13eb4908097c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153013, "uuid": "56acd36a-0ad3-4f37-b82c-5647e995baf6", "value": "T12FA4DF343AEA9019F173AFB95BE475969A7FF7633607A45D108103CA0613F80DED1A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153013, "uuid": "c467fd74-8369-4b8d-89e3-01793d088b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153013, "uuid": "5a7f303c-971d-44c9-8f84-ba69a89e9371", "value": "12288:k6j/3dWHCM2K4Cy3hcZyfw9NzKA9/1BcHjIQsb+:rj/n3Csht0d/1yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153013, "uuid": "8468d6f2-f069-4110-a379-2d439c944c58", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153013, "uuid": "1641721d-d586-4174-9008-98a4e5e459ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153013, "uuid": "9e62a2c0-d499-4ce9-b403-ab969a60f76b", "value": "817e0e2fcd8e6a5d7571bd135dc92ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240f49f2-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632137421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137421, "uuid": "4cf8d1cd-04fd-490d-aa56-a3e0fe0c5eed", "comment": "Malware payload (Formbook)", "value": "edeb5833afd72bfe9d8e361401f6d3aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137421, "uuid": "981119d3-f9b0-42da-bb07-d198cc9fb027", "comment": "Malware payload (Formbook)", "value": "3aa34d63c4a9e3e8b7acd7ddce2762165ba89fb46aee50cd86bf08b761437f6c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137421, "uuid": "3211b79c-7249-463a-b17d-aad2f4335c98", "comment": "Malware payload (Formbook)", "value": "5dcba8aed3ee8b364bfd8bb050a9397b47171f50", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137421, "uuid": "2f2e1a87-d850-4588-820d-18e661e8306b", "comment": "Malware payload (Formbook)", "value": "0986c43b0b89b3bf4b0fa6320ca3c475b3b971f4a0ec2d004f64b5fdbcce6fbca492acbfe127025845a2368d9ea46dea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137421, "uuid": "958a0ffe-a192-4367-b8c7-c31bf94303e8", "value": "T1CBC42308D45CBB64BFD90AE6CBC71E5C0DFB4F4C8B458276A1102B8D84216B439EB56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137421, "uuid": "96432835-7ee6-4806-aa07-19f6653634b1", "value": "12288:+DlQQRma+yol3HFsjy2tllqfVoXdDj3Afi52GLjKC:+D1W3lse2tDqfWNDlfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137421, "uuid": "fd9b30e1-1f36-4c85-ae90-a49214ae3ec6", "value": 575744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137421, "uuid": "69665702-000a-4578-b9db-d14a8ea72cc9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137421, "uuid": "ac54106c-2c02-49ad-933d-490caf2bc45b", "value": "Proforma Invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01a5782-1a30-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632155803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155803, "uuid": "65c454d2-0cf0-4040-883e-1769982251ac", "comment": "Malware payload", "value": "9cfe7e8046decfe80cac1faf92fd412c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155803, "uuid": "3ef75731-afa8-4b00-8a2f-2f85e6e2f386", "comment": "Malware payload", "value": "3aaddccd0cc2b844bdf1801f9862b90b218602d440158fed756b72b23b7e7570", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155803, "uuid": "f9ec662b-89b1-4869-b6b9-448c00668f0f", "comment": "Malware payload", "value": "20eab28431d148d365573a7a442e662967de30f3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155803, "uuid": "e53503f8-79ef-4db5-a787-04ae144ef451", "comment": "Malware payload", "value": "568dc78f40a959388ab73d0bdab2f45df348f64e05050cde7980efccea217d1fcc0de87fcfdcc3a060b3daca5b4b3c75", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155803, "uuid": "d85f62c4-d50f-43c3-a8e2-3e7ba6ac843a", "value": "T1C8566D16B284913FD0671A3A592BE694E93FBF6139228C0B5FF83D8C4F35580793664B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155803, "uuid": "2ba16b1d-79c9-4a73-b835-928c43757643", "value": "98304:HRk645Ic+DbIVKd5ylMnR6JlV/DOvcdVveWZBYAA:HRehErPmJlV/DWc/vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155803, "uuid": "10b0d7c6-70ce-4b7c-8346-66a126d118d8", "value": 6433792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155803, "uuid": "799d502c-c038-450a-ab57-b9e126b132ce", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155803, "uuid": "58adf29b-c5e9-457e-844f-5bf93c52759a", "value": "Correos_Pedido-GESWIQ6PF674DNZ.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d95e526-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125089, "uuid": "a38c9bd7-9999-4c99-9783-3005f288f13c", "comment": "Malware payload (Dridex)", "value": "f309453f88fc8dbd69388e131be2955a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125089, "uuid": "cd528c55-ca1f-4fc8-b936-671fa9fa5a9e", "comment": "Malware payload (Dridex)", "value": "3ae53614cb81e99a964592056aabdaa676931450906abf85b813c61da55b6ef0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125089, "uuid": "122c5052-27e9-4a47-b6fc-25a48d3f4d3c", "comment": "Malware payload (Dridex)", "value": "13846caeacc20f03c2d01cc738116d84de24d672", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125089, "uuid": "9dbc31b9-fc8d-46ff-8c32-3c085852f1a8", "comment": "Malware payload (Dridex)", "value": "b68e40fec00f087e936694be45b408ca1e6c888823462cd2b716ebe8ce93e78e350b138272a2243b84f9abfb1e0e5def", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125089, "uuid": "63605f9f-22a7-4923-b840-4c1bcba797dc", "value": "T1ECA5E120EE69E1E6C6B99F3E940835231BB93D75110D609CC391604F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125089, "uuid": "626a282a-e4b2-482b-ba62-36eec4b83763", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125089, "uuid": "58a2bc39-ed33-4e1b-8639-a590040f0427", "value": "12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ18:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125089, "uuid": "2baf6664-7445-4e64-991f-1f4cf3dea422", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125089, "uuid": "f2e2197e-1d7d-4aab-ba14-2f1e5d764fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125089, "uuid": "e74a75e9-14f1-468a-8dc4-d9c3d9c4a043", "value": "3ae53614cb81e99a964592056aabdaa676931450906abf85b813c61da55b6ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2230e29-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632160530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160530, "uuid": "1a3600a6-738d-403f-aa22-b86ccbd523e7", "comment": "Malware payload (RedLineStealer)", "value": "969ff450de04cac3791cbf4e3cda9b32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160530, "uuid": "dd28c9bd-a5e9-4812-a2a2-665f2e61e768", "comment": "Malware payload (RedLineStealer)", "value": "3b6b17e3b6a37bab2f7c435a31348c7abc3590275c6c087d50f68bf6b4b89f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160530, "uuid": "6ba6bf4c-d78e-4e52-902f-4ce91bbecd52", "comment": "Malware payload (RedLineStealer)", "value": "6a528bea6067aa1ad6b15985be299ec817b18863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160530, "uuid": "3756282f-e3b4-46d5-934e-8cbb2bd16678", "comment": "Malware payload (RedLineStealer)", "value": "b2ad53a9c15358b2e39e585da8c98b47b9e851708fee8151ac1bde645c02cd748669095bc277a68ddac3579c43ea0529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160530, "uuid": "d763dae0-fe92-48da-ad13-29b0ff7b3d15", "value": "T1A374AE20AAA0C035E5B712F849BD93E8B93D7D705B309CCF62D5A6EE26342E49C31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160530, "uuid": "63ab2fb5-7adf-4795-aa9d-38ff58a793ed", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160530, "uuid": "265f892a-3478-41bb-be91-26e474058493", "value": "6144:Zs7aNqGys6zIburtqrQSpcGmLf4FjhSjLzLT8aXkOsT:yO4s6zcurkPpcXLfUVSjz40k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160530, "uuid": "43b34038-19dc-4f5d-8a18-cd2b5dd1f980", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160530, "uuid": "ff2c7ebe-b752-4103-beba-4c05b8180d64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160530, "uuid": "120e044f-8bd0-4cbe-87f9-364b05d3750d", "value": "969ff450de04cac3791cbf4e3cda9b32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9609fa-1a49-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1632166561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166561, "uuid": "7285b349-242c-41e2-9f8c-ebf5a0c49d91", "comment": "Malware payload (Gh0stRAT)", "value": "487396a8bdc78e9e3a7e870a799f73f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166561, "uuid": "b4500109-ebb5-450f-9ff3-d6a934f145ac", "comment": "Malware payload (Gh0stRAT)", "value": "3b731d42e9a0f8df3d89aa32eecc096ab031b5d825957e33a1a7b65763682817", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166561, "uuid": "b2e49246-6810-4b49-95c3-19302f4573a1", "comment": "Malware payload (Gh0stRAT)", "value": "f0b566ee9ac79ef8645b05367a20850112d6feb1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166561, "uuid": "1b682bbd-c0d6-427f-90e4-88fe5d6d4ce8", "comment": "Malware payload (Gh0stRAT)", "value": "6c2a9697ecfd7243430105990756746eee20abde5be5bdd0303ea4aa0ecb5ffd535546a751542231df4fb39820eb7a55", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166561, "uuid": "2f0cd779-ffac-4fea-b56c-c332b15ab717", "value": "T1B884234A824DB8A0F4B236796AD7AE3F7398F9D52952CF1F890189C93C5DD30361B631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166561, "uuid": "f31be765-79d3-4470-8912-4335308f1a48", "value": "ea9a2ca34d2afbc261acd3a1ff33f1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166561, "uuid": "e0bfc041-757d-42a6-a52c-7c8029fbae0f", "value": "6144:p6IkicY+TdQcsRWzrThoecrMt3aQ450MJB3bvwHNlZJ6I6MaXwKBum0wEYS25iay:p6BkcsRqJo4t3iPPGNrsIeXwKAm9EYPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632166561, "uuid": "27f40bfc-48d2-4b64-8091-598c597dcaff", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632166561, "uuid": "e98a1961-3601-429e-ba3f-002e9ff2fba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166561, "uuid": "940758d7-b255-430c-82da-1b6f5468561b", "value": "3b731d42e9a0f8df3d89aa32eecc096ab031b5d825957.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703579e9-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125094, "uuid": "29c81ae4-2eac-477d-b5b5-5bb4d27f09ec", "comment": "Malware payload (Dridex)", "value": "0035f5cb040631c92bdf53af30a5a0b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125094, "uuid": "f186f952-5be2-4a7e-b924-fb29634e9ce7", "comment": "Malware payload (Dridex)", "value": "3b88509b3384b69e6b04a0435b58c4d2db78b5cce25a09131d78ecb58e31bfb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125094, "uuid": "f8f21a55-b35a-4f37-8974-ff6981d4a2e8", "comment": "Malware payload (Dridex)", "value": "8ddba5c7fbe70754d85568d3cba4c0bac570af1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125094, "uuid": "33b99291-6ac6-460b-9a69-efcb138d6b73", "comment": "Malware payload (Dridex)", "value": "c2ed7bc1c1de3ce1ec09b8c0170c5b98ef692488dcc283330f7679836108def6de1656e45413c409caf946026ac394cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125094, "uuid": "fdf5103d-921e-4313-8531-a6b6a469a52a", "value": "T1AC95E010EF69E1E6C6B89F3E9408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125094, "uuid": "23a80ff0-ed89-42b0-bae7-0a84405e17d9", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125094, "uuid": "330d5a91-752a-463e-b968-97c2acfe24fd", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125094, "uuid": "f0b35c9d-7ca5-489e-8727-90640f9c0f46", "value": 1994752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125094, "uuid": "4f64488c-ac70-45ce-8035-3b6e6631fe7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125094, "uuid": "e53b7115-dbcc-48c8-95a1-c8e63fe8f215", "value": "3b88509b3384b69e6b04a0435b58c4d2db78b5cce25a09131d78ecb58e31bfb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48e619d-19e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632123061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123061, "uuid": "1f4f1307-f3b9-4bcf-9e5e-a8f5a6130bbf", "comment": "Malware payload (AgentTesla)", "value": "55832871aae7651c5320136a4acb0c69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123061, "uuid": "6f4deeea-4848-4593-a6f4-fa73a3aec0fa", "comment": "Malware payload (AgentTesla)", "value": "3bce22bb44ee56691f74b2b71bc528cf5edb649db3ca441862dab76cea6792d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123061, "uuid": "25c92e0b-7987-420e-a72c-bba36c9eaedd", "comment": "Malware payload (AgentTesla)", "value": "8eb439a069bf87192cae2442edf710b2e55464ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123061, "uuid": "6cc6f22f-e087-47c0-9ec9-844af77e2fcd", "comment": "Malware payload (AgentTesla)", "value": "83615e1aa9b320f086b03f8335e0100c2691afa682ea01d0594a5b0b3ae7e7aeb2523b0785b7726a56976e4499b6046a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123061, "uuid": "34216507-7ab7-4ccd-a1cf-08d73ab72482", "value": "T178945BD1E296FCF8D029403A8575E9256A0B9B2EE8B4493F255E341975B738360FBC0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123061, "uuid": "96cb9418-9d95-4780-aaf9-64344b82b3ce", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123061, "uuid": "e38bc585-d8e6-4555-a65f-b21dc412312d", "value": "6144:s8LxBkV9b7EZZYXaueYEkKVGHkt4P8EMMbcOAzoR/TGhtyJ9X/qiTe:OXaueYEjVGEt4P8ET1yoAtY9vq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632123061, "uuid": "16c34352-4c71-4aab-810f-85ae55d11607", "value": 439607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632123061, "uuid": "7f83089f-1f71-4678-abc9-94c0aa1d0df8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123061, "uuid": "7ad173db-3a16-45d4-b832-68a61c823a96", "value": "QUOTATION REQUEST REF#E6448.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb0d55c-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632155990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155990, "uuid": "6c53a35a-7a3b-42f7-9fb5-de678428dbd4", "comment": "Malware payload (Formbook)", "value": "fea1f312f1a030c13152b3ec3f4d1c17", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155990, "uuid": "3c61a152-436e-4278-81c3-c4090aa8b17c", "comment": "Malware payload (Formbook)", "value": "3bf405e63323ac175eca7a3804f9ef2a81fef23e5d563f0ba8e8e4f24b64168d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155990, "uuid": "13a40900-9d85-4c87-8150-9f20200fad60", "comment": "Malware payload (Formbook)", "value": "a5cf28788f0024cbcaae005118d2af8187c17d87", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155990, "uuid": "5e1027cc-8572-4848-9d23-44bbad1383dc", "comment": "Malware payload (Formbook)", "value": "e705b8674b8fd08ed33d8bf7c91d50e8f8582f9c71315a74da6008b138ff51890a16c38b24e48a8474c2baa3d77b53cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155990, "uuid": "b4437dd8-badc-40f5-b8d4-2bb1242e705a", "value": "T19682D4ACD4A702A58F4A6BB4272B8F54058D7A1EF344A573323C63306BD2D7B911383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155990, "uuid": "e995c4ef-23ee-46ab-96c1-479a21dc84b1", "value": "384:alBW4KH3ulKzULLzQiYk016Vg4darz1Tg/dVN0AW1HuV9HR0X8u4INUtwYJ:044S9zuLciQ4d21TgF70AvrY8WNqNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155990, "uuid": "51db2183-e822-47eb-95b2-2455a7e1602c", "value": 18780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155990, "uuid": "126bbe9b-8648-49d0-b384-e348b9aff4f5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155990, "uuid": "b46a3995-7644-49aa-b969-f40ce05c89d9", "value": "sept quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f0b7ed-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125098, "uuid": "45538c29-6efb-492b-9f2a-0bb7c4080dce", "comment": "Malware payload (Dridex)", "value": "af0fe5101632ae02aeb10c307aaf21ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125098, "uuid": "b3c95235-318d-4a88-bbca-0b6d421317c0", "comment": "Malware payload (Dridex)", "value": "3bf4fc00339b062ffe07741db1a1587b1f00f2cb6593e6e904913ecd69ddbead", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125098, "uuid": "fc2c9794-9182-41d7-a6d0-77ad838c252b", "comment": "Malware payload (Dridex)", "value": "7e145915f197f9d57bf036429b52f9850e305953", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125098, "uuid": "bc04f2e0-1c94-4f45-8161-4dcd46b9c450", "comment": "Malware payload (Dridex)", "value": "a1bc1bb5f5a69b01e648d682990a90f1dd0041c2247df44ee8af500c5635ef799387d649d0d7f5776bd6a6763c9267a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125098, "uuid": "611d2c27-46ff-4701-bcb7-69fe70890a3b", "value": "T1D5A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125098, "uuid": "77f072b8-569f-4223-9a6b-26092572a8e3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125098, "uuid": "2c0b1cd0-e7fa-492d-80c1-856f2bfaf981", "value": "12288:BVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:wfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125098, "uuid": "63d85c63-26a0-46c0-983e-9276011fc729", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125098, "uuid": "c11a706e-db11-4cd4-9cbd-30104bbe7de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125098, "uuid": "1e5dbc42-0bc6-4f9b-baf5-24e365514e32", "value": "3bf4fc00339b062ffe07741db1a1587b1f00f2cb6593e6e904913ecd69ddbead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ab5fe7-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632146496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146496, "uuid": "cade7394-a01d-4a55-97e6-c149c7f3d3e6", "comment": "Malware payload (CryptBot)", "value": "83de589608f8e86bc18aced53c15fee5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146496, "uuid": "ae433994-1330-4fd9-a26f-eb5223b7e02f", "comment": "Malware payload (CryptBot)", "value": "3ccbf80eab6488bad3d00b6d181967e692e045e818fb3ca79887f1a0f5d27677", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146496, "uuid": "8e043bd0-7574-462b-9f5e-dbee3f334201", "comment": "Malware payload (CryptBot)", "value": "5ce376fa542c1a4f942a69168a6bf1320e0f32e7", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146496, "uuid": "046571e0-64e8-4de4-a242-138f754cead4", "comment": "Malware payload (CryptBot)", "value": "3dd5e1da9137e2b4a51ff54ff515a9a4b387c921f54fc033cbe792ef6e91094c456fb305382073fd4eeb19f20fb63119", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146496, "uuid": "0937410e-a7b9-4db5-8579-dc8223b7b180", "value": "T14E74BF20B7A0C035F1F712F859BA83ACA53D7EB1AB7091CB52C616EE26346E49D31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146496, "uuid": "7ab57854-2ef4-4432-8266-3b3427e09efe", "value": "99e1335f3817517f11962dc50cb29aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146496, "uuid": "1d94f7f6-e832-473c-8bd5-c524ea8fddd5", "value": "6144:yiZQtz7z0IFwicWyFN0vu1FwWvsZ86gu7oEB5lT2phigAP4X0E0c8:XZQz0IFwiNY0vQHvsZ7gu7o25J2psgAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146496, "uuid": "a6d90d22-8608-456c-8bf3-ab2653faf1ee", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146496, "uuid": "21ca1c4c-ff4e-47a4-8411-572b3bd7c9d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146496, "uuid": "61c50c14-a680-4150-b886-1006c69259e5", "value": "83de589608f8e86bc18aced53c15fee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb886415-19da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632118778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118778, "uuid": "61899ec1-a953-477d-9ba3-fd744f7ab8f3", "comment": "Malware payload (Loki)", "value": "6fb5023b4c419860fe5102aad9ad75e2", "object_relation": "md5", "Tag": [ { "name": "EST", "colour": "#6FED99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118778, "uuid": "8585e470-dc88-405d-a028-234f2781c76e", "comment": "Malware payload (Loki)", "value": "3d7ff7b5c3895822950678253ac0465c62854af18802895bfd193ff6df0d0572", "object_relation": "sha256", "Tag": [ { "name": "EST", "colour": "#6FED99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118778, "uuid": "8b0bbff8-7654-4d97-b559-6f29f486b3bc", "comment": "Malware payload (Loki)", "value": "650a8a4b4d0f947a0f38cc6cc13d5f21592daaa4", "object_relation": "sha1", "Tag": [ { "name": "EST", "colour": "#6FED99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118778, "uuid": "62074ebd-0d41-4687-b5af-277e2418c21b", "comment": "Malware payload (Loki)", "value": "32757f7445d9dc1636d088fcc7e04e13f63f72391fefc767a2208df9fa5062accda06c65465957fe0c82b429c46e6789", "object_relation": "sha3-384", "Tag": [ { "name": "EST", "colour": "#6FED99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118778, "uuid": "b7c0756b-63e2-404f-bacc-96149810d0d0", "value": "T19545CC298D2682F7C7EEC63CD05C4F9EDB62AC837A618F0E98C1B696167770BD18444D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118778, "uuid": "148635e9-5f66-4c96-a71d-a34f28030728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118778, "uuid": "f4bee156-1484-4388-b064-c2dc72c75e3a", "value": "12288:JBkFT+iT4G8tUJeqn2enHEyiSyR0rWzvP7r9r/+pppppppppppppppppppppppp1:JBkFT/T/Jeqn2eHy6aj1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118778, "uuid": "e782d61e-8043-41ab-a3d0-fb7e0722a38e", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118778, "uuid": "8f28dab3-0a62-478a-a179-e9644b9e32ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118778, "uuid": "3ad0abb6-6d7f-4032-83ee-f86dc699b898", "value": "Eesti Kaubanduskoja uus sertifikaat.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccb28bc-19f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131987, "uuid": "86265228-30d5-4cb7-a01c-59179b071654", "comment": "Malware payload (RedLineStealer)", "value": "91b0e36e061ef9a46b198a8ca54e753c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131987, "uuid": "2a4b8f79-5e0b-4a75-b9c1-59508f876d57", "comment": "Malware payload (RedLineStealer)", "value": "3d9c989fec01c48d91044ab58bf7af9a8d425609ec4dd8633216c106f8c880c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131987, "uuid": "946df021-feba-425d-a946-b75004b2be71", "comment": "Malware payload (RedLineStealer)", "value": "cf0bf4f4818bd5e1d1d06ba75b7855daaae6dd7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131987, "uuid": "8fcef720-7d26-4fd7-9892-979eb9a6b4f5", "comment": "Malware payload (RedLineStealer)", "value": "8c5a3b159e5b12e170ff42983dc85fe8f978bfab5dd7296ffa14cd98f97d0670dda56082c856671c243e2ddb6b6a1716", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131987, "uuid": "ad37672a-278f-485b-a05f-ce863a506aa9", "value": "T1E1B3A52E659431ECC394AC79A83E52B4D25A7C37F91D91C4A68DF1CE04312ED989EB3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131987, "uuid": "df792c8a-bc99-4902-9537-ffcf7f4d49d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131987, "uuid": "a42ae469-af33-4f73-a926-e24cab55887e", "value": "1536:XCPTcDN+mZ3KMyvWYTfmulP0xbc69krpRzyW1ZR/CL2VBVA8n41vTq:UwDN4BVlqbCTZZBVBVA8n41vTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131987, "uuid": "a3d6f82f-0fae-418c-bc07-fbb583158fd4", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131987, "uuid": "0c99f798-7df4-44c5-8cbb-682a5166157a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131987, "uuid": "74ae544e-e539-4c61-a31e-1424762c362e", "value": "91b0e36e061ef9a46b198a8ca54e753c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d703c2e-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125143, "uuid": "8eb792d6-9575-4f4f-a44d-0b3b7f5a3c39", "comment": "Malware payload (Dridex)", "value": "f6e2c42cd2449d4ede54f81591682b80", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125143, "uuid": "36b39546-123f-4a18-8be2-f8d9b49d04e5", "comment": "Malware payload (Dridex)", "value": "3e02f35fca75fe1f4a0b55a8b1e287ed89952614a1beee8ae8656fa07ee0811e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125143, "uuid": "f197faf6-3201-4673-b1c1-c1f86ada7950", "comment": "Malware payload (Dridex)", "value": "64511ddd7b1bb45ce20141c03a7352fbccc63214", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125143, "uuid": "371cb693-e3f1-4b63-9d04-1b7059f342f0", "comment": "Malware payload (Dridex)", "value": "2d9bc3725510b8597dd561bdd71e7fa8f48018388fd23ae7da39cd5fa63dc3b367b005ca8314ab0e7a5c0d5eea12b085", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125143, "uuid": "5bc78e02-bdc8-4456-b21c-aa31e021ca25", "value": "T10995D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125143, "uuid": "53d5f508-6eca-418c-9987-8fab958da614", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125143, "uuid": "02966578-f2d4-470a-af9c-6c3e917685e8", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125143, "uuid": "9e692ea1-79e9-4d26-9cf1-9955260f327c", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125143, "uuid": "b6bfcb57-c480-4d6a-975f-acadff3be3e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125143, "uuid": "e35c4b4d-a6fc-4c69-98b3-74cc8079725d", "value": "3e02f35fca75fe1f4a0b55a8b1e287ed89952614a1beee8ae8656fa07ee0811e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a23caec-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125137, "uuid": "9041e85e-75e4-40c6-b08d-2e04fd3e26cb", "comment": "Malware payload (Dridex)", "value": "70cc7acf54428a179b9da2920a84e206", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125137, "uuid": "7a42a643-5a3d-4b8d-a397-e49f0c579f7f", "comment": "Malware payload (Dridex)", "value": "3e1e9a721e7a5fb5539a3e83d0975eb5b0c0ea1e9fe92c04544386a810123328", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125137, "uuid": "4ac6048f-100b-443b-b443-4ace9b6bed51", "comment": "Malware payload (Dridex)", "value": "a152f2744da367c4c70c785299c65f316472f4b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125137, "uuid": "ea6ec976-270c-44a8-8a18-a49fa746ff46", "comment": "Malware payload (Dridex)", "value": "d9c2feb1f75fa95e015a0aaf1f47e51a7916f22b9499541c5a9a14dea90ad3da26656bdd6c53834470fdc3f9d77d07e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125137, "uuid": "a62913d8-9e94-4909-9717-623b82e68b6b", "value": "T125A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125137, "uuid": "e95f0e96-1885-42ef-8857-249e5b1b62f1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125137, "uuid": "962c7e2b-37a0-4625-87c8-c3c922ff93fe", "value": "12288:lVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:8fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125137, "uuid": "b0a55c03-308a-4108-a62c-68e80c3082a3", "value": 2125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125137, "uuid": "c15f2f1a-93a1-4784-a6b1-2603b5f95580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125137, "uuid": "2b2d55ec-37c9-4d5f-b2d5-8d76406f3ff4", "value": "3e1e9a721e7a5fb5539a3e83d0975eb5b0c0ea1e9fe92c04544386a810123328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5a804e-19fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632133571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133571, "uuid": "dac73f9b-8a1a-47b3-834e-e225cab7ccdc", "comment": "Malware payload (RedLineStealer)", "value": "eace0039dd2f8fb2a963b0cf8208b8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133571, "uuid": "fd62adf1-16dd-4c83-b620-d445726e7371", "comment": "Malware payload (RedLineStealer)", "value": "3e66d72e6cb4fab3bf03a7a1ba048e661b9669928a021140d4d0cde12ced097f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133571, "uuid": "84130a54-0dfa-4571-a8b7-1b73b70d4057", "comment": "Malware payload (RedLineStealer)", "value": "3c9095b0e6b423b17abb966bc2dce7092a05fe70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133571, "uuid": "084c56fe-4d3d-46b4-800c-97952bd75a05", "comment": "Malware payload (RedLineStealer)", "value": "41d77bfd7883f4e32c060021d888494f6df376f078f1f3e3a51abd9aafce81e7c5f1e258842014497877e11127efb2e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133571, "uuid": "eb52a931-15fa-4ce1-be49-82c8f78f837a", "value": "T1B065DD358D55A2F7C3EB8B3CE01C168D9BB1B693BB918F0E9C8186A6025772FD64417C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133571, "uuid": "37ce235a-9d31-47a5-8bf3-0e69677c5924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133571, "uuid": "4304ccc0-b355-495a-b3d1-8006231eb3f1", "value": "12288:p2hhDcnbPxuhAjGSJTRQ2b+pth7BmwE5Td3o:MEbPAhAiSJTRQ2bSthtmwEp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632133571, "uuid": "ff9292ff-635c-41d4-892e-3ed7a9cf8a25", "value": 1478656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632133571, "uuid": "cd12b41e-5fae-435b-924e-f4bee521a33e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133571, "uuid": "a66a6497-d615-48a5-ad3b-085b85c8b14b", "value": "ttcopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a7cd66-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632148890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148890, "uuid": "f59109ed-891f-4eae-a464-485d5620601b", "comment": "Malware payload (AgentTesla)", "value": "19908a728b35aaa4ba7b9dc6d385cb24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148890, "uuid": "2359d200-8dc2-4df6-a293-3259ebb19da0", "comment": "Malware payload (AgentTesla)", "value": "3e86f01bdf7832cedc1fc52b0f23d883abda9b4920491f9d440d5d4517826622", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148890, "uuid": "da230e79-a1f7-4575-9ee3-00a82adff63b", "comment": "Malware payload (AgentTesla)", "value": "8f8463f1b65029586869c55941bbd15bc056e0e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148890, "uuid": "609309e2-a3b1-4d3e-a7ed-621d8fd68337", "comment": "Malware payload (AgentTesla)", "value": "6a32a307a0e03c6c63deb5e7682c8beacc7e7a7736b69ef684ee2819d3691920b349e2860c737946bb786141d10e8334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148890, "uuid": "eee7afac-8856-4e3e-82f3-84ef849bf7b5", "value": "T18EB423D6EBA1ECDC9290CDD65E0719CEA70836AB9477307BD63328066307747638BAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148890, "uuid": "03fd9b26-b329-4cc2-b941-e6fb15818248", "value": "12288:t2RB9jyoyME7RB7Aua9Dq09JQjYlVbgTgMsCcZZQfZcAXut96HjI+:tgyoyM2RBa9Dq8OjYldMDQZIBXk6Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148890, "uuid": "276c7bca-3f84-40c8-92e6-7479ac99bd14", "value": 506865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148890, "uuid": "b2b9bd15-7a2a-4d22-9a71-d05ef3552201", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148890, "uuid": "2a972dad-3b01-4916-9d02-233e4b0105fd", "value": "SHIPPING ADV DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c307aa-1a40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632162417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162417, "uuid": "e9c17c49-d205-4df8-92bd-d82cebef8b6a", "comment": "Malware payload (Dridex)", "value": "f776730fa7bfed5c7e98aa0a5e1ebd34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162417, "uuid": "b7a6fe15-7d36-4c3f-9457-c8d8d61f11f6", "comment": "Malware payload (Dridex)", "value": "3ec7158693ef7f4a03534695d13976f55a14cba1b697dab458415a91786f5555", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162417, "uuid": "49974b8f-28dc-4ae9-b0c4-3d4c0e752800", "comment": "Malware payload (Dridex)", "value": "d4e4b434b1bad64863ddc055246460ce42b4f8d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162417, "uuid": "5407afba-2e8f-4724-a389-c8c8fbc8f2d1", "comment": "Malware payload (Dridex)", "value": "b55e5fbe690cff71bc513069daf64131a069bb3d8324ab9f882bf62796b5a4997dbc04027e2d2a9073d2c01945127f2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162417, "uuid": "fec39c2e-9b92-45c1-92ba-fe01fee03afc", "value": "T1C314E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162417, "uuid": "4fcab96b-b5e8-4d9d-9854-2f02e4c3b30e", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162417, "uuid": "90d928c0-9aef-415f-986d-657cf8cf2803", "value": "3072:h9g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCestC:h9g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162417, "uuid": "34558aea-c06b-4848-bc8a-254920a3c651", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162417, "uuid": "783a0602-5856-48aa-83ff-0962b133568d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162417, "uuid": "850c811c-3b09-4387-9399-eee2b8ad838e", "value": "f776730fa7bfed5c7e98aa0a5e1ebd34.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79289b0-19da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632118798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118798, "uuid": "a830b685-118b-4b3e-bd2c-6efd78a545ea", "comment": "Malware payload (STRRAT)", "value": "6b796640a36a3dc359ad43106c3d1eca", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118798, "uuid": "77e50530-b24a-45f5-a64e-21669406953f", "comment": "Malware payload (STRRAT)", "value": "3f0b6fc350eac244c1bd1b59e6f7e46307dd63c3f0cc41e61e3ebeb604c0492e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118798, "uuid": "dbe05d05-24b9-417d-85ad-3f2a4fb29797", "comment": "Malware payload (STRRAT)", "value": "5f2b62ddff81056fcc73938a6f9cde78cf9a197d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118798, "uuid": "dd2a8095-aacf-461b-b51d-457d7604f5c4", "comment": "Malware payload (STRRAT)", "value": "65b891abcf35efff7477905ac3add797f2056bd6298f96100f389f62879081f371f3afe0a9cf2c9d2eed8a6d49e7b07c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118798, "uuid": "1dcaffd0-caaf-4dd4-951d-8309f079b433", "value": "T16304F16FBD5B81FAF55B5436A9194326925D81D4D0C2822F79FC08190EB6D2A0F03EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118798, "uuid": "2cbab6ff-954b-43d7-9884-9a6ea1a4e490", "value": "3072:+QDvUTL+iTjzqsL/HRgbmCoUNrqkhVe3DANqAyO/lZF0lFhZFrzG55bIAJoLPXA:+QTFiTjN/m2UNeMcA4VQF0lbZ5zyuAJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118798, "uuid": "e93639a6-344b-4a4a-9aa5-c573082e0275", "value": 188571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118798, "uuid": "043dac29-b891-4cf8-856b-cd9907778dc9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118798, "uuid": "8d742070-51dd-4306-ae43-6c58656dfd0f", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e81ddda-1a08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632138352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138352, "uuid": "3082cbbe-bdbf-48bb-a21d-394d59920ea7", "comment": "Malware payload (Squirrelwaffle)", "value": "77bd39191fdc817f2f14f0462bff8d86", "object_relation": "md5", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138352, "uuid": "73bfc037-9c69-48bd-90cc-e56e1ed76b1f", "comment": "Malware payload (Squirrelwaffle)", "value": "3f453d0703fa81709d25c6ade25215066f38abceec9699b7b49fb9b4171bbb50", "object_relation": "sha256", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138352, "uuid": "e6396e15-f781-4232-af04-ae490f8208ba", "comment": "Malware payload (Squirrelwaffle)", "value": "ea94f85f59615cfec1b3d330810e9d91ff79bd71", "object_relation": "sha1", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138352, "uuid": "3114d0a2-33f5-41f0-b1bc-70213203d9fd", "comment": "Malware payload (Squirrelwaffle)", "value": "9d41353f6e96ba183277586442833398d21c72f3a06338ac6b94c4025e404d06a214c97ba50292fb61367e262f71a424", "object_relation": "sha3-384", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138352, "uuid": "267b5db9-e68a-40b8-833b-a0a688a7e0ed", "value": "T14844D02636A5A41DEC2D2B76A8BB53D02337FC504FD38BC77AA772263F726914D22405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138352, "uuid": "bf01f408-3524-4c77-9f4b-d3818fcf1f5a", "value": "6144:mKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+knfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmE:kj7CqScwoRZ9bSXkh/nLKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138352, "uuid": "b9976315-b071-4141-aaf6-0aebed788018", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138352, "uuid": "7a01fc19-85cf-4df0-a258-ab81ad9d602c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138352, "uuid": "63d6e716-3015-43be-8adb-72c2c321fd7c", "value": "diagram_1376118316.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42bfb14-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632146253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146253, "uuid": "f504d571-b963-45af-8f72-d11bdf1dbd66", "comment": "Malware payload (AgentTesla)", "value": "aa3c7de73ca4d0b74156e10748c672e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146253, "uuid": "09297ceb-8369-4a58-b7a1-0167b20a756b", "comment": "Malware payload (AgentTesla)", "value": "416d1974189d1e8078830a2e52bd899061ab2f97524a72cbbafc892234b359cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146253, "uuid": "cff8b3e3-f950-405d-ad12-50bb2d996665", "comment": "Malware payload (AgentTesla)", "value": "4adcdd11d0e79a0b5a24ae20927a0ee3c4fd29d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146253, "uuid": "04492213-40b3-46bf-b15b-7702e444af18", "comment": "Malware payload (AgentTesla)", "value": "8cceb4e67451b6991f34f13415a573ad320e6883b5b41dce1efea0563a5ef5a8419d06e389c2bf94dffa2473cadd9331", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146253, "uuid": "2b68f26a-67bf-4e87-b622-63d8800d3eff", "value": "T198457DAC3711F9CED567DE3A86243E549B50B1AA0317F743A52718E9E94E4CAEF040F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146253, "uuid": "4287884d-6765-4ef7-9c46-a1faedde976b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146253, "uuid": "83c7e1e2-3bdd-4b18-9261-8d6ce97c7488", "value": "12288:KQUWn1i6JXmzxt7O5YI4uG7FXLVdlLuEbVxw6Nc29U59wNUtO+hwKHBAbYmkyZco:KRWnBu2p4hhVfqExxBnXEPaiaPDdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146253, "uuid": "d0234858-d03c-489c-9d56-a645eb435a64", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146253, "uuid": "ccb7c6dc-42db-45f8-a24e-31bd481a3665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146253, "uuid": "41cc7c6a-d499-42ef-ae5a-7c99dc0ad026", "value": "aa3c7de73ca4d0b74156e10748c672e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca5e2d1-1a08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632138402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138402, "uuid": "444d5430-bfb3-4915-a387-3b05bf558bbc", "comment": "Malware payload (AgentTesla)", "value": "17bcb1ba0414eb523c2094ba1c764577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138402, "uuid": "53737ece-c843-4617-904d-016f69f76d6f", "comment": "Malware payload (AgentTesla)", "value": "41a6bde2687f9d58a168f42d69c1cde7e0a82108227edfaffba9f88a4ba40dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138402, "uuid": "30057070-4426-4112-9903-c9e86d18439e", "comment": "Malware payload (AgentTesla)", "value": "7488184458ffb7bd859141f8b8285f165d2c1736", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138402, "uuid": "8d05bd72-82bd-45b0-bac4-a7f98084dff6", "comment": "Malware payload (AgentTesla)", "value": "55dcee1cedd9a6c74532a3f897fa6ece184a8c1726d8548f02ec350e876f54745e24b63a5fa9555563d17752a845c063", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138402, "uuid": "0bcfd807-279a-49d6-a0bc-86f4ab8c777d", "value": "T1FC55BA294D2682F7C7EEC23CD05C4FDEEB61A8837A518F1AD8D18AC7166770BE58845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138402, "uuid": "d79e2296-7e74-4e6e-9207-7eac2f5cb3af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138402, "uuid": "76c6956d-f9f2-4268-b8ee-ab8b2f41dedc", "value": "12288:O3mVngSaNfhBbl/eHzmTbdbZmkvmw7hYk8:O3mV+NrETSbdbZH9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138402, "uuid": "2e75770f-35fb-4afe-82da-f293710abf70", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138402, "uuid": "6c603ed4-8300-4f8d-8132-ca70d4098bd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138402, "uuid": "1d2f7796-4727-418c-9826-b4dcfdb88a62", "value": "d1zcl4uX5lfH6e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416da5fc-1a21-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632149067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149067, "uuid": "8a458f3d-c640-4972-9cae-799bb19d4210", "comment": "Malware payload (AgentTesla)", "value": "b8245d465885669f2689531b114310be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149067, "uuid": "12c6633b-f9b3-4861-bf2e-cdbcba92f0a8", "comment": "Malware payload (AgentTesla)", "value": "4211501aaaa2f4959d061a45c43055819879b2bac7f54070fd502319d22d8ad3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149067, "uuid": "648364b0-9008-42d9-9689-a930226d04e5", "comment": "Malware payload (AgentTesla)", "value": "b378d779a3e549320794e3b8b8d3e21a4ebbe359", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149067, "uuid": "c4f5f4bc-10f8-487d-86a5-82ab545bf26a", "comment": "Malware payload (AgentTesla)", "value": "2acc78e350cc63ab7230d3d0252463fe3b16b296421a352dd999c2a333ac3e935cf49ea9a7275b44597eb7941e4fdf6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149067, "uuid": "ced91c4d-c79c-4689-94a1-bc2d21b45a5c", "value": "T151B423D6EBA1ECDC9290CDD65E0719CEA70836AB9477307BD63328066307747638BAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149067, "uuid": "f85d05d2-78d3-42be-8b80-92136ba61e12", "value": "12288:Q2RB9jyoyME7RB7Aua9Dq09JQjYlVbgTgMsCcZZQfZcAXut96HjIl:QgyoyM2RBa9Dq8OjYldMDQZIBXk6D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149067, "uuid": "9671c35c-7195-445d-812b-9609ed025dba", "value": 506867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149067, "uuid": "8d370865-9c85-441d-8749-4ed6dc0aac65", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149067, "uuid": "d2ddbcf7-0fa7-4d77-a1c4-3f0cb1b7c686", "value": "CONTRACT DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767b287e-1a11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632142284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142284, "uuid": "a66c82ec-4ebf-4cb0-802c-68619189bde9", "comment": "Malware payload (STRRAT)", "value": "88c7d170c7f5491ac2edd0b4621575ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142284, "uuid": "c80937ed-12e5-4aa6-a1e0-9eedba188a41", "comment": "Malware payload (STRRAT)", "value": "428044bde3ed9905c2edce3eb836629d15448bfa1e9f3d571b0d24d739c16af0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142284, "uuid": "4372e230-710b-48eb-ad4d-b308017f315d", "comment": "Malware payload (STRRAT)", "value": "b7e22eb1fdccbbbec5a4a3d21cb95a55c7346b1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142284, "uuid": "986c1265-cd26-4f12-a390-ad1e09e69d3a", "comment": "Malware payload (STRRAT)", "value": "1e285b43561470d61938207782fdc62b3097124c9223f307588b77a9a12d215bd5c1947ffb991ede4c57ac5697452dda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142284, "uuid": "86ac8a60-e547-45b4-b61e-5ea947047f4c", "value": "T14C14ADD41DC31B9CFA28A339D0EA152B4EFCFB1BD408640176AF6BC69FAA043B51585D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142284, "uuid": "3078f9bd-fa3d-4f24-a8ad-fd02b9dde993", "value": "3072:choILzBAxqs3+BeZ9oGLxtRXeqyJgZVJ3IoNgsdAm5ir78zyv7MJku:yLzyq6GMou4HkVRHNghmoHjyku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142284, "uuid": "e16640be-6e4b-46a9-9d87-5cc8191eb6f6", "value": 190513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142284, "uuid": "1bc91142-dfcb-473d-b72f-fe5c1fc9abe1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142284, "uuid": "86c43482-c086-4de1-a9c1-3219792a8b9c", "value": "required order quotation offer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cc7171-19a8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632097238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097238, "uuid": "a65e7f09-b295-4c49-8d2a-3816ccc7a67a", "comment": "Malware payload (ArkeiStealer)", "value": "38e1e8a27861d0eafbed16e4cc117491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097238, "uuid": "4000bbc2-c10f-4d28-9084-f335bb2ba7d7", "comment": "Malware payload (ArkeiStealer)", "value": "42a80e1f597446f0739751c300ba920564f0defa00ab759b1c5d0b682f01598d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097238, "uuid": "ad45bcf0-2e8b-4dc0-8cf2-98a44d4dc8c2", "comment": "Malware payload (ArkeiStealer)", "value": "f15e738c25be48c150f1521fcfbb39da98251f09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097238, "uuid": "96548f43-c5e5-4b87-9623-d6454870dd0e", "comment": "Malware payload (ArkeiStealer)", "value": "74243bb463a1bd42d914c34c0025e4f57f522d85560964d4d026010641fa7945ce34219fff2d9584fa67ee80279d42f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097238, "uuid": "f71f4cf7-99ab-462f-923b-6abe2b8ac8e8", "value": "T1AAE4F120B7A1C036F1B712F989769769A83D7AB15B3450CF23D612FE16386E89C31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097238, "uuid": "2d8bfd9c-c95d-4740-b5d7-cfce93ee2c7b", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097238, "uuid": "ce5be4ca-3bda-4092-81eb-b7f86e44a4f9", "value": "12288:RZNH/XWZIjMeKuR6lKpvTnnyWc2tB56TcN71YqP7Jkk2ZGuv3BRGJpqqj:R3H/Xwzu02bbFkTU1fjJkk2Z9v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632097238, "uuid": "3f2483e2-f2ef-4dcc-af08-16a35769e3d2", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632097238, "uuid": "5fad2c08-e86a-47d1-99e1-3e93f11c50a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097238, "uuid": "91dc68aa-cfd1-4b73-b9cd-ff7d40614069", "value": "38e1e8a27861d0eafbed16e4cc117491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2f163b-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632151927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151927, "uuid": "daed8dc2-8fbd-4a7e-bebb-c3511cae81a9", "comment": "Malware payload (Formbook)", "value": "b60ff49a36670b785048b28e003ac616", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151927, "uuid": "912eb6f8-93d7-47a7-a9d8-b6035aacadf3", "comment": "Malware payload (Formbook)", "value": "431d2d39a6555e194ae8b771e282157a2927196ee903d7c1adb4071d18303776", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151927, "uuid": "069b2b80-fec7-4ebd-becc-17e17cb4edd0", "comment": "Malware payload (Formbook)", "value": "7c92feab3172e6de899d19445789417a7d416434", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151927, "uuid": "1e1c7450-2870-49ce-8e1a-43c8adb5ee59", "comment": "Malware payload (Formbook)", "value": "c4d23d9e6b0a3e42c6803b03266c46ed7400ab929145773af1c08fde0f41e54d2ce4a279a0045f4e7e966d0fe3adf884", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151927, "uuid": "db52eed8-3bb2-4345-889d-cb41b5d87f4f", "value": "T11CC4F176F48B5786CA4A1279697ACD1BFB958C06293A870832D3352C7C36FCF056817B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151927, "uuid": "26c36d1e-b333-4d60-94a8-f0c0d77f1e1e", "value": "12288:gEhOI5nstu/882L8EoVghZ5WeXBWIWd9JNbwyHeR:bxnSwHEoVgr5WE0IWPJNEyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151927, "uuid": "5d5406ff-0d1c-4e4f-993c-278bdd1ae84f", "value": 594936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151927, "uuid": "7fa01a24-673a-4389-a061-955f38366057", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151927, "uuid": "5604a0e5-89a3-4cb2-964b-02a5e828bc3e", "value": "Order-AMU.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34494542-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632160212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160212, "uuid": "e7dd1f0d-1687-4b84-8b72-1e652b740825", "comment": "Malware payload (Mirai)", "value": "770e4985b0b61240f96ac8adcc1f37a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160212, "uuid": "c496342f-e400-4aca-b8af-83cec3f630c3", "comment": "Malware payload (Mirai)", "value": "433f545c5599b967fa5e8ad03e6f5c977e27948948536bbdb7816c3a5aff19be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160212, "uuid": "e8dba51f-2537-48ee-b4da-9104b78d0355", "comment": "Malware payload (Mirai)", "value": "8297d99a526282a887c141466f327bb53fb47c75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160212, "uuid": "f6439fde-577d-41e8-8a63-adf30c063c5d", "comment": "Malware payload (Mirai)", "value": "a43c32fa57dd8fad5f85ef435db2c3d67a83af1b2fcb07b82fed7919680952e0f18872dfbea83555b66fc892cf57c613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160212, "uuid": "7db819be-024a-4870-a0c5-0f2b13f1fdc6", "value": "T1AEA3A0B590A45D74C2150E34B7D8D8388B26B80467F63EF2DE89CA560443FE9F06E7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160212, "uuid": "48be0d8a-9362-466b-adec-165e2f09e13b", "value": "1536:k/Daha/aA1JrsLYCF48ZcztVjOmfZ3XqK+8Akrz2VUqhtrsSivCDxBQ:krg8J/sLYCa88DjJdqpGrzWrsSiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160212, "uuid": "3732c176-1db5-410f-82fc-f5ac85868283", "value": 103472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160212, "uuid": "487eed75-938c-4904-92c8-30d9240a0636", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160212, "uuid": "d7317ca3-8113-4327-9cde-af75f7a57a29", "value": "770e4985b0b61240f96ac8adcc1f37a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d181797-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632146563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146563, "uuid": "48da9b07-5f95-41f7-b7f6-119187bd086d", "comment": "Malware payload (RedLineStealer)", "value": "58aba679f067c21a66e4a69a1ad77fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146563, "uuid": "b5f3555a-8a2f-4f16-baf5-f56a1e2d1734", "comment": "Malware payload (RedLineStealer)", "value": "4396ca0aae315ad2bba765753f85606a95e5309acde75f3577d93b282f35aba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146563, "uuid": "4a6c716f-5d65-46a6-a63f-54968a2c1186", "comment": "Malware payload (RedLineStealer)", "value": "f16e3ffc0146447756d29f3945a1c882cef30262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146563, "uuid": "d73a615e-2543-487f-ad51-4a4f9dcf3728", "comment": "Malware payload (RedLineStealer)", "value": "ec5082f8fb51594528ce6b53623fd0781d9eeefaf3423b4560cf2a69811186cd184c0b89dc8ec11dad0daef636d1bf7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146563, "uuid": "bc65571f-1fcb-4a5e-8496-00268e0dbc63", "value": "T1E464BF20BBA0C036F5B711F51AB993A8A43D7EB16B3481CB62D616EE56346E4DD30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146563, "uuid": "f2548b0e-094a-4db0-89a0-5cdd8236e2d2", "value": "99e1335f3817517f11962dc50cb29aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146563, "uuid": "ef926ea9-f6ec-4883-bc9e-9fce92ff1e1c", "value": "6144:oKZQ5L1LyWUPUeWfFtcVoSz+qoxxI94yQZkDJE18:dZuLyWUPUTbcVFqqoxm94NkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146563, "uuid": "b429eebd-a9ec-4fbd-8ea4-7b225115b05b", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146563, "uuid": "f5c92a9b-0d5b-47fb-9838-80ce876d173b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146563, "uuid": "62ef87f4-779a-40b5-b08c-c7483761e04f", "value": "58aba679f067c21a66e4a69a1ad77fd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dc5811-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632121261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121261, "uuid": "dccf5102-0d9f-4599-a1a4-6ee20ef5508d", "comment": "Malware payload (Smoke Loader)", "value": "87dc873cb2750ec5d3ab97b9ac15d354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121261, "uuid": "a2f6e221-88bc-44b4-92fd-63e8738cf3df", "comment": "Malware payload (Smoke Loader)", "value": "4576ae2f7d752217f761bde0d1618cc866be3d3caea42720cf26a9983b8f5f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121261, "uuid": "fc0ef486-f81a-4e44-81a5-9c3f1d77d857", "comment": "Malware payload (Smoke Loader)", "value": "7b928a42eece7fe73f354ab54f5c982f5cbc53ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121261, "uuid": "f22a036f-bc93-4988-a56a-ac96da3a8e37", "comment": "Malware payload (Smoke Loader)", "value": "e9a3f74b0a22a12ffde4230b8e88e7cf20455cf0346696f60eb3826bf1dfed8b046fffbdfd1de58ecd0695be87434483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121261, "uuid": "af661bc9-a6f5-44a1-b90b-dc562d74a42a", "value": "T19F348D20B7A0C035F1B712F955BA83B9A83D7EB16B3450CF62D616EE26346E49C30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121261, "uuid": "f02265dc-f991-403b-838d-0c8b7b4bb40b", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121261, "uuid": "9f12d061-ceef-46b9-8622-236fe6f858ec", "value": "6144:rBZQuBT3I7M1BFd6F2z6T86POZxg3jMDyjCIc8:tZ73I7WBPz64L4TMXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121261, "uuid": "5026a42f-52b6-4959-909e-8d4b928ff228", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121261, "uuid": "b94a2c0e-b6f4-4182-947c-548f0907fd34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121261, "uuid": "b8e38fa3-705d-4fa2-92c5-e695012c7a49", "value": "87dc873cb2750ec5d3ab97b9ac15d354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d505834c-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125263, "uuid": "7646f377-13bb-465f-adf8-47f71a027def", "comment": "Malware payload (Dridex)", "value": "1a36208fb6c0dea21f4af9dad22ef386", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125263, "uuid": "eae803db-f18c-43a8-bc50-5d41f2e89dad", "comment": "Malware payload (Dridex)", "value": "458a8d39376d0388a968a568410562990c19bc18d9df13290d67f6a2634dc69c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125263, "uuid": "58e8c40b-dab9-4f46-bd14-55d7d6426236", "comment": "Malware payload (Dridex)", "value": "f1ab77a6d096a1f5da7dd95b6735142fd505073c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125263, "uuid": "d5c77922-9966-4cca-a674-1045bff94888", "comment": "Malware payload (Dridex)", "value": "9953492cf7ac84f80661e0fde4510e996376bb50fed93bb1e1d88ce2c391fd1bff776c55612361e1f9f9b9c533449905", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125263, "uuid": "d329b9cc-9736-4945-80ab-889366c1e501", "value": "T1D3A5E020EE69E1E6C6B89F3E9408352727F93D75110D618CC392704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125263, "uuid": "d5a2ba88-8d08-4162-928a-9aea3e5f4743", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125263, "uuid": "797e1f92-0942-4945-8d18-f6d89774fe86", "value": "12288:dVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:EfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125263, "uuid": "0a25d3e4-45ee-4e22-b35c-d18e103c2ea6", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125263, "uuid": "68703329-bd58-486d-883a-c1d284136522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125263, "uuid": "ac669341-42bc-47a2-98cd-48203c910241", "value": "458a8d39376d0388a968a568410562990c19bc18d9df13290d67f6a2634dc69c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c1565a-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632138719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138719, "uuid": "3bb3b547-fed6-479e-9847-e97dd4139c4e", "comment": "Malware payload (RedLineStealer)", "value": "13bf108131801e28e572a2c9d56b899b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138719, "uuid": "ac7eb0a2-7830-4898-b128-f33f81d9aa25", "comment": "Malware payload (RedLineStealer)", "value": "464a8dad1966abc7d550ab251a2b2ca6f2ebe9e0f5cedb9c26ded4d9c9186eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138719, "uuid": "75c2cfcf-a613-4372-b5fb-27307be00657", "comment": "Malware payload (RedLineStealer)", "value": "04083c154af7d3844ccbe9a347ccf309d6f5e685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138719, "uuid": "860061ef-9052-4832-a26b-bbd3eedc238c", "comment": "Malware payload (RedLineStealer)", "value": "15f70fa030d38d39250b9dcdd974d48f1b7a4f828f8630b28ba139c54c0c7b5238d971b593a7821dc9bdcedb859bce35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138719, "uuid": "c93bac55-4356-40a2-993a-f3570dac726f", "value": "T14BD523C1F94480E2D47D82728957D292E7727C5B6D20E906728EB71B5F33253836FA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138719, "uuid": "f84fd126-6881-4acb-b9fe-07a2654f623a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138719, "uuid": "669683bb-dbb2-4957-aed0-ee7962635310", "value": "49152:mLT3gU360ynKQ/nbfBkoo4Ie4KSSvrXetVZGS93yRHp7eWXZkHHXWqi:esQ60S1fbJkh4Ie4K14uzHpDZWHXWqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138719, "uuid": "6e0360d5-9b93-4d13-96f6-50224e7b9aa0", "value": 2803200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138719, "uuid": "aa31edea-2e5d-4a47-9f9c-b6b5646f5a42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138719, "uuid": "c5becfce-11ad-4e72-addc-e0d8bfd21478", "value": "SecuriteInfo.com.Variant.Razy.930840.21115.7665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b340d7c-1a07-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632137863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137863, "uuid": "2685acd9-733a-4f8c-9650-8a17130f5015", "comment": "Malware payload", "value": "3be95a8935184b54bed0b7e82c3abdc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137863, "uuid": "c41b6ade-0ce2-4784-968c-fe2fa7895a46", "comment": "Malware payload", "value": "475f82ff7689408b2a97a3daaa75585a3b783d4e64aec531060cd604f91385d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137863, "uuid": "84d372ad-ee61-4fdb-a7be-93bb18c9bddc", "comment": "Malware payload", "value": "4e0e7a6a6b4251bcc25d1f99cfd9967e6056d3f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137863, "uuid": "aed00e5e-2f02-4276-8986-7dbe54a11168", "comment": "Malware payload", "value": "df8a3818e0a3f30e11195f232a3e9b0df0c98544d0a037c5f57d9fb1fa50052eab954d94b715adc282b120863b85db58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137863, "uuid": "2b2922de-bccd-4dd3-9361-e259a211cb62", "value": "T1F2D3C7337214A379E3D96F30F4603ECB36699638195C7748B059B2DEBE2978C59F02A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137863, "uuid": "7bd9d469-913c-4d92-bc05-b05fbdfdd860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137863, "uuid": "2e72685f-d0f9-4d4b-b8f0-41bf1b641827", "value": "1536:5Ba2Ov4RBFpUaaaXIpG8lZps4h9VbMJFtNEXN0zv0wRoEA2TmQRDSTlM9wM:5BBOqU7SwG8BMskSlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137863, "uuid": "30a3e981-7f39-4d4f-8aa5-aaf4f12a60cf", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137863, "uuid": "995463ca-97ba-40c5-bd45-e6eb27531f29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137863, "uuid": "60be3669-c956-4f09-ad52-5d294729e93f", "value": "3be95a8935184b54bed0b7e82c3abdc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2235c1c1-1a10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632141713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141713, "uuid": "59d2898a-cd7e-4d72-b1d6-bf6fe4d8429a", "comment": "Malware payload (Formbook)", "value": "ab027769d5b6bcb8f2cdb9cdf41c1204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141713, "uuid": "55f48a53-ccb1-4a6b-874a-92a8d1065bdb", "comment": "Malware payload (Formbook)", "value": "4768bc4db58542167ce61a3e0a78bfaa79a3b7dee0b54a587886545ed83a13f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141713, "uuid": "adebd8a2-c8a4-4555-a33b-53f93c79727b", "comment": "Malware payload (Formbook)", "value": "b25bc17d36296301533ee8716b4649849d7c56cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141713, "uuid": "d8bf2b14-9531-4153-96f4-88b89f0eaccf", "comment": "Malware payload (Formbook)", "value": "bcb13e34d421b3300fba958240229ef16142a2fb07371b0cce6d3618e5aef702482756b1d5f561f24deacc7bb6509852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141713, "uuid": "ea6131ec-f88a-46d2-be78-09628af5d6ab", "value": "T18DE44B97B6E1587BE1599A790D0F2368F8253C101E1C1C03DAD47E7C5BB9E827E1622F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141713, "uuid": "1be0b1b0-fb74-4d44-9d55-fc06cdfa1202", "value": "84d5173d5d26cfc4667a04380d7e0b47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141713, "uuid": "cd211c4c-d8cb-438d-9060-6f3011d39122", "value": "12288:TSwAOcXhqsThT3P5HxB48dDyfP2PemkWgDeC:TSJfLThT/VpyX2PeIgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632141713, "uuid": "924a73e6-067e-457d-849d-b2640d6da585", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632141713, "uuid": "f79a88f5-acce-4fc1-b78b-5a53fe5bd5bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141713, "uuid": "f025c0e8-d124-4367-8b2d-db5fce7e4f6e", "value": "Yeni Satinalma Sifarisi.09872627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b78ca2-19f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632130264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130264, "uuid": "90211b90-48c4-4eb8-ac67-2da4d82c93e5", "comment": "Malware payload (RaccoonStealer)", "value": "cf978064b4209388a67a9fc8d8304559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130264, "uuid": "619360ab-298e-4fcb-9f4c-9a734b1b7c24", "comment": "Malware payload (RaccoonStealer)", "value": "487f7c670fd41c29794ecf4577efba0790553a1b4895f85a54ac42d2e1f546bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130264, "uuid": "c47713ea-4472-44c0-82c5-f82a321f7922", "comment": "Malware payload (RaccoonStealer)", "value": "31b74b3f4bb510736d4756a45f7a098c47552e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130264, "uuid": "22f8b404-c17e-454d-b221-b6e4f3f5d84a", "comment": "Malware payload (RaccoonStealer)", "value": "caf77becba2510e4071c0650afa8f848eaad161b36ea44cab3d1fe04379a72ab60f2dcecd7f698d04c0bd7828e135b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130264, "uuid": "49ddfb5d-33eb-4906-b2e6-1f3a207695b9", "value": "T1FAB4E02076E0C036F5B712F849BA93A8A53D7EB16B7491CF52E616EE16347E49D30383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130264, "uuid": "80dcb2bc-bce9-4582-9ee9-9301d5156654", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130264, "uuid": "9ce49cce-2e7b-4cec-b31c-da49df1df53b", "value": "12288:CZ+DutwUJzff0eXhw7WwJEMlHEX3/BORdizS9sddL:C4DutQe27zeMlHewRdh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130264, "uuid": "4e047436-8757-4690-801c-06e55593e2e4", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130264, "uuid": "395f1c17-b40d-442d-aeb2-77317b9cd3d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130264, "uuid": "7f3ff388-7601-42d4-a62c-fe3c5cfd5186", "value": "cf978064b4209388a67a9fc8d8304559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a49e2c0-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632138774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138774, "uuid": "263ce1b3-17d5-4100-968a-0e1fc14c4378", "comment": "Malware payload (GuLoader)", "value": "aa2f0c0a34b5317859f53b001619a4e7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138774, "uuid": "e62136d3-a4aa-4101-b49f-30c826b5ea16", "comment": "Malware payload (GuLoader)", "value": "488ae9e93969b55454d26e3fd2100d9126fabe8ae04178b51b9d53b60ebd4034", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138774, "uuid": "2d2ed5e8-3736-44bf-95eb-6753f2020838", "comment": "Malware payload (GuLoader)", "value": "2333504cf0f39a3163ccd51b6695656c186d5d00", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138774, "uuid": "7ab59bb5-f644-4861-932a-b5d95434cad8", "comment": "Malware payload (GuLoader)", "value": "ce39367f1b6c1171643eaab7c31089a3758b4ffd195188507c91345458c4ce6a0755f2d4bdda1d52bf2357b02dab29c4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138774, "uuid": "df596f0c-93e1-45c0-8f98-4d9b191afcf4", "value": "T11AD4F16E7C8886F2F5C96575806FF0AA019F8F1967E1B0129AB739C479773D029209CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138774, "uuid": "09a37ed7-ef9c-49b9-b198-6b66f1608f9b", "value": "12288:Myo2DTy8YQ9+IZgPG1yQGd2ZPI0igAClkIw9ClUNSuGbCe5c/1/JA4IkPw/TM+j1:MX2D5cIWPGWMITgAClk19Cioule5cd/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138774, "uuid": "504b7f35-2cbd-4afc-b1e6-6eaa1be2e564", "value": 604728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138774, "uuid": "d15d07b7-c1ad-4892-be21-fe46da334f8a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138774, "uuid": "dfa9710a-5042-4c1a-a35a-c80f613c8195", "value": "ITEM LIST RFQ 72BY002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df63dfa-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125519, "uuid": "41791288-a0d8-4f31-b83d-cd557ff1d206", "comment": "Malware payload (Dridex)", "value": "e1c532ae36bff77ce1027f266d4636cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125519, "uuid": "1c5b8192-f9e6-439b-88bf-183755d4e508", "comment": "Malware payload (Dridex)", "value": "48dff2f54bd280657b744a8396f707a4f0c91123fb7530c3776a9bec3316a9e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125519, "uuid": "c6a47833-0e64-4426-86c9-4f85a38a380c", "comment": "Malware payload (Dridex)", "value": "1fbbc9a4c3b495cc92ec881f0e2f597077635289", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125519, "uuid": "8a92ca10-a8a5-4c71-88b0-2737f5bf6647", "comment": "Malware payload (Dridex)", "value": "ca08b75f2886cb04ce07c425a1cef3e1fe09cd4d1674370bbe07750e52a1b78c0f51834c062dfd111922a67cf42cd44e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125519, "uuid": "dac81cd5-d847-434e-af07-b211c02edef7", "value": "T17095D020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125519, "uuid": "7601e73a-eb4e-4770-8648-ec389eb27f9d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125519, "uuid": "065025ff-1abe-4d84-9dc4-f40f9ba27972", "value": "12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125519, "uuid": "fb7481c8-5ec5-4360-bfea-cc1dab660b1f", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125519, "uuid": "2122202e-c067-4192-adb0-dde625c470e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125519, "uuid": "d83a087a-a035-491b-a06a-43f114e5147d", "value": "48dff2f54bd280657b744a8396f707a4f0c91123fb7530c3776a9bec3316a9e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e8eee6-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125612, "uuid": "0ad3f8af-ab3e-4970-a55c-c966b27608b7", "comment": "Malware payload (Dridex)", "value": "0001be02fbe03a06df73dffdea0dab74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125612, "uuid": "b9acb33d-ef3c-4ecb-9a41-6dd9433a22e4", "comment": "Malware payload (Dridex)", "value": "48e180e9da5d22e09b4b63a2302b2b364db052a3871a108622cc8b34df731ab3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125612, "uuid": "3ce36aac-e1dc-4f08-bd77-7b211e112e53", "comment": "Malware payload (Dridex)", "value": "b1f9940dd7514d90a84b454e9ecf0ff346883090", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125612, "uuid": "5e8096cb-5b21-4922-8f06-e16c7ab8f314", "comment": "Malware payload (Dridex)", "value": "698b404a780a01591d43e10d2172db8f3eb03546feba9928d8c6b3621a9cfbb261e66e562117c393fc038e633f2ad260", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125612, "uuid": "802dd1ab-563b-48ff-9449-92dde89d560b", "value": "T18195E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125612, "uuid": "61c37f10-1888-4df5-a75c-3ad1335ca524", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125612, "uuid": "b82de6c9-8974-488f-b196-ef23d2309d4a", "value": "12288:hVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ19:QfP7fWsK5z9A+WGAW+V5SB6Ct4bnb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125612, "uuid": "d0a0d76f-c96d-4e90-bac2-7bc1f489dab0", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125612, "uuid": "a45bf73c-92c3-4a2a-bcc9-105a8819c719", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125612, "uuid": "939e065b-2de7-4fbd-b768-e915cc8ec695", "value": "48e180e9da5d22e09b4b63a2302b2b364db052a3871a108622cc8b34df731ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6125a7-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125253, "uuid": "d8c45f73-1c7b-4f69-af68-203ed6c82606", "comment": "Malware payload (Dridex)", "value": "f7cbc9e2fbdedaf0d22d0a3d922e1b65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125253, "uuid": "212e6a02-ed1a-4309-b9a8-5c4d9251761d", "comment": "Malware payload (Dridex)", "value": "4991c3d9a9d641ad8f173fdbddd156c111a759e20477f1a5402e7f6f18f32086", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125253, "uuid": "37277962-cd2c-4d0e-9c91-560b4acb452f", "comment": "Malware payload (Dridex)", "value": "e2ed07a314fce167c3ce46dbc2b00baa81cb68b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125253, "uuid": "d2cbd57b-bccf-4924-8049-5c2d1601862d", "comment": "Malware payload (Dridex)", "value": "90cc65ca5f3e54945344e8879a165be8e83ab5e4081c40aac6cc78bcf5f401cc9adc1bd354ff316fc6d82a430453bd19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125253, "uuid": "b5e1ef62-995b-4798-b7a8-6c509620fcef", "value": "T160A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125253, "uuid": "410aaf26-11ef-487d-92c8-2c3ec58f95fc", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125253, "uuid": "62385b7c-4c9c-438b-a515-ea93cca35ab5", "value": "12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125253, "uuid": "9559889e-aebc-4bb0-8823-74f923c579a0", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125253, "uuid": "257dd1ec-da45-48b1-a423-86940f0b0d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125253, "uuid": "afb9430a-54b0-4ca1-b1cb-548307566e25", "value": "4991c3d9a9d641ad8f173fdbddd156c111a759e20477f1a5402e7f6f18f32086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645e582b-1a07-11ec-8fa1-42010a9c0011", "comment": "Malware payload (XpertRAT)", "timestamp": 1632137959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137959, "uuid": "db9853c8-0de2-4a6b-a0f8-2eb2e0503ade", "comment": "Malware payload (XpertRAT)", "value": "09c275af1fe403ef1955cf691179cb33", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137959, "uuid": "2e59cfb3-5608-44d8-8637-e3fd8d0a8dd5", "comment": "Malware payload (XpertRAT)", "value": "4a67cc05b5f45a774fafb1da0a0e8ac0f3839a0b520c0b2346bbeeace304aa77", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137959, "uuid": "a5eac801-c49d-4148-969e-86220e2784fb", "comment": "Malware payload (XpertRAT)", "value": "49b1427effc50d6949c45e22fecbbfba4b2380c5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137959, "uuid": "89eb2133-28e1-46c8-9a34-c42162b2a629", "comment": "Malware payload (XpertRAT)", "value": "61823d3c172c819452e391370f17f31075a7f746a3e0dd3c300779c10d0fea862529dfc35580bbf00b8321a4cc9cd6a8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137959, "uuid": "2b3798b7-1017-44f5-a989-c715dbbdc477", "value": "T11E340DE4688F44B2E6488C5DA494B148AD74FEE334CA887553AFD435DF59BF2AEC4083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137959, "uuid": "8adb8bd8-0916-4d9c-bd60-06985246efbe", "value": "1536:iLFHYWB6IWEp6aSJIOA0RoBNJTloJRR0ss2wdzFz76mAg5eeVhMDw5wfL7:iLOWgv6ss/dzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137959, "uuid": "d847bec2-2173-47b6-a55a-463511fbc773", "value": 247316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137959, "uuid": "44a5fd9e-561b-409c-b35f-7f5cac7e4ed7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137959, "uuid": "21b1b4ac-ff8b-4a5e-a461-253e77a621e4", "value": "IMG_Order PO 094765 SMH.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792d4707-1a6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632180943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632180943, "uuid": "f0b60dd9-a173-4e40-939b-bacbe699b1ed", "comment": "Malware payload", "value": "8dd2a8605148e4e6af1781a9de0d51eb", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632180943, "uuid": "3f86b3f5-7332-4df0-ab39-23b1ff2d21f9", "comment": "Malware payload", "value": "4a9e84a374276202ce4468813331c296e150ad568b3cd20b4d6f71be62d8518b", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632180943, "uuid": "763440f0-438e-4d1e-9c22-e7eb5bf99e58", "comment": "Malware payload", "value": "dbe09e8abbcee0e909a0c44fd494e9952231a1d5", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632180943, "uuid": "fe04a595-337a-4982-90e3-e47fad4db0be", "comment": "Malware payload", "value": "b3aceafef39693e0876f3cf261a59f209fbfea1d159e3765a0be21edd6f43ab3394b782083fb1efe5cd9bd0a16fc0aef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632180943, "uuid": "8bf2bf70-6827-4043-b515-4896562c6ba8", "value": "T13BD3F128D5839CACE45F478E232BB1524AEEF2D6F1CC65523E6D0B868381F55F9236C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632180943, "uuid": "aeb96b40-57eb-41e7-a71d-d57231e52d44", "value": "3072:QUmncQ5BmykRH+osqYMRwH6HhHN9/RQv2TVvFXMk7x3zvW+HdgbEJ:Q/cY05HdS6HzRlW+Hubi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632180943, "uuid": "b12692fb-8ce3-43c0-9573-7c9265959d89", "value": 137716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632180943, "uuid": "18128235-53b3-4a07-bee8-d67e14b9f489", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632180943, "uuid": "6a5f7e6c-3dcf-4aa0-8109-29d08eed5aa1", "value": "reader.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d210f568-1a68-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632179804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179804, "uuid": "c2c6ada2-e97a-48a8-b54c-e71004354148", "comment": "Malware payload", "value": "9469e16b9015a3fa3c0cc1636b8df1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179804, "uuid": "6b90b46c-b8d9-4d3a-a7f4-22d36abb68ec", "comment": "Malware payload", "value": "4acca481a4185e2ac07d527cc4062fb20c4622deaf1f58675214bf4dba910eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179804, "uuid": "3151a04c-321b-4791-b272-9bb6225e1dc5", "comment": "Malware payload", "value": "fb0c180d116dafc964c0cb85618a5cb925c0e4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179804, "uuid": "777e0ea5-ac3e-4c30-b666-f3f9334050a6", "comment": "Malware payload", "value": "0b767041eb1b491dd7eaaf1c58c914ee0a4118995f9ec6c61713321287a840eb59fbcdf846ccb5f3e67489c35ebf0646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179804, "uuid": "f3ecd3ac-b921-452d-8b73-d6aa985d8539", "value": "T1A1E46D93A190263FC8933AB9CC2F356A1C0EED103A5B982166F5390C5F75352FE2DA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179804, "uuid": "1e97d03a-74fa-4378-81a1-f3637afe047e", "value": "830382fd5b7a73f0620211f8c0ad9dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179804, "uuid": "ab746106-5fcd-43a4-b318-5def8aa2d76a", "value": "12288:w9uZ2lK3ox6/ktmA1ZzgirJFarCvozH9ZgE5eDW:sMxox6/ktmA1hgMsrHH9ZgKeDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632179804, "uuid": "2142b475-164d-42bd-b1fb-1366798de67f", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632179804, "uuid": "5f27a232-cd0b-4c39-8e8c-f6b2bcd602d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179804, "uuid": "cad23c96-33b3-4323-9fc7-9506c69fcc11", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88fecd5-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632145509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145509, "uuid": "06ad2213-e526-4c3a-b26a-48d1d5eac447", "comment": "Malware payload", "value": "e631bba238e6256f64c19bed91730f6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145509, "uuid": "efe52206-c96c-4cbb-a299-6052718b3c1a", "comment": "Malware payload", "value": "4b4668ac1fe136d0dddde33e0684548dfa473d9da7c473d8e045158c5aaa4362", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145509, "uuid": "5661bdfd-7b25-45b9-9ca5-5204100fbc86", "comment": "Malware payload", "value": "8d42e59f19cf7d5c7fbf51450410520caf1db907", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145509, "uuid": "5366e50b-b817-4fc8-97ef-56eb819ba552", "comment": "Malware payload", "value": "9162ad8c6e8a78fb09feabb8c46540deea28c9738252901b49f96174e215bcaa936f14acc96253783e3249a58274b5dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145509, "uuid": "edfc9199-b154-4066-a64e-37e7da0f544f", "value": "T10004CF845DC02A718A975B08703E874E977C05CAB1BD27D7BC7EB943DFA31264C06DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145509, "uuid": "1f0a07b0-15cd-436c-96fc-4e35ab2c3283", "value": "3072:YGx2tANtBEWpekQvrbt17DJxKTkGRq9N8px5pb/FmHQBV8LAswQFBAku:YU2WNjEWpnQbt1xIzRq9KpxPgHQMlpHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145509, "uuid": "679ed9fc-bf54-4005-aa63-697b23338b5b", "value": 190244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145509, "uuid": "2a36208d-d666-4c2d-bfa3-11a0c31c1439", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145509, "uuid": "c10c6034-7a88-48a6-a69a-2894e995190c", "value": "Quotation Sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b8037e-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632151868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151868, "uuid": "593db254-be7b-41dc-a801-77de97f9e069", "comment": "Malware payload (Formbook)", "value": "37eddb099a44d161a75f507a01d5b0bf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151868, "uuid": "4107b1e5-4080-4ac1-9491-486120d3e7d1", "comment": "Malware payload (Formbook)", "value": "4b9b02536d3146b6692e1eb631466f5142217d306d478ae91e94fd089244714d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151868, "uuid": "fd664961-78b6-4651-bd08-b37b30ac9f09", "comment": "Malware payload (Formbook)", "value": "69ee622a1176fd357b8ec42f92120e30ab1e5e2a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151868, "uuid": "728c4c99-ae1e-41c0-9711-5448a99dcf68", "comment": "Malware payload (Formbook)", "value": "cf04532be828fbb4f97b3c3eeb50e0f89989a339c7317b080555c8fcfce34202a123527791afca62e7ff06c0f7206d97", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151868, "uuid": "4f20bdf4-eb88-44db-98eb-d832300693b8", "value": "T17DD4E192EDFCE70BEE2E42FB52295ECE81219E882114E62D2610B6D35B7C571C74C4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151868, "uuid": "563337a0-1efc-4437-b5bc-b5b968aeb478", "value": "12288:s5EWoCEZyx60mOqfMH45eIvUUf3JTOIdd3a4yUAkW8:s5EWoDq9bAQjssIm7kW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151868, "uuid": "b3336a17-9f32-4e0c-8875-91ecb8dbdc23", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151868, "uuid": "2300de0e-dabd-4dd6-9145-624da4905f07", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151868, "uuid": "c01089ec-184d-40e4-9f5c-1d3adb1193cb", "value": "Shipment_Documents_Details-0l8x3.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac284f2-1a39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632159310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "d2aabb4d-4b42-4adb-8558-82638628cda5", "comment": "Malware payload (Mirai)", "value": "a418b422472e552163df2d568ca64280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "62c87adf-6055-41fb-8921-cae2459b2d36", "comment": "Malware payload (Mirai)", "value": "4bc4e606ef3a129a743b47d25e684e4f7af5fe6d606c34e11efd6ec3946ffb4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "df7daf23-d745-4675-95ec-baa6ad8c9cb2", "comment": "Malware payload (Mirai)", "value": "3a9b9fb4ab868e6967d8df63278a70b2413f71b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "b9bd6a98-5ba9-4cd9-a255-374c4800b751", "comment": "Malware payload (Mirai)", "value": "27ed0a1f21ae799ae56bfcd570c0e1ba86568b35b1cb06a8c93c0597a5c666dfd01197060646639c4f5e649f180b1e8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "923f8d5e-d65f-47e4-a67e-125136fefd82", "value": "T1DD430229BD0B7E85D1F15DFAE43EC392E4565E74A2D6E8C6A70D0B082FD481A3CB4097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "80caece3-b2f7-4e74-8a26-b9c066d37e95", "value": "1536:KzuDOfXKGz9MfERahqL1qRaeDwfHTn37dK36/MXQ:KCOfKGzlcqL1iaeDsTn3wKEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159310, "uuid": "c81d0ba4-e847-4ed9-bd94-8eac26c16555", "value": 58328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159310, "uuid": "5b65742d-b71d-4e73-9eea-f31d031f1b56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "a2362899-6cda-48ba-874f-a0b9b56031fe", "value": "a418b422472e552163df2d568ca64280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9175cf-1a63-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632177404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177404, "uuid": "6b1f3f44-79ac-44f9-8127-a2b25451ca76", "comment": "Malware payload", "value": "6624b03b2421f2813c463b22b48b9574", "object_relation": "md5", "Tag": [ { "name": "cve-2010-2883", "colour": "#19A8D1", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177404, "uuid": "2cf9b441-f610-48e5-a741-844685a8e74c", "comment": "Malware payload", "value": "4c46e8f35ee5663cff59edcf6d5b9f51f491baf37079d33f8a24417c85a5cd9d", "object_relation": "sha256", "Tag": [ { "name": "cve-2010-2883", "colour": "#19A8D1", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177404, "uuid": "d6ab2626-d420-4c8e-817c-42625831024d", "comment": "Malware payload", "value": "45394765f8da676b8bd89d589ccd641b9c32da1e", "object_relation": "sha1", "Tag": [ { "name": "cve-2010-2883", "colour": "#19A8D1", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177404, "uuid": "941262b9-814e-4b91-a832-79a173f87316", "comment": "Malware payload", "value": "dc56db1311955945fb801f083ea58541a278c0f4e5d441181edeee68137567ec60f0c7352aecde8e5c0649b08bfcd071", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2010-2883", "colour": "#19A8D1", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177404, "uuid": "1caf8942-3cb7-471b-b50b-2f3a93c2a440", "value": "T140150240050EFD42577A353F0081EC94EE1E6F1C898939AB5DABD1D4B6CCA9BA5C239F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177404, "uuid": "b298a28e-321a-456b-86f7-26eaf7378f2c", "value": "24576:LPjLTfO2+qyvaoJsiiBd6g0V9aAri16SgZ1xmmS:LPjH+qgRsiiBYvV9aQi16PZTmmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632177404, "uuid": "5a96637e-50c2-46e5-aece-fc07410bbe06", "value": 925291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632177404, "uuid": "de32f663-572a-44e9-ae84-f34c043ce69a", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177404, "uuid": "bc8831fa-c54f-49b5-b4e2-dc7bf01fef23", "value": "4c46e8f35ee5663cff59edcf6d5b9f51f491baf37079d33f8a24417c85a5cd9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f636c8eb-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632143787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143787, "uuid": "0c082c1b-5e34-4ed1-8027-d9afd309b497", "comment": "Malware payload (AgentTesla)", "value": "3958da11bf966f69b5bcaa1dee2d22bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143787, "uuid": "a87bc68a-31e5-497c-a229-48ea7ef2c67c", "comment": "Malware payload (AgentTesla)", "value": "4c5b527763b02858d21d030e497e197e6976b9a2c1bb8ac33cd45caee40e7b69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143787, "uuid": "6bef588a-66d0-4a93-a185-de275d691984", "comment": "Malware payload (AgentTesla)", "value": "1a89c2b20193fd7597c30046edba3836ccb224fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143787, "uuid": "5adbb4ec-e19b-4e65-9b98-7d272d51bb4c", "comment": "Malware payload (AgentTesla)", "value": "95228dce0aa1ed8a46ee102918380ac386bd70bb25c65b6229429230929f684db565b8e038e8af78be263cb58bb7287a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143787, "uuid": "0a324191-e647-43ab-8653-1c486989a123", "value": "T1F205AEC17D47D89BF4DF2AB3986FC12011656E9D9161C73D2682BA2B55F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143787, "uuid": "0f6615ef-4a84-40b4-807e-490b095aca0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143787, "uuid": "45aded41-7578-4ece-9d0d-a0970ea2904d", "value": "12288:u5MTdYH4jsmtiK5oyZidEJfwzlfp7+AYc+zUNc5h0GAKLOcEL9qHqut:c9+Fo9dEBw5d+AYc+zUNgSGAKsLULt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143787, "uuid": "fe04ddfe-be6a-4a58-af9d-ee29b41a2b8f", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143787, "uuid": "fb2997ba-2df2-4749-b348-832ed8dea25f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143787, "uuid": "a3b31b66-c814-4783-b0de-924e9772ec38", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ab7245-19a8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632097025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097025, "uuid": "e4dd80c8-98e8-4485-8aa8-163142535b7e", "comment": "Malware payload (RemcosRAT)", "value": "8b7fed1914705666e4826519ebf2ebe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097025, "uuid": "81afde67-81c9-4f6a-8cef-0d7d75789c7e", "comment": "Malware payload (RemcosRAT)", "value": "4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097025, "uuid": "697e7566-8022-434b-9ad8-d62b44248475", "comment": "Malware payload (RemcosRAT)", "value": "7916166229867d620b4b07a359d0bf92e6574b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097025, "uuid": "2d7fb92f-a09d-4682-8eb2-9d0b78deb6c3", "comment": "Malware payload (RemcosRAT)", "value": "4bc590cd2274f3e9ed28ca5809a36b23858ade3c14c3d2f1be04fe22b4907138dd23261081702fb3e4759e6395c99149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097025, "uuid": "b6109f61-71f2-4723-affc-f899ff3eec17", "value": "T1AC754F254D6696F7D3EFC32CD05C0B8EDBF5A483BB919F0E988186C2066770BE98854D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097025, "uuid": "a668f8f4-cc2a-46a2-b0de-04b16e2e2f3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097025, "uuid": "521ded19-0bbf-405f-841d-e5d100e5057f", "value": "12288:cHgaU3wDVCEBaCZHx/U0rHLLWdYUDShFYRb9iZUXpmw/Y0IjtI8bfGPxVine3sUM:J4CCHx/U0fiaAShCVcKXp3Yjt1cxVoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632097025, "uuid": "227857fb-79d8-475f-8bdb-f1c171b870e6", "value": 1672704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632097025, "uuid": "30f4f9e6-0db2-460e-98db-474e34f0ac02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097025, "uuid": "4a8aa57a-e67b-43a4-9158-f2166acfb740", "value": "AW QUOTE 6677 HQ1-Scan-068703_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de5ff39-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632121547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121547, "uuid": "edc1bd95-1b44-4f0c-8b80-cb552156ac14", "comment": "Malware payload (RemcosRAT)", "value": "911ff402bd84cf853438795af8acbdc1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121547, "uuid": "e27a9466-f108-41b7-8352-527c0ed552a5", "comment": "Malware payload (RemcosRAT)", "value": "4ce4fd04bd63cd1196883abe8d581b987fc10a52215515d6f040128a523324aa", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121547, "uuid": "b405b254-15f7-4ccf-89a4-8ad7e9ce078b", "comment": "Malware payload (RemcosRAT)", "value": "4b8f38d548f68e54e6e7b414714fa654d069406c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121547, "uuid": "2cd0ebe7-7578-45ed-8845-af1bd91f3f18", "comment": "Malware payload (RemcosRAT)", "value": "223d3671ec70edbfc4594836477592a20b79dad13fe43411abc21bfb87529b13660ed4f10054919f93f8567d8358862f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121547, "uuid": "dbbe5c94-72d7-48ac-ad38-c3d17b89a386", "value": "T1FE052378AC4E5A87272E4CE63B528EBAC4B481698F190C725FD32EF71477221B1B705D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121547, "uuid": "06af564b-b776-40a8-b987-c6e8129f02fc", "value": "24576:6ZD9Y+PXJgDrBqc37Di1SAQY34Ie4aj2HXnGX:mDFuDrBx3USDY1e7GXnGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121547, "uuid": "3a85d596-a69d-4c5c-bfe8-8d589c9e895c", "value": 798350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121547, "uuid": "ca2262a5-3473-48aa-bcf9-be5c241419e5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121547, "uuid": "0c7f1ec1-f7a0-4d52-acfe-5e8c06b2e372", "value": "AW QUOTE 6677 HQ1-Scan-068703_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f95573f-1a23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632149896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149896, "uuid": "6bb8196e-fd6f-4552-8cb2-e90ef02c45eb", "comment": "Malware payload (SilentBuilder)", "value": "8cd25260763711aec2372ed827ea6e84", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149896, "uuid": "f5a3dcf3-5b55-42ef-8c37-639cea932678", "comment": "Malware payload (SilentBuilder)", "value": "4dec7e1492495740ed14d697dd112b6afdd80b4a38fe2adbca391299568cbf14", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149896, "uuid": "ffdd54ab-1cff-437e-8a88-808cb430d75b", "comment": "Malware payload (SilentBuilder)", "value": "4d115388323a5aeb69082b8da063d83322b855cf", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149896, "uuid": "466e5ad3-7fa4-494d-9adf-587eec50b191", "comment": "Malware payload (SilentBuilder)", "value": "8dc70ade821277af233b6e6ad31e44f921f7b5564ddac709f1ee028169c022b89c84cac04c555066c273ce413d73fd45", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149896, "uuid": "a342ecc8-4718-474a-8263-a81c02630158", "value": "T17844D02636A5A41DEC2D2B76A8BB53D02337FC504FD38BC77AA772263F726914D22405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149896, "uuid": "c2e92ef6-d377-48a7-ac13-75a7020451d2", "value": "6144:mKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+knfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmw:kj7CqScwoRZ9bSXkh/nLKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149896, "uuid": "a2b26ed9-efbf-4a51-849e-12eb31333291", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149896, "uuid": "c8aad1ad-8eec-46e4-839d-d8db900ecd37", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149896, "uuid": "90776942-2555-4f0a-bd4f-625a3997d94b", "value": "waffle.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ab9b62-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632121346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121346, "uuid": "c062540c-b64a-4876-918f-57ea415b6872", "comment": "Malware payload (RedLineStealer)", "value": "bef2c89ebb4ecc31325d503a2a8259d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121346, "uuid": "9a38082b-933b-4a11-bd63-487edc0f6cf0", "comment": "Malware payload (RedLineStealer)", "value": "4dfb0e513ed4fd3b3ffda6bd3e6dbf5ef1e903356bb3313dd6730a2e6446b7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121346, "uuid": "f70ba588-2fe3-4a3c-a94f-dee172e974f9", "comment": "Malware payload (RedLineStealer)", "value": "e08b313833703ac980edcb2b89680d19e3525e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121346, "uuid": "f0332725-274d-49c5-bfe9-be8df1130016", "comment": "Malware payload (RedLineStealer)", "value": "310d6ae4d8ce1c299aa8f1d9a7ebe900dcf7371ae757a657e937f9ffa4e7db9728dd3ab9ebc9ee8021753e2ca6795a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121346, "uuid": "0ff4093f-c5df-4eb6-b0a8-7698c7e58613", "value": "T184F5D7B0370FB2BFCE0904B9DCC1A91B970462E546154A06EA9D3876F5D2FA92F873D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121346, "uuid": "d0e50996-6d23-48b9-9cc8-85a55e7d94c3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121346, "uuid": "dac1167d-0507-4194-8750-0dc2085bfa41", "value": "49152:DLDZgkz0yaQMrOO0TBNsxsfmRdDMTLoQ7y3b:nDxBMrOO0TBNSsejD0UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121346, "uuid": "b917b48b-0dc0-43fb-b92b-9a837876ea20", "value": 3369984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121346, "uuid": "ba9b1ee5-00a9-4fb1-8a51-cb90f81b9053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121346, "uuid": "b5caf39a-3b5e-4d26-894a-ed1b0496c3f5", "value": "bef2c89ebb4ecc31325d503a2a8259d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2579b2-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632153034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153034, "uuid": "01c91261-dd3c-4fc7-8431-d3f72afdd524", "comment": "Malware payload (Mirai)", "value": "6f9a757f2b9c410202aecc1d2f4e88a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153034, "uuid": "9ab16b8d-c8cd-4514-92e9-69d8e42890ef", "comment": "Malware payload (Mirai)", "value": "4f4d11b17acac34221c33a84b0506cf627419fb72d3aaa7a4d8964995e5172a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153034, "uuid": "d2df1b26-10eb-42f8-93c3-971646419ce4", "comment": "Malware payload (Mirai)", "value": "1fc36287e0c65c6699732adfe040186431269b3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153034, "uuid": "8defd60b-7be5-4f17-b2d8-ee9b9d48dc23", "comment": "Malware payload (Mirai)", "value": "a16f5e9b51d2d1c08ae9fbc91020dc6482d3b77ef50370f4cf716230d00257bd91327f5dddd0877fc9345b6cbbf66a85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153034, "uuid": "a63f0b6e-7f1d-41a6-833f-b8c249e9e00b", "value": "T135F2E1D5EC97B840CD9C6CF521EE4BC02E65E0462AAEA3CC23F64897B51D84BF58C275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153034, "uuid": "6b269b92-d56c-4f7f-bcac-e0693808811b", "value": "768:rLoRG4GLlAnZ3WWVj+grpEJNgGWmY7LXiUFe673YWW+:roAan5Cr3gGJYHI+3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153034, "uuid": "fff378ad-5574-45f3-8db6-17bf6b401716", "value": 37324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153034, "uuid": "97886f21-f583-4cc0-b926-d51e9cb77753", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153034, "uuid": "d005d520-edda-422e-b45b-15fb094b1d5a", "value": "6f9a757f2b9c410202aecc1d2f4e88a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd555eb-1a4e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632168575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168575, "uuid": "b7c3f8b5-17af-4662-911f-217d291e3986", "comment": "Malware payload", "value": "acd1b8d6eda520b0dc3500b806167a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168575, "uuid": "f61addfe-887d-4f6a-8951-9d46f8391644", "comment": "Malware payload", "value": "4fcdae562d7a9bba5bd8997e152ffb33211a2e42c322adfd24b68cf448e5272c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168575, "uuid": "4e9c61f7-065e-4b10-8da5-b8db1ec120a5", "comment": "Malware payload", "value": "41ba000a04604ab4f503d35e9a1fea4af2bb9b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168575, "uuid": "bdbedac4-b60e-4c09-a529-c1cc817b56bd", "comment": "Malware payload", "value": "5d03f3c1583f2013154135d49ffe4f2c2c832c84e370b7ab24f5e938d7d12e46ca04536ed599143613f4f98f6a8ea7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168575, "uuid": "25f60418-8a2c-42f4-8702-eff827f3eed0", "value": "T13215AEC13D47D89BF0DF2AB398AFC52011696D8D9161C73D2682BB2B55F3352306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168575, "uuid": "55ad6b15-42ec-467c-b0c5-ad7355ee2577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168575, "uuid": "5c6a2af3-7566-4056-83d2-0f29bb8ffa0f", "value": "12288:i6smtiK5oUZHqpoYSXaNEzCz0z0Z7CLwf6gRqippp8PqaSzqGQK:Q+FozEwFQzU+TqpcPq+ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632168575, "uuid": "4eddd146-69ce-4aea-8ade-fb95c53237ed", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632168575, "uuid": "81247576-2440-4c62-acfe-1a5676f55559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168575, "uuid": "1fe2de1a-c3e9-4920-bd44-d6ad27b3fe64", "value": "Shipping Documents ZIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84970e2e-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632153045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153045, "uuid": "85319d04-174e-47df-a13d-3fdda0baaa90", "comment": "Malware payload (Mirai)", "value": "4041773b476ad1324d36c7988d87e1cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153045, "uuid": "32e03829-3945-469b-9de7-da60a562bf60", "comment": "Malware payload (Mirai)", "value": "50128796b9e6a4629bc7093101c8054cd593309742194c39c748802f023e493d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153045, "uuid": "8679dca4-faee-4859-a185-9ef3ee50bf27", "comment": "Malware payload (Mirai)", "value": "913a164b6d04127c378e0b27a5985aa4dda12b84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153045, "uuid": "5adf9651-75e6-48c8-ade7-dbfd4d701ea7", "comment": "Malware payload (Mirai)", "value": "43530f27a30e653f5e887ca94c1dedc0741d1f7f41db3c725eba178f18f9085a9f6714aef0431cb5e4ff26d017933c80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153045, "uuid": "e2aa183c-ac14-4710-9704-19515756d0fa", "value": "T16AF2F1944E11CDD1D1DEA0F9A8D103526F66AEE780217C0A4DBBBB935F67075BC52BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153045, "uuid": "f8652cfe-c664-4d6d-9cc5-44811aa4a9bd", "value": "768:Ip60JJPE4jNzzDNxQK5Xtmi40D72qbpitpH5JgGlzDpbuR1JT9:SPEGNzPNx/5svUfbwjHrVJut9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153045, "uuid": "fa19545f-16b5-43ea-a398-a712217caaad", "value": 36268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153045, "uuid": "8b2102cf-8527-409e-9a77-d1b08f39c447", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153045, "uuid": "c578932e-91d4-4805-aecd-7602aeaaf4b5", "value": "4041773b476ad1324d36c7988d87e1cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409c0f47-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125443, "uuid": "b3c6532e-3b35-493e-aab7-17773c2495f6", "comment": "Malware payload (Dridex)", "value": "01d1d814ba70cc3a31aea4a80e69a123", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125443, "uuid": "34fc3331-aab1-4935-9bb7-d6e51a120190", "comment": "Malware payload (Dridex)", "value": "506f4806b3cddf57228ea57d45f61fbc3bd514021c35e769298ea501818ccae3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125443, "uuid": "80c017f9-2479-4811-b263-c0a9b69f9976", "comment": "Malware payload (Dridex)", "value": "6738916b14520452e1c106f464491c9be4bfb8d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125443, "uuid": "3269330e-fa70-4714-97e7-53e0634f5ab9", "comment": "Malware payload (Dridex)", "value": "977e01a74be70b2a8fd8cf6599566c4e47bb0b4c70565252934b72e2d591c23947e0b3649107b31a72121d4028c1b805", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125443, "uuid": "54ae4a4c-a5d0-4567-bf1f-1197ae2144d4", "value": "T1B295D020EE69E1E6C6B89F3E9408352327F93D75110D608CD392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125443, "uuid": "3d7eb96e-5fa2-4ba4-88c2-b474cd7a4410", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125443, "uuid": "a436c5e5-9419-4913-ae15-5bd471e679bb", "value": "12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125443, "uuid": "1fd06916-0a69-44ed-8cac-d56ef84c0875", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125443, "uuid": "d7f03138-c36b-488b-82ab-eb267737c2a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125443, "uuid": "0fa974ed-89ac-42bf-ab4c-2b5787135ee9", "value": "506f4806b3cddf57228ea57d45f61fbc3bd514021c35e769298ea501818ccae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afbe9d9-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632121273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121273, "uuid": "c3cb446f-1a64-4687-b7d6-2ea33c14292e", "comment": "Malware payload", "value": "06ca129910fd79de8bdc7a319949fb25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121273, "uuid": "4fdf1da5-47c9-49d0-b462-afa664d11a79", "comment": "Malware payload", "value": "5139ad11a48646552189e064b132a68728a2b53bb93cc2c96f737fd9271852fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121273, "uuid": "c2fd6414-d363-406d-9f9d-f364e285e011", "comment": "Malware payload", "value": "efdea05145d1841958295d65823365a64733b688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121273, "uuid": "72b48290-0993-4573-8fef-27231039a775", "comment": "Malware payload", "value": "f1e86cbc0aaa47025495fcacb7e0609d0286c3921b8bca1fc54dc8cb4e3d4f2e729c46e45950741caad23141ba1bb11b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121273, "uuid": "3e4107c8-ab56-4a3d-9a70-e3572887ef7b", "value": "T1DEF37C0F63F86066E4B5937059F202C35932BD615B7886EF128E997E1E336E0B631B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121273, "uuid": "ca4f12c0-8682-465e-8abe-9b80e5c80435", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121273, "uuid": "de231d34-dcf4-4dee-a402-2ea7694593da", "value": "3072:NahKyd2n31a5GWp1icKAArDZz4N9GhbkrNEkbr3rO:NahOup0yN90QE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121273, "uuid": "7fe36c39-89ed-4281-902a-435ba6038576", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121273, "uuid": "220670e0-a831-4c04-abd7-60f944d87bc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121273, "uuid": "30095256-5fa9-42fd-91b9-f25aed4d5a51", "value": "06ca129910fd79de8bdc7a319949fb25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4b3a6d-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125549, "uuid": "240531b0-c535-4f1c-8e3c-8ede87cfe272", "comment": "Malware payload (Dridex)", "value": "ce3de3ef2e2a6a13e39daeae188007a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125549, "uuid": "4b72e208-80f9-4e79-b1ea-258e28dbe7f2", "comment": "Malware payload (Dridex)", "value": "5209f383147b114b02ca640869fbe2afef56610bbc579815cc064b24d4c41b6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125549, "uuid": "68e97a93-7d3d-4627-9628-283d5ed9b0d2", "comment": "Malware payload (Dridex)", "value": "00d2eca0a180270e90ee0dac1fa67c746b322176", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125549, "uuid": "f309b552-1417-440b-93d7-554fad286f25", "comment": "Malware payload (Dridex)", "value": "c9be91adf3b373e5429df6087684724ede8d56738bfde6dd94e4671332d307fa2c94cdad2c0244b2397fbbacd1f343e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125549, "uuid": "dbbd61c5-c484-42d6-a35f-df06a7760c85", "value": "T1F595D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125549, "uuid": "9b483282-a3f7-4bf3-b616-c31fb09859be", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125549, "uuid": "088c892a-b0c5-4672-bc4b-c0eb51f250bc", "value": "12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125549, "uuid": "fc34be68-7f15-4d5e-bda8-13d89c39e6aa", "value": 1925120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125549, "uuid": "1e238cb8-d66e-439a-82ae-4535c8d2836b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125549, "uuid": "b1bcff34-1300-49aa-b552-b3526e8b14f7", "value": "5209f383147b114b02ca640869fbe2afef56610bbc579815cc064b24d4c41b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5593d04a-1a22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632149530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149530, "uuid": "4404806f-f222-48da-be73-2ff8dcf3f98b", "comment": "Malware payload (AsyncRAT)", "value": "76bcb6e5c3da87f870a69ced48c36e8a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149530, "uuid": "f59520f6-7232-4d78-b70a-d9ed8425a280", "comment": "Malware payload (AsyncRAT)", "value": "5310ef8378e0ef3db4a7498d2c30386ba3cdc54a379ac2c10eea595acc65b4b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149530, "uuid": "c324b045-509f-4f3f-8ff4-107fb2a1f529", "comment": "Malware payload (AsyncRAT)", "value": "02201029aebd1933469561a942b1b84ed2537a29", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149530, "uuid": "157a5286-35fd-4ae2-82d5-4a07401ebed3", "comment": "Malware payload (AsyncRAT)", "value": "067823843d5c199e930081224c5ee5713b818fa6b9439d3c88ab04d02a44375eb31769ecc2320eafe8efe1fee22301fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149530, "uuid": "c23904a0-e091-4f93-ad06-1c6ba31ca58b", "value": "T117E48DC13D47D89BF4DF1AB398AFC12011656E8D9165C73D2682BA2B55F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149530, "uuid": "de3b7a63-4cea-4df5-84d2-3f4a0e995223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149530, "uuid": "e13e8a59-9040-4f3d-8b5d-b19753872e33", "value": "12288:w5MTdcn0FsmtiK5oyZ6ZQD5n+pypIIVrjLEjQeP7:SP+ForobpI0rW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149530, "uuid": "48ff7346-5f72-4095-8ad7-1fd21d7034ea", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149530, "uuid": "f0a3c3aa-fef0-48a3-b3d3-3c1200499263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149530, "uuid": "9466e601-a1f2-4955-8ed0-a26e930b514f", "value": "Fleet Manager_CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bd8363-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632160234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160234, "uuid": "b0875dbb-9409-43b4-9ef3-54368bcd9b7c", "comment": "Malware payload (AgentTesla)", "value": "bdcf69889fedcc75f128511e80d7c0cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160234, "uuid": "d8922b31-8e32-400c-9e16-8dddc1997b5c", "comment": "Malware payload (AgentTesla)", "value": "53659c72e3f0387cb08d3794648421f6697495d1ade26339972174064d60ebf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160234, "uuid": "a380ca58-a2c6-48a7-ba9f-dd4a497241b9", "comment": "Malware payload (AgentTesla)", "value": "c688fa89557520358c41154cb47d7ad2e7eb53b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160234, "uuid": "c6b4e80f-638a-41e2-abff-72b73e0c8b4a", "comment": "Malware payload (AgentTesla)", "value": "a2a4a4537a35cd9e95bac519682218c35fbf14406950696064bdbbded8dca9947503b01cea2a7fa5812f1a5d6b9a77c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160234, "uuid": "b32396af-539e-4eb8-8a6b-c5c33569e27b", "value": "T126841786EAC04184DC2E6770243E8D35961BBEFAA8B4E54E6F8D763577F31E3143214A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160234, "uuid": "e64c1432-142d-4b12-8a6d-bab5d464d747", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160234, "uuid": "829ade59-841e-4a48-8f18-82005e110aaa", "value": "6144:w8LxBu0+uhQM09s/bk7llol8xd4asyfAR/ZgWaaQ02RMNIFWj8llFS:Z+uhQM0cSfG8xe2fAQWar0oY8llFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160234, "uuid": "c6f4131e-5f91-4072-aa9d-dacae4afe827", "value": 405733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160234, "uuid": "c29581fc-e949-4fd5-83bc-e97671428da2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160234, "uuid": "20e0e622-7834-4a49-a8d1-22cc6e976e19", "value": "Nuevo pedido # 86-55113,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743c2705-1a12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632142710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142710, "uuid": "ed72a9e5-616a-4495-b5fc-3a59ef8a97ec", "comment": "Malware payload (AveMariaRAT)", "value": "db8b61c879de14d0712856f4310bb83e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warzone", "colour": "#7EE2FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142710, "uuid": "8b066338-772d-4dc1-8f4c-41ea46a10ba5", "comment": "Malware payload (AveMariaRAT)", "value": "536d2e05383047b6b1f38680c840aa099498965dfc13ceafb0ec3efaeb3b293e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warzone", "colour": "#7EE2FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142710, "uuid": "a6979767-93bd-40c4-ba37-d1fc7c67eb04", "comment": "Malware payload (AveMariaRAT)", "value": "19c5f773358c1da7cb927edb081074713e38934c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warzone", "colour": "#7EE2FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142710, "uuid": "e11c1815-d1b9-4a0a-ad09-1e9ba054b275", "comment": "Malware payload (AveMariaRAT)", "value": "a6e7a0e7bc9860010ab3a3e87ee337807d266eecf9e0791227518f9c0ee3de241ec0aed1fd589402e73390df71f28b1e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warzone", "colour": "#7EE2FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142710, "uuid": "00dad967-889b-4dd3-93ba-0d68aac7e1cd", "value": "T1EA2549F11234CA19FDA6ABFCC0D590214B3B6D31D462854D7B71AB8E2D73F82614FA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142710, "uuid": "915e4fdd-3381-4063-b094-87acf204ffd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142710, "uuid": "508c3cec-f680-408e-b95f-ed355a5a2370", "value": "12288:JBGiY6HiFur0Oef/iaxmAUPnV/nYORaBP50oA/1YCS4bmtiK5o3OyuMtntGGzGtF:JA6CFuYO2IAUPn9850oA/1PS4b+Fo3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142710, "uuid": "52b042e0-b23e-4d66-8afd-b085cf428b4a", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142710, "uuid": "14a2f064-5780-454f-be1a-aabdd9383de5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142710, "uuid": "1f2f6fe6-feff-43d0-b396-0e13e91663b6", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acd6462-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632138748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138748, "uuid": "1d5a43e6-e0da-4665-a46c-69cab89a1295", "comment": "Malware payload", "value": "32431f1b969df7035c40ac7637c998ab", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138748, "uuid": "4e551734-e007-4ed6-980f-339024e8312d", "comment": "Malware payload", "value": "54cc7b10385ad506cd75dd1d3ac7897d8bf2982423ec2e51ecca900e4a373da5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138748, "uuid": "54a8eb24-021e-4762-9b92-09b6b3d038ba", "comment": "Malware payload", "value": "6f13ed7105a9807655f425efc9e1ecebdcf48ca0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138748, "uuid": "8153e7c8-1f7c-4836-ae84-36119e001e50", "comment": "Malware payload", "value": "0ac285da6308853232ab822bdf1d2dc7b5dd572ab647d61891ce94659f592c7bac2ddce89f0a64e723c23c5b4a1fcd36", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138748, "uuid": "f93e20a2-2ba3-4fd7-9453-82a7d68ace39", "value": "T110D4F13B5A5FD6B5E2A52B3FEAD734C50AA06C0C339FF84E6DCBB611503C14A1E82161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138748, "uuid": "e9aa64b8-368d-49d7-99da-241b71d2269f", "value": "12288:ObnyKyQdzbJ4Gf4yee4WRd9YrKPnKhwYM9ohYH+pHFLven:ObnyK11wyee4AeePKRGiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138748, "uuid": "2ba2e93e-6683-4250-a2d0-0c4b70948de4", "value": 601256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138748, "uuid": "f092a8cf-f231-400d-91ac-49e3e90e57e0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138748, "uuid": "7b21bf81-04f2-42ce-a72f-7540c712e906", "value": "PO#4550358074.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe21f80-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632145360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145360, "uuid": "cdc24033-5e41-4bb6-bd26-ed74432008c6", "comment": "Malware payload (Smoke Loader)", "value": "9f7b9edbacd4b26446a0b8c82c6edf6e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145360, "uuid": "107bbde2-f5d0-4f27-a513-432130a3367d", "comment": "Malware payload (Smoke Loader)", "value": "558269dca96917e3e5c81e8e97bde71b98bd081a56d43b5a003b9e36a335c860", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145360, "uuid": "c3c36cbe-536b-4604-810a-fb147dedbc0e", "comment": "Malware payload (Smoke Loader)", "value": "a67c26f3f2306d9d02a9aede7d3e7b35ad1a437d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145360, "uuid": "30793ac1-2f8d-48dd-af8e-30d43e6ec859", "comment": "Malware payload (Smoke Loader)", "value": "22cc065eb0e77169423d607516662451804be45115a27c81ff4241f29598160b1a42b3a37c685aaa2dd7f6bce81a5a34", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145360, "uuid": "1555be76-3e94-451a-b973-6eaeadc358c0", "value": "T1F7C5DAF09C5060407D3E2F8692AFBF84862C7536A798061F00FED6F63E57A56F967848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145360, "uuid": "0d01e59e-c526-4312-af77-2e4ce01c5f45", "value": "24576:V9mK+ncEgqAm/g/QVdEw+s4uvQ7S0n82uP9m32ZK48rju7q4OOwGJppCMWcs0fC6:rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145360, "uuid": "fad59762-53ae-47e2-bd1e-d63a0c18bae0", "value": 2590415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145360, "uuid": "6086d480-33bd-4129-a09a-ab501f87e9d3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145360, "uuid": "57c051c6-9443-46b2-b2a7-8f34f904f58f", "value": "Payment Notification.pdf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d807a326-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125268, "uuid": "bf7083a2-5e76-4ef6-b400-a83b43986e20", "comment": "Malware payload (Dridex)", "value": "6070e743d934b45de02bd4c220cee347", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125268, "uuid": "79ebb2e4-0085-456b-af14-bc42b7c3f64b", "comment": "Malware payload (Dridex)", "value": "5594dc91df08f7e476630fd049f54c0331263f3070664ebcd87e1bda73e5b2cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125268, "uuid": "63f448c9-b073-4297-8d42-649fa944319a", "comment": "Malware payload (Dridex)", "value": "93a6dbd5f99ec16c0762929c93bd7448717d52bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125268, "uuid": "a29dc78f-26ab-4622-a8b4-34d49df36310", "comment": "Malware payload (Dridex)", "value": "e3e4368e061267c8d373b4d78cb994e6dbab46b56b065783b0e7623336fb85328ec5ef977a630d55b423ebd509ca7992", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125268, "uuid": "d0d17231-bf5b-4f92-ba1b-c935b4a6114f", "value": "T1A4A5E020EE69E1E6C6B89F3ED408352717F93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125268, "uuid": "5ee4bda9-8a53-4bde-85eb-1f896cc39fb3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125268, "uuid": "4348cbde-e33a-4890-b145-881d118e0b29", "value": "12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125268, "uuid": "25161daa-f135-4578-a03d-7b6b5d1adf83", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125268, "uuid": "1f800087-ce47-455c-83d0-3f688d739234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125268, "uuid": "8b1114a1-070e-49da-b8dd-a70bd006ee09", "value": "5594dc91df08f7e476630fd049f54c0331263f3070664ebcd87e1bda73e5b2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71edc62-19ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632126958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126958, "uuid": "6d1d38c1-72ae-4e37-ad2e-9e82399d4bbd", "comment": "Malware payload (STRRAT)", "value": "889bf64014a14991d5f6ded5a935e85b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126958, "uuid": "dc448633-0e7a-417c-975b-cd5ad9c57137", "comment": "Malware payload (STRRAT)", "value": "55a1132700d6717af4960db65efa580c734d2b7fd64fcfa922bf485c410818e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126958, "uuid": "bb08267a-4b63-44de-bf6a-0460a1ec4ac9", "comment": "Malware payload (STRRAT)", "value": "3760fd8a7cae5912e055ecdf298479c579666800", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126958, "uuid": "4c725eed-e68a-4c1d-977f-5d12fa4527fd", "comment": "Malware payload (STRRAT)", "value": "ebeab19ebfd6bf694ef63730002badf3d1365af8812ca25563707d6b869e47423961a7628830d98f3c6ac482f62734eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126958, "uuid": "431315e9-8a5d-4d7b-b7e9-31949924c799", "value": "T1FB04AD114D84C7934B6B722C5F6F1407A6B00B86B4582740FAFEAE36ABA733C7357568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126958, "uuid": "54f9e6e2-9f44-430d-baae-429edcbf5941", "value": "3072:i0900t+oZ+qipWgez7LkagIaPkwMaFqWnb96TGfBQulk0dYl6qgVCJhsmbTku:i0Kc1Z+f3iUHIaMS5nJ6TGJ+PqYTku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632126958, "uuid": "1214b6c4-ed3d-4213-b319-dbad0acb1da0", "value": 190247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632126958, "uuid": "74ce08db-145c-430d-8e68-fd62f38d3a07", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126958, "uuid": "32fe7e0e-dfd2-4350-bd8a-e65ac6806e8f", "value": "Purchases Order Form 2021-1603 - #27471 Polan.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c94f339-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632152844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152844, "uuid": "d959c6bb-26ce-4788-bc15-c937c1737368", "comment": "Malware payload (AsyncRAT)", "value": "4b147f861b5f1161d152744720b169d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152844, "uuid": "c91524b9-e611-4aab-8450-e70265606d16", "comment": "Malware payload (AsyncRAT)", "value": "55b1523e368cdb0366a68b0fd883906d1b6788388eeca389d55a45afd01605e3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152844, "uuid": "01221833-8614-4148-b53a-f24bf4659990", "comment": "Malware payload (AsyncRAT)", "value": "c8ab59f67915026e90cfd4e74d33c140ff83abb7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152844, "uuid": "bff42e0b-c3e8-46d1-8c30-13253637ef01", "comment": "Malware payload (AsyncRAT)", "value": "3067fdf00e1bddd5a442079afdd0ec0941c07fd10ab8006e3c187a449b4bc40d80c42830c5734a65a2c7d9ef3dc5857e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152844, "uuid": "f71721f5-0c6e-4b50-a139-dd09da070366", "value": "T1A4233B043BE9C22BF27E4F7499F2214586BAB1633A03D61E2DC411D71713FC69A526FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152844, "uuid": "4eb1f8e9-8502-4f8a-bfd3-f07f25709ffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152844, "uuid": "e2be1772-a3c7-4b0c-a361-0f72565f118d", "value": "768:4uW/1TwwSf9WU9U0Xmo2qz4ErKsHRaQxJWaPIUyICwO0bBd/NXG/al/XSqo+Y09x:4uW/1TwlZ2orKk9eUyIXbBd/pRlvSwnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632152844, "uuid": "a53e32a5-8f16-4962-84ca-60b8513120f1", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632152844, "uuid": "ae9dfd8b-36f3-4f5b-9035-9c0428578803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152844, "uuid": "eb9a526e-3618-47b6-98a8-8dc1c37497e5", "value": "Ft6Zj1cT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20fe83b-19fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1632132908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132908, "uuid": "c420f037-fd51-4333-9767-6b856764e6b0", "comment": "Malware payload (Gozi)", "value": "242ca0c987f3b4ab2083131df6435527", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132908, "uuid": "b27b306e-6a15-471a-b5f2-26c9519b59a4", "comment": "Malware payload (Gozi)", "value": "5657bb527b62a7a83fb6542f2f80f50d0574dfa0b26a26ff26deb9029687b19a", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132908, "uuid": "eac4f6f9-b5df-40e7-806b-c5336519cd9c", "comment": "Malware payload (Gozi)", "value": "b74a83fff39fe91097e502ae214e8e9ce998e4b1", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632132908, "uuid": "5f25ff45-894e-4af8-a8d8-e64bdf692c61", "comment": "Malware payload (Gozi)", "value": "8fadb6b10ef5fbe356338476a7b27fc52084ea1ac57cfb38603069e26fb28d3c5d1512a012fae08840bd2baaf7248359", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132908, "uuid": "9653c61c-fb4f-45ec-a9a3-9c910ddf01a4", "value": "T10284DF2BBED3D075C82D44B5C891DCE23678B846AD68C6937AD83F3F19B30816D9A14D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132908, "uuid": "45106443-1d02-408f-9125-7f021c167a68", "value": "24875872bfb48e43a35582603ed00a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132908, "uuid": "cbaef636-5100-40d5-9ac6-c20e42585e9a", "value": "6144:M3XNL4UBjlWzkeFxH3+umm6M0luIbNlPo5EbpB0q4Rw3SBe4+R8Slg5LL:a9rjlWznxXvmhM0lugA4vqRw19mR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632132908, "uuid": "a4fd2f3e-ea56-4ba9-a4dd-7340e3cefaea", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632132908, "uuid": "87c6aba0-0325-4b12-9ca2-35269af3f0a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632132908, "uuid": "6fcb9364-3c8b-4fba-ad89-5920f80ff66f", "value": "61485efd6621c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe357f6-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632160205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160205, "uuid": "c9f7dd01-d196-4032-9d5c-ec14fec528b2", "comment": "Malware payload (Mirai)", "value": "18147a09e4e8388802a2738c16ed3cfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160205, "uuid": "16d5f361-8288-42dc-bd77-245f0e8e556d", "comment": "Malware payload (Mirai)", "value": "57873f601d7af26239d99211f0280445432966336b3303a2e9880447a1402ff6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160205, "uuid": "35ef4f20-2a98-4ca5-8229-c95233e9591b", "comment": "Malware payload (Mirai)", "value": "7fdb3b0516415e2c734d5625a322702bbdea2541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160205, "uuid": "90c99a19-e55b-480d-939c-9ac2b02f55b2", "comment": "Malware payload (Mirai)", "value": "c5af037399b849c70b0f16bb7d5de6b816c43eb034be7428293f8c78570e046d0ecb2f6438e1a87e7477996b7daa48c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160205, "uuid": "2aacc566-e876-456b-a481-64043ccd106b", "value": "T1B503E1DA4A0602F3E2D51432556DBA1B738A07FAF0B5645617F8BE1CA663AC36CF4183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160205, "uuid": "ac14e9ec-d331-40ae-a1ce-adb836fd42af", "value": "768:sAIaeIMDi/Zkgo+/qRnHMwWTyZDFzg9An2MZYKyh6HE0XktOfONmq9q3UELLL:sAIIMDi/Zno+iZ3ZpE9q20YiHpk8WNmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160205, "uuid": "d1edb5f9-18f0-4a7b-b64b-90b669adf6c2", "value": 38372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160205, "uuid": "e9422b3b-da69-47b3-bb89-f5f54c1008b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160205, "uuid": "551c5f57-746f-4096-812f-b47e00585e13", "value": "18147a09e4e8388802a2738c16ed3cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414de6da-1a57-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632172260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172260, "uuid": "bbe12902-0541-4fa5-8762-380d145ecfaf", "comment": "Malware payload", "value": "e8de22629a47faa0eda56bed3b1bfddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172260, "uuid": "a72e4823-3339-47f1-ac26-8cf75597a9f9", "comment": "Malware payload", "value": "57af71329fbcd067e4a0e71b6b6a5ccb22c9ba806843928fcb02196259d34da1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172260, "uuid": "9d6de3ca-9bea-46e3-a1e9-9babb9615c58", "comment": "Malware payload", "value": "30f935507e84df8b40c50bc7ac47c900281b5f01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172260, "uuid": "dd09a796-b59b-48cd-a20b-247af6a25f4a", "comment": "Malware payload", "value": "87ab88aeecb35e042954ecf27b90755462a3efb21a37cd403968ed487c23c4e5f8e513865f7a7f35b1a72850762651c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172260, "uuid": "1775e09d-7e4c-489c-9cfb-17ce2a428d57", "value": "T1A8E40120A7A1C035EAF752F849BAD768A93D79716B3450CF12C627ED22356E8DD31383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172260, "uuid": "99948b1f-7f29-4136-b69b-9829773422a1", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172260, "uuid": "17ed0ba8-e0f5-4df0-a4db-71201149672c", "value": "12288:2tIxdngLHv/UEcXPv4xIG9i3ViSPv+3MMwm9Jh+wQoGDbyl8uuo:rxaLMv4x/iYQdwewoyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632172260, "uuid": "77f4c55b-4eac-4481-9fe3-e8ee36bb1a73", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632172260, "uuid": "d46b756d-b152-4b89-a365-8d21ab62927e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172260, "uuid": "96f49f90-fb85-4d90-8a94-f0eada88285b", "value": "e8de22629a47faa0eda56bed3b1bfddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fdaf70-1a33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632156965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156965, "uuid": "159d91e5-5655-4f58-b331-e2fe775af326", "comment": "Malware payload (Mirai)", "value": "28ff1bb3e534069d9ebe1c21a990b5a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156965, "uuid": "b16918e3-8a20-4a8e-a7c0-f83728fbe838", "comment": "Malware payload (Mirai)", "value": "57cccd272c019e7e2c54b2fa1f6cafcbc6707a4c25f632cea680d351c6bc4d91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156965, "uuid": "cecac05d-cfa4-49a3-8f16-484bb15d81c9", "comment": "Malware payload (Mirai)", "value": "2a5174f9ea6caff8d67df71d922199386599c356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156965, "uuid": "00d195c9-a740-48f7-9b58-66ab46d78a5f", "comment": "Malware payload (Mirai)", "value": "3ce51b783e341b3f01b40b75edd965710d59f8d0dd4c68b8eb8d5158cfbcb6da30c03fd8e072e949e3b22912c1b3b5ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156965, "uuid": "60c5efbb-f43a-4824-b7b2-c862d31fc6aa", "value": "T1B1634AD3F809DFB6F809D73B449305067230A3A54A821B77B353206BDD7A1A92973F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156965, "uuid": "6538591f-8626-4976-92f1-5e980352be95", "value": "1536:m7pDCdtR2nOXotu158ywBXpZXX6ymwHSwIryNGmcosyFebG:mMdtRX4tu1EBXjXT7l4mcosyFebG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156965, "uuid": "f502e191-0764-4c8e-b9f6-081b5a9f85f4", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156965, "uuid": "b2df9a0e-824a-494e-bf22-10a20b202d57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156965, "uuid": "b9639503-ef40-4dc7-9118-fccbc7146d73", "value": "28ff1bb3e534069d9ebe1c21a990b5a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec908716-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632153220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153220, "uuid": "e6325582-41d8-437f-bc4c-480008300d9a", "comment": "Malware payload (Dridex)", "value": "fb1eca9d12608067ec4ee0990f63ee13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153220, "uuid": "2b5fc21c-4f0e-4396-9af8-991f9b6a3aa2", "comment": "Malware payload (Dridex)", "value": "581ee1b37d2931e58dc238a7e9a4b0f2baa42c31c1dfd847b7983ab5c75dd732", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153220, "uuid": "9d25897a-cb9e-48c1-b001-db673cdb4c4d", "comment": "Malware payload (Dridex)", "value": "c2dab8f53011c40ba58a2639dfdbb6124be367dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153220, "uuid": "98d04088-3fd3-4480-b4da-1db78a975cf2", "comment": "Malware payload (Dridex)", "value": "8df6f305d2cac847316da7dd3842eb5805518ecfdde7b21662039c95a7cbb50ad721f1fbf9ed6dff5ab1638de236479e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153220, "uuid": "3f378b5a-dc4d-445d-8256-a97d5afc5039", "value": "T1D314D04BCC8A44DDF6363C366BBF2D7A5F2E07214A28DC29CF54D515AC2370AE45A1B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153220, "uuid": "6bdddfd4-b116-4605-ab34-d88cbb3f9bd7", "value": "2640864aaa54b312b8f622402aa35be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153220, "uuid": "ee59baf4-f1e9-499e-b2eb-db9cf5ece7f7", "value": "3072:0CbhexUt6JzasssssssspciikZxitibxt1JQA+ONSfqJ/DkBD87dI/lyYZvCsssO:0ihe+lKibx6isqJ/DkB47QlyYpBxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153220, "uuid": "4523497c-2ff6-4d2a-97f3-5f33b3b9cbd3", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153220, "uuid": "414655fb-c7f1-4fdc-9a9b-99d5db850530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153220, "uuid": "c30aaf1f-470a-4d85-b7ad-1785fa6bc311", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c340e4-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1632146465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146465, "uuid": "a3841fcd-f62d-47f1-a215-e7b4428d2706", "comment": "Malware payload (Vjw0rm)", "value": "214ec6b7df53b376868f51e63a1dc66e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146465, "uuid": "fd9c6bd3-a146-4182-89ed-cc095a47dfee", "comment": "Malware payload (Vjw0rm)", "value": "585ac83dcf8a6c3138d3e2a5682142427b8cce541dda443672552a52ab28f05d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146465, "uuid": "d1d90385-1f25-4085-9fb6-43b3ba6ccf73", "comment": "Malware payload (Vjw0rm)", "value": "1395ad3250027c19fdc18d8c7702b0577228e792", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146465, "uuid": "79867f88-bdcf-4c39-bdd0-2d1410d5f598", "comment": "Malware payload (Vjw0rm)", "value": "6252b4a017756f06a42d8e8d1e441ca229a0870a68ad64f7aa247c1b6a20e525254af7362c1294d824e0d89827c79143", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146465, "uuid": "80437c36-97f8-428d-bd76-b65f85c18718", "value": "T1E2E2D4ED6844F9C9D961A27876696EC8ABF8770FD44143CE381C73449F31658C2CEA2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146465, "uuid": "3d1c5783-2df3-46b9-97a2-d577cc619b3e", "value": "768:s3TdV+rIOOCqsV4TzbfzTyHp4DnJTlM6LgkHq7:sDdV+rYh6OzzTyHpWJT6ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146465, "uuid": "94426cdf-56e8-4dcd-94a8-94fc80af0235", "value": 32680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146465, "uuid": "1ea1b2e1-530a-4a25-a583-d27dfafa7572", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146465, "uuid": "67d60b64-ac11-4365-98cd-baf1a92d844d", "value": "eVoucher#.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813d224b-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632153040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153040, "uuid": "ac5ff82b-b539-4781-9d9d-68d3cf642590", "comment": "Malware payload (Mirai)", "value": "baf908008e9641a0200a132f60d05a0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153040, "uuid": "84aafda7-29a1-4817-827d-9a6728705788", "comment": "Malware payload (Mirai)", "value": "589206a66bcda91150c514cab1633d1020d81f46bf9e2f5b68cff3e42c77c3ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153040, "uuid": "85723d0d-67b2-48c8-9e51-e5c46b728d62", "comment": "Malware payload (Mirai)", "value": "a8cecfd000ebef64ad5881c14a3f709c365ffa28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153040, "uuid": "b326c917-af60-48f1-93ee-c17c3e44d88b", "comment": "Malware payload (Mirai)", "value": "66f3fac0f888f0f4b11faa51994cbd18bfeaaf0693023d286607f021a7fc4cb9469b6453407adabcb546505d797a97c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153040, "uuid": "d07ca5bb-887d-480e-aab2-f522429b9ab1", "value": "T145F2F142A8F89BC5D9B9D0B4501F331E061C8075F51485E3DEC831B7EADDB89BA18EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153040, "uuid": "a3450a54-0060-4c7e-83b2-01afd9803885", "value": "768:JsprRHEPb0fNvsYFOZxgJ3HDV90V2N9wQY9QbCFQnbcuyD7UtQRjPy:sJmkNvxuQ3h90UNGmjnouy8tyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153040, "uuid": "4d948675-87d0-4b76-8d1b-aa092662693e", "value": 35544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153040, "uuid": "e29fcb02-839e-4e81-ae49-8a47a5c317bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153040, "uuid": "b4be41c8-1620-4f87-9262-3e341199a934", "value": "baf908008e9641a0200a132f60d05a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3f3ac4-1a67-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632179309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179309, "uuid": "71ae32e9-313d-432c-a29a-3d4079ba33a7", "comment": "Malware payload", "value": "d398a07e1e44a4af8b0f4be05184ac09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179309, "uuid": "bebd5826-d3ec-4fb0-b8d3-4f4e6d4fda9a", "comment": "Malware payload", "value": "58ea23d0b59fdffcf23dad14d1d79ef101fb9d21821d1107818e3d085ba11b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179309, "uuid": "fdaa195b-44bc-4e07-90e0-5f911ec07a56", "comment": "Malware payload", "value": "901d0983ed43efc7f2e7265e2d8d5eeea50d3a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179309, "uuid": "3038b772-2ee0-4532-8432-f4ed3739b307", "comment": "Malware payload", "value": "7e09964fdb00bbfd85d32fb578cb104670fa3a4bb29ad43e01cd35649b1a325b5a6443307d05a0c999e6c00411bbca98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179309, "uuid": "289fdd11-fa9f-4756-a6ab-bc507c1d86c4", "value": "T13EE47D01D2C0855CD46620F2B1A24F739D7CFF6239E1560BD7E4EA763F281A26E1929F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179309, "uuid": "56d4c153-fdb7-48ae-89ae-0e26e10b545b", "value": "6bfdc8e9ab91099b93b196379cda0bf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179309, "uuid": "a4ba7490-95c4-4156-ab8c-889bd9f699c2", "value": "6144:lZ3nSa5hHQmx5jb4IwiWTB6WeM+++POsmgX:DSmwm7/uiWTczX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632179309, "uuid": "002b3540-7796-4faf-9afe-45fc7ed43876", "value": 676616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632179309, "uuid": "e57edfb3-a192-4430-ad1c-3e8785507126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179309, "uuid": "938b0552-8234-4504-ac12-8ee96153838d", "value": "unpacked_437ccf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ee10c0-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632160809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160809, "uuid": "66ca2e9d-4f86-4dbf-8969-0a9189e000e0", "comment": "Malware payload (AgentTesla)", "value": "937a263cc9523a19b59c7ccd565856f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160809, "uuid": "b0e43729-0eb9-49df-90a5-2998e8104963", "comment": "Malware payload (AgentTesla)", "value": "591e461d4d79a004fe1c9b1fa8681b29390c4b6cedf9ba561f26ec0e65700b92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160809, "uuid": "a4fca89e-75f0-4f47-8233-f845e8325ed4", "comment": "Malware payload (AgentTesla)", "value": "5591d7da3b56125fc67b5e3c0953da502f5a80c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160809, "uuid": "4a1741b6-6147-460b-8be1-21ec8308c16e", "comment": "Malware payload (AgentTesla)", "value": "da9d1ece3bda745e6f2380365dd22abeab170c687a0951b9c014117fc31598a27b5ca4e62f910ad8415a069abb937d8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160809, "uuid": "61c4a69e-709a-4f52-b15f-b2adfd0e4cab", "value": "T14E159DC17D47D89BF0DF2AB398AFC1201165AE899161C73D26867B2B55F3342306BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160809, "uuid": "1a075ab7-99d6-4aa2-ab1d-a675201af145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160809, "uuid": "c354fab2-7385-46fe-a4ca-9e4d02ee60e8", "value": "12288:BdQsmtiK5oUZLuTGjsooVApfvc591bHKMc3DjTZUdfOL+8OhXYdF1wY2QK:v+FoRTGaKdGobjTOdtm7wGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160809, "uuid": "1de589ca-a3f9-4854-be75-727985dbd0c2", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160809, "uuid": "84070e71-79db-4a89-9302-2aa4dadf1f7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160809, "uuid": "4165d035-ecd7-427b-a238-f69dc7c9d94f", "value": "937a263cc9523a19b59c7ccd565856f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a1d095-19ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632099283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099283, "uuid": "d8926ad7-3828-43db-b231-17222c490362", "comment": "Malware payload (GuLoader)", "value": "c6ca4f86238d49ed2620211e9a1411f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099283, "uuid": "c1ce6991-8100-46de-bfaa-a24cd30e050c", "comment": "Malware payload (GuLoader)", "value": "59f57eb54271f8421034448e25abcbfa685f7b6370259c124905089bdc68884d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099283, "uuid": "2b840e71-3718-4ee9-8bf4-85ecf6de03ec", "comment": "Malware payload (GuLoader)", "value": "f3204fa5da92fc120f6e52eed187972057dd5e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099283, "uuid": "8b3b3682-5145-4837-a8be-8d63cc6ba5ee", "comment": "Malware payload (GuLoader)", "value": "1188e028ae1f151be8b8f0cd03ecf0f12d448d7405e72ad0b44e5b2a59f4d6273e6f39de6ed82a6e3a0dc59438ca692a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099283, "uuid": "25865f1c-4af5-49fd-94c1-876ca0604b6c", "value": "T108837D96E6E45CF3F5839ABC04A2B63814177C935FA0EE071D4CBE1E3A323455BB521A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099283, "uuid": "25da3526-5869-49f6-9658-5343a0b59f39", "value": "40768f14753bfb2d577d092577251956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099283, "uuid": "626b11da-cf73-4206-b11a-64e467c7be4f", "value": "768:x5P6tj322B7UyWDI9721b1UirW2j0okNID47bg2x7J6UopqjzwMwD:bWLnPWS7+b+uW2j0okNID6b/YKz/wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632099283, "uuid": "4b0b8211-e308-4a02-a8e5-6edd7a34f495", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632099283, "uuid": "adab5daa-025f-44a4-989d-e642a00be617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099283, "uuid": "77da21a1-93a6-4c92-8ca9-62bd52d9e23e", "value": "SecuriteInfo.com.__vbaHresultCheckObj.25494.9558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da394936-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632125701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125701, "uuid": "6564e02d-6a19-4543-8dca-0066d547f1de", "comment": "Malware payload", "value": "980abb80675e39adb756ff97c319d98e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125701, "uuid": "9ffeb9a4-de4a-493c-a741-ecc3bee377de", "comment": "Malware payload", "value": "5a365cea38015694af35724920fdc42f98d84e93586d18ad7a1fe83d1687366b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125701, "uuid": "3e157d22-5b4f-412c-a84a-8719e1e505e8", "comment": "Malware payload", "value": "a43151d0e718fd6eacab86d299907015be2043f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125701, "uuid": "d18f97bc-a62a-456e-964c-d6abd9892493", "comment": "Malware payload", "value": "e8d878e18aa762d2f2b6b6a7ed5878af94628f6789f5848bb2dad14e8e857cb474fc96f46157bc8f0f424ed16d350661", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125701, "uuid": "3807067a-0ea9-416e-a6c4-536706ca0556", "value": "T1CD54E0F32A118E15FCB42AB292A7C618076ECE41AB60D73BC6C5715AB77E7CB0D93141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125701, "uuid": "dd70675d-c756-4734-bf0b-d7ddc07b05f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125701, "uuid": "6cc7598a-2a35-4c97-8fc8-e564b26db500", "value": "6144:pds93Y7ZVyvoItCkzFUYgiUxR04aND/rkh:pr7vcoIokFgtx23rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125701, "uuid": "c319284e-630e-494a-8c34-8c6cf6af3d14", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125701, "uuid": "025b78b3-c1a5-4965-be61-acf47cb6917b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125701, "uuid": "8f373365-0a16-4264-81dc-cceb6dff213f", "value": "980abb80675e39adb756ff97c319d98e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c34e05-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125148, "uuid": "32fc1500-3d08-4c39-81df-39e52f0439d7", "comment": "Malware payload (Dridex)", "value": "2e1570782fa824aaec44ebe6d8d1b303", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125148, "uuid": "d7f4e6f0-e15f-4a61-8082-16d761ea8f0b", "comment": "Malware payload (Dridex)", "value": "5aa75e37d956e743af1cdf7448666064b5fff7f15047ef1776042ca5f696c44b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125148, "uuid": "5d3eb8c6-e9e7-493a-9086-bac85ffa1764", "comment": "Malware payload (Dridex)", "value": "d1d9ba5a9b1027d5d75c5186ca4d441e3ca6f673", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125148, "uuid": "582f1bce-c24b-480d-9a84-3078f5e55a84", "comment": "Malware payload (Dridex)", "value": "28040aeed2aee6cdc790f276c526eab81a5e32c5acb1f90b255dffb2b84cf26dd3692af67a48e56fec73108af6cb22f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125148, "uuid": "b36ce5da-eff0-46b5-a0b9-098525e0d329", "value": "T189A5D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125148, "uuid": "4ea0490b-1203-4243-8352-662a0efe990a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125148, "uuid": "334a0201-8a56-436a-acb4-a0d0cbcc9c8a", "value": "12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125148, "uuid": "d0d90b7c-861e-451b-92c1-7c9cb605330c", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125148, "uuid": "4ab1efa0-c601-4c43-92f7-cf2f73ca47d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125148, "uuid": "9d868ed9-862a-417a-aa84-11b083f69a08", "value": "5aa75e37d956e743af1cdf7448666064b5fff7f15047ef1776042ca5f696c44b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c71666-19f6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632130879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130879, "uuid": "40fc975c-e91e-438a-bc28-e482afa2701f", "comment": "Malware payload (RedLineStealer)", "value": "516d965aca3f47f9f65ffdb476b82dfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130879, "uuid": "61f91bc0-37e4-49a8-80d6-afbdf347c777", "comment": "Malware payload (RedLineStealer)", "value": "5b094e96a4340aa3f6cecc2ec4cab35444b8e10013e4d870d02e0362f54a8af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130879, "uuid": "09cb7883-5980-4c8c-9667-974b0dd86aa2", "comment": "Malware payload (RedLineStealer)", "value": "8709f520fa4ecfbc9f93ec8f06fac92b62326af1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130879, "uuid": "be8bfa2c-28b9-4168-bc03-379166b8eeae", "comment": "Malware payload (RedLineStealer)", "value": "d2786268ae87c80cd168cac7ba96b93a1f67631a58cb0720089f151d07157047d59ce0ee07b63de9439ad44baf68280c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130879, "uuid": "3c5d2ec5-ccf6-4679-aca0-263bbdbc015a", "value": "T17D64BE20BBE0C036E5F312F459BA83A8A83D7AB15B3491CF62D516EE56346E4DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130879, "uuid": "7a191800-a4b8-41c7-96fa-e807414cda58", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130879, "uuid": "134265dd-5947-4d22-9d01-53811c601128", "value": "6144:ohZQdjzvRcHaGuWqFB75GJ7hBKdH4lJyMiEs+x1y4W8:eZ4vRcHaGz875GhGHFMjah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130879, "uuid": "2decc190-d0b6-4c13-bd4f-b19088fc374b", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130879, "uuid": "ea750166-4699-4a56-ba83-69045997d30d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130879, "uuid": "f4c0bfbb-7559-430c-a184-f79f9add919c", "value": "516d965aca3f47f9f65ffdb476b82dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7744700-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632160459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160459, "uuid": "4657772f-c532-4c99-9a3f-752a976ce5bc", "comment": "Malware payload (AveMariaRAT)", "value": "d43e3ae5c7b859525aebdb7c248cb6e1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160459, "uuid": "5899e8a9-9cbe-4a5f-94f8-d9e67e4a3a47", "comment": "Malware payload (AveMariaRAT)", "value": "5c27e24a982091e963bd82c418d75df8a640db240beb81d6cd0681b92833615a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160459, "uuid": "03a809a9-9194-4403-8da0-333b417bcec9", "comment": "Malware payload (AveMariaRAT)", "value": "590156acb601d71f6b04008df519672bc6a13c8c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160459, "uuid": "c072b965-f644-43d7-ab2c-9dfa7c27fb1c", "comment": "Malware payload (AveMariaRAT)", "value": "df5f14c423f0e3b28ab943daa9747d5bc1cf92c214ae28f16791e34db01885bad8b5bcb815030c740f34ed01cfac196e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160459, "uuid": "d09ac981-5678-40f2-99d5-20792ad90947", "value": "T145F45DD3BD134467FEFC52770229809AE0657ED9646893FD8D72B087A633BD5380E982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160459, "uuid": "5a575dd9-3474-43b0-ac96-b9ed526c9ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160459, "uuid": "c7629d51-a01f-4a42-be65-dec6e370496a", "value": "12288:suCsmtiK5oCZ1Wyikt5qzVoGGuLwlXP+8/oJsSWdqbimvqltBs:t+FoB9ktIzQVP+etCqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160459, "uuid": "0f4ac7f6-d332-42c0-a3bf-f0b0902ffdc0", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160459, "uuid": "30de0081-95be-47fe-ab8a-cf5e1ae0d246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160459, "uuid": "5bfedeac-1a0d-496c-a088-51373cf8b590", "value": "d43e3ae5c7b859525aebdb7c248cb6e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73684ee-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632121804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121804, "uuid": "2e5d794f-9265-4d5d-b33a-81bdf467463b", "comment": "Malware payload (RemcosRAT)", "value": "0d9247623d85ba75b83f909d98caae11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121804, "uuid": "91a24e15-879e-4849-922d-6a4dde75dd57", "comment": "Malware payload (RemcosRAT)", "value": "5cddd352c21b35aa01f2353d74e3dedef3bde4b4dee56e61c696319ec9237b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121804, "uuid": "7bc820cf-dbb1-4a11-afb0-2cbf256ab5bc", "comment": "Malware payload (RemcosRAT)", "value": "1377ea7e6b909283bb4b4457aea6801aca70d552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121804, "uuid": "013b3cbc-4b11-4664-b9f7-1cd55a94c162", "comment": "Malware payload (RemcosRAT)", "value": "dd933d84c015023cb167a7ea7b5d3be7b043f3bd369f6c6ee436c883869140ebdf18c1a401cc33210c8708f40861d891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121804, "uuid": "957ec821-701b-49cf-8af4-e43cccedab60", "value": "T119551F294D6682F7C7EEC62CD09C0FCEEB62A4837B918F0ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121804, "uuid": "2f50a380-9f51-4ba9-af31-90cecc7d197c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121804, "uuid": "db9f6e74-1155-4d9d-9f56-6017613e07f1", "value": "24576:7pYuSFdijDkaAePPqB3BHPPHDt2T7czovJxg9oz:7pyFdiX7mxHPPHDt2nczKJxmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121804, "uuid": "47298289-35f0-4dc1-bbfd-9442691b4891", "value": 1304064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121804, "uuid": "9c82646b-4cf0-4158-86cf-d5c90d0410ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121804, "uuid": "1f71445b-fd79-4423-a4fe-96455d76d6a1", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953f3505-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125156, "uuid": "41d1b157-a338-4401-8c49-8409ea3eac08", "comment": "Malware payload (Dridex)", "value": "6c8c8bd71f89366476ef1aaa780be9da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125156, "uuid": "60924136-e90e-48a3-a613-e409c7a9001a", "comment": "Malware payload (Dridex)", "value": "5cf06990186088f97dbc1f6a6e2070c0b51c8f1ccb3ffd571b694faa4e0d22e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125156, "uuid": "e5d2bcac-3f46-4aaf-bb57-be984c1496aa", "comment": "Malware payload (Dridex)", "value": "b3770c849e32d37fd872632102ef1900b60b6b43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125156, "uuid": "948f25a6-adb3-425d-a81d-9ca6736928de", "comment": "Malware payload (Dridex)", "value": "98d97505c09d1c157fcf9f5c9bb7d40c88898dca8bd502df87662613332b427d7e87000306cc3636ee2593e34c8ff519", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125156, "uuid": "38a6ebb8-c875-4b3d-9a9c-90d7a44a81a5", "value": "T1F695E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125156, "uuid": "0c8ed9ba-7169-46d6-bf3a-fceba7ad39cd", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125156, "uuid": "9318f0b9-788a-4d06-ae17-99e26868a459", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125156, "uuid": "286b3062-8a1b-41de-a011-7ccb1a9e95d1", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125156, "uuid": "6641b7f9-9a6e-4ae9-9b8a-8d28920488c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125156, "uuid": "ef569b15-c4ec-4aa7-9aa8-d7f856a3c5e5", "value": "5cf06990186088f97dbc1f6a6e2070c0b51c8f1ccb3ffd571b694faa4e0d22e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e5ad57-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632121406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121406, "uuid": "fdc16c25-407a-483d-b67e-37de49c93792", "comment": "Malware payload (RedLineStealer)", "value": "2d140a33c8353961ac1e03f16abb6404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121406, "uuid": "cca77f3a-6562-4511-8c63-8f20f337addf", "comment": "Malware payload (RedLineStealer)", "value": "5e00970284b92c69f71325179e2f9a3cb40493c3b53efd997af571f0effacfd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121406, "uuid": "e3d35315-48dd-4936-a175-903ec9a319fb", "comment": "Malware payload (RedLineStealer)", "value": "44f92e07f708fb79124755746e29c10ad6296db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121406, "uuid": "6a378f59-b885-4997-b39e-391795545704", "comment": "Malware payload (RedLineStealer)", "value": "13d7fb1892851d2a3d756c9e7dbe5e2e853029965952f247c8f06e65b536b18cfc26d03f707c619b89910abc42f82fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121406, "uuid": "205c6a94-cd0f-464b-9935-6c8dafce8282", "value": "T10CE5336F66EBB4E8F943D033FC3D90851087ADB29091E9BE076C0FA9A77215C4B57A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121406, "uuid": "456e07bd-23f3-4c94-ae5a-2e2967f435ba", "value": "2061d2d60e6bc0fdd621117f51b85f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121406, "uuid": "4fd1a11c-6376-4fff-934b-633896f99dc3", "value": "49152:gxfWynrnGxFj5uZ7y5d172BZxwXXiCn4W9v1IetigJxddAr/JG2mXEsW68xaTrF:4fWO4B5MyJTHxn4VexYraU2VrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121406, "uuid": "ff3300d8-8c12-4d44-887e-3d99da5fef35", "value": 3040131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121406, "uuid": "4ce327bb-2eaf-42a4-8834-62a5994aa57f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121406, "uuid": "b12edd47-3e01-4bfb-b13a-0bda1010fbd9", "value": "2d140a33c8353961ac1e03f16abb6404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19eeb36-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632121794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121794, "uuid": "9d2c995b-3258-4b74-b1ab-03366fe00f0f", "comment": "Malware payload (RemcosRAT)", "value": "a84b3e1af950f42543608d6a6cd18a46", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121794, "uuid": "2006cc26-fbda-41d5-a1f7-f32e9cd865de", "comment": "Malware payload (RemcosRAT)", "value": "5fa711a4d33c6a814f57c9396245a924d8761b0c336da3e924d6cf866c84a9d4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121794, "uuid": "5c5f0e80-5406-439f-ad20-724d5904e4d3", "comment": "Malware payload (RemcosRAT)", "value": "58c6840a86f2372c8329f8bc38c355cf1761d64e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121794, "uuid": "1b8b5e80-9a6b-4a66-8088-32ff1a49c845", "comment": "Malware payload (RemcosRAT)", "value": "971081781ea515a96917fc7f0485add82d28c3b243506c53f8898ce91d6ab2bce2238b82bcd165b032380acba4245f55", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121794, "uuid": "fd5c6d13-0ae6-4473-ba67-a932b8ae80af", "value": "T11AD42308231A2EDC41AD62BD1B4DDFA55D2A0CF9C5FFFABD5C74253C80D94B442A32A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121794, "uuid": "9a5e5ed8-cd4a-4335-9593-60cf9bb6ae15", "value": "12288:o3ehrqCSGnBXpIYqrszGLq0PbA4Gu9SbH8ngl5qVxIpHzLKiaKUcChp7IzdWWBs:ouhrFSGdpIYzP0Pk4D9SbcgiVOpiio1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121794, "uuid": "879f3058-57f1-45b3-b76e-2a361d3287d0", "value": 651599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121794, "uuid": "65fcc629-909e-444d-bc9d-45e05818136b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121794, "uuid": "733ee35f-77f6-4ec2-b015-8b2dfb4f50c4", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f781e70e-19fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632133052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133052, "uuid": "142cdc43-44f4-4724-9180-667f55f6807b", "comment": "Malware payload (Formbook)", "value": "4cfaa2d8cd495c4287b169c5ba8b59b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133052, "uuid": "cfde4dc4-f909-4088-9434-e8e09fb6aca7", "comment": "Malware payload (Formbook)", "value": "61364951cb7faf165eaadcb66f8e124a689f5f298ec5f2d9539206904d1194b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133052, "uuid": "380a8b70-90ee-46e4-b33f-ebb824be63de", "comment": "Malware payload (Formbook)", "value": "53f596bd4cad49fe5cdec7a7badd528fe0d3196e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632133052, "uuid": "5601ba55-d512-4019-9418-a596d3fb5ac2", "comment": "Malware payload (Formbook)", "value": "4de886d23baa8a5bc58c2309625a0f0c42cca9bb3e8e19ec540b44bea11f42b942972908876f6f24b79d7d93931417ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133052, "uuid": "28962912-75db-46aa-b499-d6a9196cc338", "value": "T18605ADC17D47D89BF4DF2AB3986FC52011656E9D9161C73D2682BA2B54F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133052, "uuid": "442e3a59-0eb7-4b13-b4ee-94f10a5676b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133052, "uuid": "e76fec1a-8056-4227-a29f-f530c13313e6", "value": "12288:y5MTdTWISsmtiK5oyZ8u3KQQSpCNWDk301YMEGLogkn7SAXMTtASN:r3+Fo1KCak30OMEGLodf8hRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632133052, "uuid": "0fba4186-2a6d-416f-8c6e-91660a63b9e0", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632133052, "uuid": "7087d44b-6329-48d7-bcf8-300b0fe15e21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632133052, "uuid": "9fd9e7a9-2dbf-4cb2-a3ba-73408159762d", "value": "Payment Proof pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f735f3-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632137577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "35fc05f6-0953-42ff-a09e-56a23a8402e4", "comment": "Malware payload (AveMariaRAT)", "value": "5ae9a33968dd84ef25dcf1ae3b883e67", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "bf3d74c3-2561-4a3d-add4-5d8124c1cc51", "comment": "Malware payload (AveMariaRAT)", "value": "613da9b107a9f69a8e98220a8f68541c7b3b701f584556e550ccd7d70a18fa9d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "1cc94b21-c411-403b-a070-11f1424bc5be", "comment": "Malware payload (AveMariaRAT)", "value": "39e7957ad45c83cdda0263e6c0fe9803e0a831dc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "076c00c5-edbb-4148-abf5-08aec99c27ee", "comment": "Malware payload (AveMariaRAT)", "value": "d5e5823e159d1d16c229485e2e08846a077cc7edb175306943defb42b60a81f1dbbd168a7331383d83c250691f8c2aac", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "f14f8bc7-2c4c-47b0-b7d7-133a4047cdc5", "value": "T140D4236BF1DE4F9157D9EB02A48BE4D430BD261AE6004C7434E77A4E270C7CAE4A18BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "b1f60511-167a-4c3c-b0d6-38023c21a31c", "value": "12288:44Hu/inAq9c6rEDjgvO4y0bAwm1ybVenp2h4UrbkgueZ:44H1cUw0vO4yema64J4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137577, "uuid": "9a28ba15-219f-47e7-b0dc-02d53de530a3", "value": 626505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137577, "uuid": "e31fdca6-4dec-4bba-a53f-c6d86b37ba0c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "8fef8dc9-31f0-40b9-965f-461ede414869", "value": "21RM02749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c016e39d-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632121362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121362, "uuid": "64ba8c62-0cc7-45c6-8e4f-ac8a4769743d", "comment": "Malware payload (RedLineStealer)", "value": "2ef7f8706b2e3e0e014dc7a4dd50704e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121362, "uuid": "ed6bdd02-4bcb-4e60-bca6-07f5cae5a0f7", "comment": "Malware payload (RedLineStealer)", "value": "61929967132e6a3a435292821d1f6ec8f96247936a6da0ec7ecb6d0795feb89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121362, "uuid": "f59afd98-08f2-4efc-a5bf-ba7b53c79325", "comment": "Malware payload (RedLineStealer)", "value": "3126e0b935a319fce40696aebe1d706a089fef6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121362, "uuid": "75cd3874-2407-458c-8d11-2a6c40b436ea", "comment": "Malware payload (RedLineStealer)", "value": "431134f52a18654a5f584b5cae4beecb7797990ce8c182720fcd06d1192f670f881bcdb906d7236872e95823405788f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121362, "uuid": "28e0e141-6731-498a-ac8e-006f0d4f9bc6", "value": "T18464BF2076E0C035F5F712F849B593A8A93D7EB0AB3490CB62D616EE67346E49D30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121362, "uuid": "7af8fcde-cef9-43b7-a74c-a7148b4698ec", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121362, "uuid": "84d11eac-a590-49e0-963a-1c9b18f3270e", "value": "6144:U0ZQdNaEfQ4AsO7q67fshXV0n8PsyFfNd52nMKeXdhw1:DZ65fQ4AsOWEshlY8PsypNdvK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121362, "uuid": "4d3ffac2-9e16-4d75-b9cb-9ccda02f7bc0", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121362, "uuid": "f6ddbdd3-b0cc-4ad4-aa9e-0e2d97f17969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121362, "uuid": "c90a77c0-fa0a-4cf8-8a3b-10ac4a57bd3c", "value": "2ef7f8706b2e3e0e014dc7a4dd50704e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9028095d-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125577, "uuid": "a64bed35-f8ef-4943-abaa-328be7eec898", "comment": "Malware payload (Dridex)", "value": "2d00776fd0643732b7b368fede1a0a29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125577, "uuid": "c4c0d210-7853-401c-9d7b-2e620316a543", "comment": "Malware payload (Dridex)", "value": "635c704c0711f536479cc26566b70db972e4ac4b519f8f39ea794c44bfa9c49e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125577, "uuid": "6087cf19-f1b3-45a5-9d93-e79c4206064d", "comment": "Malware payload (Dridex)", "value": "5b5619188d8bf1ef959c8ee1b7799edc094cf678", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125577, "uuid": "12e4e49a-5146-4d55-8881-1af4940df643", "comment": "Malware payload (Dridex)", "value": "eec1e212233e16f91c4eb0ce69f8c4de3a4d0e582397921d7b439ffbdddc7dab8c2e28bdfdf199eff2caaeff54027e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125577, "uuid": "3c996f76-1288-4fb1-a75c-d68e1f111c2d", "value": "T18095E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125577, "uuid": "0f14b9a3-b5b7-4049-b31f-27bb6e77a4a1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125577, "uuid": "1bf4f4c9-6677-42ab-919c-e9300fac6004", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125577, "uuid": "09cb8b49-1134-4e22-82f4-a2b15ba164ca", "value": 1908736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125577, "uuid": "4b96b569-5aeb-4649-a9db-9e11dc799cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125577, "uuid": "83526c44-97b1-498f-b31d-7bebd0ad911f", "value": "635c704c0711f536479cc26566b70db972e4ac4b519f8f39ea794c44bfa9c49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7aba467-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632160916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160916, "uuid": "abe8b916-1397-4aea-bcb0-206578a9bafb", "comment": "Malware payload (Dridex)", "value": "b27c5ea73724943b7b14ba9704c88991", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160916, "uuid": "83caee4c-3ae4-4f87-8e49-75bd414816c9", "comment": "Malware payload (Dridex)", "value": "63cf7a2bff240f1ad2ea0e1d7ff4885cc174d346f04c42e6e8f6209df2acc614", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160916, "uuid": "711fc36a-4b5f-4d79-a9e7-d346fa59dfcf", "comment": "Malware payload (Dridex)", "value": "4d5b967b9e11003f922eeeee8e3af4ec362f395c", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160916, "uuid": "1e58dac9-2c2b-4296-aca1-30fa109605ac", "comment": "Malware payload (Dridex)", "value": "afee8a4facc39a87133f7503c7363252d2e454bdc958e2e4515e6a051f1f0fed94725958ef234f385a8760f6a77f2ce3", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160916, "uuid": "b341950d-95e2-4461-9f71-5ef346e49f3c", "value": "T12814F205227518ADE27D067A4CD35EBB93214A112800FF1F63F2EA1D5D7F2BB7686C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160916, "uuid": "289a38f5-ae0c-473d-8904-1c0683ddd8dd", "value": "6144:oxwsvK0keUaAqWkBYV0R6zwSRUC8V/hwZ5K:8wsDr1WOYVYYsCK/hw7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160916, "uuid": "dcd219f3-ce13-44e6-868f-ed3f94ac7067", "value": 202618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160916, "uuid": "99c0fc93-3389-440f-9ae5-ec99baac9398", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160916, "uuid": "5d55f834-2159-4849-9ed6-cb3322769fc9", "value": "INV.-2584745_20210920.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230a0bfa-1a38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632158894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158894, "uuid": "1780bc7f-bb8a-49bc-a697-05fb704bdfab", "comment": "Malware payload (Quakbot)", "value": "a372400cbff205def639e4db62ef17b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158894, "uuid": "465cba07-2505-4685-a2a4-4ed459da66fb", "comment": "Malware payload (Quakbot)", "value": "63deda6fe8af221a650f6ba6a2ee6c7fec17f10bc5e063c9b0aaee4981a01150", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158894, "uuid": "6db2ccfe-d1c4-4e3e-a019-be77e7b23beb", "comment": "Malware payload (Quakbot)", "value": "445447a8cd34df42d7fd786a164389cf8e5f82db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632158894, "uuid": "e15aa165-11de-4705-b5b6-6f1bfbb6d443", "comment": "Malware payload (Quakbot)", "value": "5d4fdf28124712cba1b17dc4e49b66e0af2a0c7013192f1843385875c82ff12bec875ea97afbfb5ad0093c9403a62b14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158894, "uuid": "247844c9-eff5-4878-9609-a9ece5ab54c2", "value": "T19E05D01A7ED6E191C83C5D7988E1C8E67238BC686D28961739E53F3F29F30D1584909F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158894, "uuid": "5569dd19-edc5-497f-93ba-88893b032b7d", "value": "fcecb109cd51f9ec6659a40269cd21c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158894, "uuid": "0e7bf77c-ae2e-45fa-bc07-6a952df3350f", "value": "12288:p0yOZOB93YJh6kwi4eYHc+12GPUhW1brsZCesX/OkSAIV5TQi/c+FI2PXekp5:p0yWQFViB7IOcesPIVVZQi/csIbk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632158894, "uuid": "3ac99433-07ff-4d83-ae8d-135e000ab569", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632158894, "uuid": "d927d9f8-c8f5-4a63-905f-4610ea3b8e45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632158894, "uuid": "b5de6a84-1c9c-40b3-88b8-c0ef780ed44a", "value": "44459.8061394676.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e258f7f1-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125285, "uuid": "f20eb5f1-0531-4709-bdd8-b3db3e9ef136", "comment": "Malware payload (Dridex)", "value": "1f3460022bcce8ceea95a920c3032a9b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125285, "uuid": "5c30c719-22c5-4cc0-b63f-f21804d3a4c8", "comment": "Malware payload (Dridex)", "value": "6450960e2c36613c48c0d30ccfb43484125bc2a6986f86d635658f9b648ccddc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125285, "uuid": "6faf3551-22ca-4534-a574-c7e0a06be2e3", "comment": "Malware payload (Dridex)", "value": "d63305265037c0a5dc16d3a4da57b19e0e9e1f51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125285, "uuid": "c2422654-6771-4f11-8e94-c4f704440b2a", "comment": "Malware payload (Dridex)", "value": "f23194212e5e2b6cd4e35f866be54d681a9134d34fe9cc65427add9938ad621968c6425058656f9454ee08dd2a448ba4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125285, "uuid": "a9c1f23c-f13e-4789-ab58-cffb5469aca8", "value": "T148A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125285, "uuid": "01401d91-8d71-4158-b29c-66a6f20ef800", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125285, "uuid": "5fb971fc-dab1-497f-a7b3-2e472ee70d4a", "value": "12288:CVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ffP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125285, "uuid": "a4cd5c02-3cbb-42bd-84c4-d7bc7f4ac299", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125285, "uuid": "20224c57-934f-47d0-bfc6-a3367b4b69e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125285, "uuid": "c833a09f-f204-4aa6-bb3b-4546c3158e13", "value": "6450960e2c36613c48c0d30ccfb43484125bc2a6986f86d635658f9b648ccddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be6d68a-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632118053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118053, "uuid": "e39e0a14-91b1-4419-8a2c-54330a410e00", "comment": "Malware payload (AgentTesla)", "value": "5d8e3878fd878c20cea3a1c9eca1b28a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118053, "uuid": "527db48f-e9f6-4690-be73-589e729389c0", "comment": "Malware payload (AgentTesla)", "value": "64ad4ef2e4d2826235be5327f8066ac0446f5d53e21f9fed1e48ad03807d32c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118053, "uuid": "f94c8283-fedd-44cd-a6d5-b6c3a170c549", "comment": "Malware payload (AgentTesla)", "value": "4534906160d30d952de9dc565d76afade51ed271", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118053, "uuid": "96a2987e-600b-433c-a55b-656afe105951", "comment": "Malware payload (AgentTesla)", "value": "9f9b8dfd71a494614bfcaee707426b6a31bc1a18108f8bd73295c3867fd4b7667eceb7db67dae6f8cbb87d3bcb5b270c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118053, "uuid": "13f2362c-df40-4da0-9a17-6ef5128cdfb9", "value": "T1A725D03422948226E2BBA7F8D4319460873EBD469436D6DE1CC2ADDB3DF134D811AB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118053, "uuid": "5681035f-efe0-4412-8060-a36dcd3777f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118053, "uuid": "6e9b4f02-1038-4100-aa90-81698846ab6b", "value": "24576:/A6EFuN+FoJG2GOK498M7pORaXMMwKuDRAQ:FEFuN6oJGGoM7pnXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118053, "uuid": "3347a653-6f21-40a2-b440-c5edffaedf9d", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118053, "uuid": "e4c5a8a6-9901-400b-8257-9eb9ea922c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118053, "uuid": "c4f9e3db-99a1-42e7-9efa-ac54099cad69", "value": "Order List EO102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7afeda-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125274, "uuid": "d3e6bab6-9da5-475c-9552-9e55660080cd", "comment": "Malware payload (Dridex)", "value": "5bb8e357e1ea730413418990bcafb8fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125274, "uuid": "898af869-1d5e-4057-a1cf-d60eb2b31127", "comment": "Malware payload (Dridex)", "value": "65174e0e18480c2fb056faf69453b5fd995d5dbed7763e5dee5ac5bd4ecfb323", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125274, "uuid": "74b5d2b0-a98c-436c-ae03-523b2978ed54", "comment": "Malware payload (Dridex)", "value": "7b5e40220badda80b028886b4dd9f88bba9caac5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125274, "uuid": "c85d05e0-0943-43ff-81c8-c7dd53abfbcf", "comment": "Malware payload (Dridex)", "value": "9b49e50333dc0ad5ddc5c8fec0eb3619cd303402ee8738326d01388553f74478e3de72405ddfa5f271c99041893c129a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125274, "uuid": "a8d4fa42-616b-4aa3-83e2-fc811f6acd69", "value": "T163A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125274, "uuid": "82475a22-dd27-4b16-8878-118b2bfaf2be", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125274, "uuid": "948b95f3-956c-4449-964b-32322842011a", "value": "12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125274, "uuid": "8216daf3-fa12-4bbf-93e8-b7e983d3aedf", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125274, "uuid": "947e751e-dfa1-4c60-87d4-f2e6cc7b37bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125274, "uuid": "998d1d70-c61d-40f6-84f6-f042cc542462", "value": "65174e0e18480c2fb056faf69453b5fd995d5dbed7763e5dee5ac5bd4ecfb323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc720c49-1a26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632151448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151448, "uuid": "f77f6c02-9ff0-419b-bc44-af60f3dfb263", "comment": "Malware payload (Formbook)", "value": "5da62bdb6889d90f395efd87681ebdc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151448, "uuid": "b9f89468-59c4-4ada-be77-7e04b4bd2e93", "comment": "Malware payload (Formbook)", "value": "65b8d28cc93ef078954f569422e9292298e638a11a6bb681c85065c84e042bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151448, "uuid": "99ea75c9-d856-42f4-b913-8d3f52a1ef95", "comment": "Malware payload (Formbook)", "value": "d6d8cfb0f3bec3b693b805a8bdeefe3651b6d509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151448, "uuid": "64526018-7678-47ba-98cf-861da2b51eec", "comment": "Malware payload (Formbook)", "value": "e24c69626123b3c4fec86de7ae0ad8ae0cb6ad821a0d849d7f16be81acbaa3ceab96d85fa50ca8cdc0548161f01310b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151448, "uuid": "8ebd647b-3260-40da-a4d4-09ecff36a5b2", "value": "T16C4412836BF9CDB7D56796305D35636AF3B38199E15235074FC80FABFCB098A8619082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151448, "uuid": "6b70ab0f-b424-4ed6-bd4d-580819d2ca7e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151448, "uuid": "c78a715f-45cf-4b92-a0e7-ce22cc763a2c", "value": "6144:p8LxBntcE0yoInozz1mZOoEFmAckF5rTKqdacxIiSgIF3CFbW:EuE0yAVsI4yPbaQBSgIFyFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151448, "uuid": "9a98a32f-2445-475a-90cf-6c9f851d451c", "value": 257349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151448, "uuid": "61b11897-7054-426a-be38-a615577735b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151448, "uuid": "a6aa4a55-89dd-4eae-b0db-98b34bab1745", "value": "transferencia bancaria copiar...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b91cf92-19cd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632113141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113141, "uuid": "41608db9-f880-4a64-a451-fe01d75c6cbf", "comment": "Malware payload (STRRAT)", "value": "22fa8208c1489127ed2e3dd54cc57248", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113141, "uuid": "21593778-b9b0-4fba-9686-c6ab926a0343", "comment": "Malware payload (STRRAT)", "value": "664954cc6173fe15aec267b6122f197bcb5672e84b1786404a7ca0812ffbea6d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113141, "uuid": "bda65d96-c518-4cfe-80a2-8d9cc2d6161f", "comment": "Malware payload (STRRAT)", "value": "b67d2c30f33bb4a0364a29e92ca782327a5398ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113141, "uuid": "6f51bafd-2148-48d4-a787-d4f048a756b7", "comment": "Malware payload (STRRAT)", "value": "be3c463be6bbb99aea0ce08966b57937c365a72b0eb1a2ba479bac0dc5b085bb97536bbe4d77408af501d0be3d54d220", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113141, "uuid": "74c292dd-a695-4e48-bba9-1492af51cd08", "value": "T166049D200BB01960DDAA720552BF0718A6FFA79BE554750FF8FE6AC09FA1101D31DB7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113141, "uuid": "cde2cb81-3790-433b-af8d-8b7fbc048e0a", "value": "3072:f58Ni7zGdufu2OinSdXQbBFsdS4j+zZrQ+j8+ku:+I3AdXit4ut8+ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632113141, "uuid": "b6a26cf5-ca96-4f37-950d-a2309aabc24f", "value": 190319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632113141, "uuid": "2d8794fe-809e-4011-8144-b2c86b10a817", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113141, "uuid": "450575af-9e39-4505-ab21-719543129420", "value": "Kindly confirmed all details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caf0d1b-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125410, "uuid": "36347387-1146-4872-bbcc-a835be56377f", "comment": "Malware payload (Dridex)", "value": "17dc491a9eb8c2f9a3fd0010ff5e1232", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125410, "uuid": "6674b465-a1d7-489b-abe0-3b2b1926a8ef", "comment": "Malware payload (Dridex)", "value": "66b6b7b88798c14db22e0c095a92f9a0a1b72325c9aac0cb3cef452ce8492794", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125410, "uuid": "e8a23694-af29-42c5-b0e6-281f3a018f2f", "comment": "Malware payload (Dridex)", "value": "98370e0435de91b430ea294e6b0fc5067c10ddb0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125410, "uuid": "23211100-25f7-4f23-8026-9ac12d98a116", "comment": "Malware payload (Dridex)", "value": "3a5c471f79c15522b9419a5af783870b21ccf61526afedce898a9e79975728ea747207a12a4a0b3797f96a87635589ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125410, "uuid": "50156b46-0053-4409-a00d-c3b19ea568ab", "value": "T12095D020EE69E1E6C6B89F3E9408352317F93D75110D608CD392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125410, "uuid": "5c3290cc-5a67-48b3-8938-4dfaf9717d99", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125410, "uuid": "584eefb8-63f5-4428-bebf-92f8deb15d7b", "value": "12288:cVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1n:pfP7fWsK5z9A+WGAW+V5SB6Ct4bnbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125410, "uuid": "0f917b8d-08fc-45a9-9608-0c68eb8ffdeb", "value": 2056192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125410, "uuid": "5aa3e2ff-cbe0-4a81-8842-68972c47622d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125410, "uuid": "bf7e3db1-f22d-4b6c-aa24-fef1e96a25d8", "value": "66b6b7b88798c14db22e0c095a92f9a0a1b72325c9aac0cb3cef452ce8492794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91843790-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143618, "uuid": "aa9885b3-0764-4916-92e8-0cdf6572664c", "comment": "Malware payload", "value": "7851f8216e0ed1ec8203a3f1fd7b1aa5", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143618, "uuid": "e6c159c3-4e83-4362-ab8d-1a7de6da9484", "comment": "Malware payload", "value": "66e9a98763f0a4b4d7e1c6745f968c8df84768e6acc88f6eaeb5a547f3e9bc4a", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143618, "uuid": "229deb9a-7f45-4054-8bab-6f6017e4e77a", "comment": "Malware payload", "value": "5ffcd3b27ffd79b5d9e962ffd205dd63739abe52", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143618, "uuid": "3b2c35bf-e098-4a30-b721-bdbc9fab6171", "comment": "Malware payload", "value": "fe0cae1c62704ffe33615c5a5e9d615473d23e30930a6de213cf276dc7b9245ff5c61db7fdd832e225f8d1d1c2b53efe", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143618, "uuid": "570e8ae2-f717-4f53-8060-38548c883508", "value": "T1BCA118239A97EC31DEB5ADF7A2C10340167AA5205C0BD6BCD7846D59DFE604703A4B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143618, "uuid": "eb76c623-31d6-4116-8fc2-82b6d29b9897", "value": "48:t2dzmnmysVuevBzCvvCvvCvGCvlCvXCvmCvECvcCviCv+ICv0BCviCv0sY36CvaH:ma8VXvhh1TH0uKp9cFg4akkiCR7yOKao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143618, "uuid": "2f46da62-679d-449d-82b7-ae3cbc3fcdb5", "value": 4818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143618, "uuid": "22412def-9dca-434d-a9c8-84d02660cf30", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143618, "uuid": "aa452947-6fb6-40a5-b438-9ae94c96d189", "value": "HBrowserNativeApis.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf717c8-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632160683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160683, "uuid": "39245af0-112a-46e8-a952-17012f581d8c", "comment": "Malware payload (RedLineStealer)", "value": "9546f65b5202dc76825766b5c22a17a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160683, "uuid": "9ccd23db-ea47-44a8-bbeb-b36670ea8b75", "comment": "Malware payload (RedLineStealer)", "value": "670906ad0855a2402291c290dc16f18343be80a00cb7f164463475b2fbf132b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160683, "uuid": "41156b4b-ba0c-4abd-b361-8173ab8d6617", "comment": "Malware payload (RedLineStealer)", "value": "467010a017e145a5df7314af1e2e69a417daa2fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160683, "uuid": "54e564b3-6a53-4308-8d63-9c18fa421262", "comment": "Malware payload (RedLineStealer)", "value": "a7866c03d31ab958763ffbe8c80280f2944dd8474e143156494c2b3b282c3211d9614721c0059fd592480cbcdbde4bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160683, "uuid": "d3fe629c-6d18-4431-aafe-87d9a081ff78", "value": "T111B4264C6013B3AEDCA1373B8E3A9F15CAF41D649566416D39D0BE77EAB1F82053E242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160683, "uuid": "3065c48b-5674-4c69-ac7d-6d06dc84fff3", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160683, "uuid": "9b4b8711-159a-4fef-befa-4edb7b0dfff3", "value": "12288:Vz6dpdoyzWCjlgEvbrm5cpz4Hg7sKjDGd:Vz66yzWCjlx+5cWA7JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160683, "uuid": "3591ffe0-5623-44ab-ad25-e86ed492e37a", "value": 517305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160683, "uuid": "e84fe377-112c-4170-82b2-bb14bbbfc9b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160683, "uuid": "22c6cbf5-e99e-4163-88fa-399c98bf570e", "value": "9546f65b5202dc76825766b5c22a17a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae358ad3-1a4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632169006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169006, "uuid": "9613e2fd-cf8a-4d7b-a5e8-57a6d75ccd23", "comment": "Malware payload", "value": "cf0f946b4038ccd8594109084c0db80a", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169006, "uuid": "dbb14590-5638-4658-ba20-edc6420863ff", "comment": "Malware payload", "value": "671701ceb705dd907d14a7bc9ae135a7d2ab467d321f0534009dcc79087d2bdd", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169006, "uuid": "a6f90205-ea28-4ed0-86bd-709e9160988c", "comment": "Malware payload", "value": "9b5230355dd74ed3f2e48bffc4f839cc9474acbb", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169006, "uuid": "83974a40-0a93-4c59-b49b-335f934cae3e", "comment": "Malware payload", "value": "59515207a8fa9d125645e67747c494286a7de89723e4183bcd2da14e41f4c1e7e6528c573724c03d33efb9050505bed3", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169006, "uuid": "7e93b5c0-4a73-4fec-be01-e3a9c7d91189", "value": "T1E35318003780D626E02A5A73CEE6C6DA3735FC61BE10872B3199335F2D765E09F26794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169006, "uuid": "379b4ff7-3655-4680-84c8-76628cbac0a5", "value": "384:ax4xVwC8dto0km8yKhU4CR9WzV4R2zYclFo39D:3wJdylCR9ie2kcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632169006, "uuid": "c05a3d05-9944-4f7c-bbf9-8d154343f67d", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632169006, "uuid": "8c413eb1-c664-4730-bcdc-14f8a9f6e9b8", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169006, "uuid": "7b2ffcc3-ddd9-4ed5-8b84-6583e3c78a42", "value": "Swift-Transfer.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb40fab-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632155985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155985, "uuid": "67e9d0b7-7d2e-4dca-ba25-8780932ec2cd", "comment": "Malware payload (Formbook)", "value": "15c0994e6c4cff319deb5e35339c204b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155985, "uuid": "efa21c68-255c-443d-9906-6f46e5f83740", "comment": "Malware payload (Formbook)", "value": "672ca84f8680ab545196dd1f961b3f456ae6b4ff1e0629fab96ed0625f22bbd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155985, "uuid": "33b4eb2d-a9c0-4c70-a8c6-0db3f9ceaafb", "comment": "Malware payload (Formbook)", "value": "48ebe72f83588ff4a778fd25a7d1c42f135834a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155985, "uuid": "d99e45c9-74f2-445c-82cd-6adc8be6559a", "comment": "Malware payload (Formbook)", "value": "92a21d8f3c7575d8a8dc3e6cdbf66c42be1f99bf5324aef94f2ed6c551391b12dcdf0cf7abe40c3470abf752051eaf08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155985, "uuid": "8ed99ceb-9c66-4816-8697-d72cbd00c421", "value": "T1E8059EC17D47D89BF4DF1AB398AFC4201165AE8D9161C73D2686BB2B55F3302306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155985, "uuid": "00f4ee63-742d-478f-a8e3-849eaec23aef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155985, "uuid": "957633f8-1db8-4882-84e4-9ead601a5c1b", "value": "12288:kpw+1P7WsmtiK5oUZqWdWHWV/rdM6tZWc9Eii35IVGQK:oh9+Fome8/rdMiQii35IVZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155985, "uuid": "716aefa4-30a2-41fb-84ec-11ccea055161", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155985, "uuid": "e9386d08-2d8c-463a-9683-d2bfb20a5805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155985, "uuid": "bf3ea189-9686-40f7-9ec3-dcc10becf87a", "value": "15c0994e6c4cff319deb5e35339c204b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f14b01-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632118129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118129, "uuid": "ac3eaf7b-4bc3-49b1-a69d-3cb6dd858f77", "comment": "Malware payload", "value": "05fcf9faca3d86984bd924f800018d57", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118129, "uuid": "5e98f385-062d-4962-8ee5-568ddb73621b", "comment": "Malware payload", "value": "6780f24310b9f829beea08e1857c96cddad4e2fc8935ad4f5a4eba5df284c188", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118129, "uuid": "7ebdcf29-87d8-4e0b-b25a-6b8d4519345a", "comment": "Malware payload", "value": "bdb125f50266a2a7a56311786cb7b7a7cbdc3226", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118129, "uuid": "7bc98bf9-5bb5-424c-b3e2-936c3f3372ce", "comment": "Malware payload", "value": "c2570a32c91373c42de599882d0f3e09a6b8a71aac22c4f90551352a6a36b208f42d04f1538fa11590c62646c2ed6d24", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118129, "uuid": "b8ed9fc5-c9ef-4564-80fd-c024fb1d846e", "value": "T173D402483468A271F107733E336A63789950EF69A4B181654FAF797BEB3E50DE830706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118129, "uuid": "6dedb1ec-926e-47c3-8c97-515a2077dc92", "value": "12288:Rq3HVgwpTIV6EE6QsFcK6PW8rgflASCQFghhzcA1C5sfDirdhK:k3HV3pTIV6/6QsFcKGrgfgGiCWWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118129, "uuid": "37bcf6ab-2648-49f8-811f-054efeb0622a", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118129, "uuid": "d8421c83-3a70-4f76-9714-70e16c0ccc87", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118129, "uuid": "2db8470a-9e11-4d18-93ad-42997818643a", "value": "P.O. Assad and Sons Bahrian.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dde6f03-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125439, "uuid": "8b50ac5c-2ab4-4ce0-817d-bd14e1145d4e", "comment": "Malware payload (Dridex)", "value": "aafbba01249f41fcd18ba867f117a258", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125439, "uuid": "ddcfcb1b-6e74-423f-b006-7e5bd033a0fb", "comment": "Malware payload (Dridex)", "value": "67dc8fa853dfb5df7dd19e78f50acc8adfbc7ede37166caf45498af71eee150e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125439, "uuid": "3cea2ae3-bc26-4671-abe5-ff0774d47e9a", "comment": "Malware payload (Dridex)", "value": "7909fbae908f66cd057cfee3c1ea200598b85406", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125439, "uuid": "99b7af3f-d822-4835-8f45-bfe6ae5e21ac", "comment": "Malware payload (Dridex)", "value": "5fb0ac3e30271870fdba1f3eb014abe028bb870b48bf41507c56ceb5ad30d45a25364e9bae2c84c6e97b89dc6aa94cc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125439, "uuid": "e72d38e8-3521-4e65-a59b-c4463b6ca793", "value": "T1B595E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125439, "uuid": "4ac3db7c-b482-4e00-bf54-20f4e5be8f21", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125439, "uuid": "f6cde671-0b62-4d25-a8b6-d369d8945257", "value": "12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125439, "uuid": "283916ea-780c-4b57-b2c3-592c8d67afe2", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125439, "uuid": "f6eaeaa8-7669-488b-8bed-8957385dbe1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125439, "uuid": "8769e5e4-5f24-4e77-ad5c-ba324145da6f", "value": "67dc8fa853dfb5df7dd19e78f50acc8adfbc7ede37166caf45498af71eee150e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde045f5-19f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632129573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129573, "uuid": "90d38920-3eb9-4d7b-bf0b-c4a5638126ee", "comment": "Malware payload", "value": "79832148a283baaf88d8270158cdddde", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129573, "uuid": "25c88300-abd5-47a8-b896-43c1004d889d", "comment": "Malware payload", "value": "67ef95841bc7c2beb6b026a121d69305eb2a4d424133e92c61da8cc6ace62f55", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129573, "uuid": "9479eab2-7149-446f-89ef-0e5b4688b1bd", "comment": "Malware payload", "value": "2f9955c3b27932a7b35436dc384d687c63a987ee", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129573, "uuid": "e87944c4-3a60-4b71-954c-2ecebda59375", "comment": "Malware payload", "value": "6445e39468ab0a53050578a01662ea4b56c6d58ffa042ed88cd02288860e935d4009d741a8bd969986b38c7edc83c7b1", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129573, "uuid": "1dcbb582-1353-451c-968f-34403e781463", "value": "T16AB394227A97D4C6ED1F833A4CD286D62221FC067E46DFF73232B72E1971598C91225B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129573, "uuid": "1bb0a63b-f85f-4f88-a964-558da174430a", "value": "3072:ShlYkEIuPm3fNRZmbaoFhZhR0cixIHm0+HRJ9iWt:olYkEIuPm3fNRZmbaoFhZhR0cixIHm0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632129573, "uuid": "4e0ce034-5e51-4628-a89c-e6bb64305620", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632129573, "uuid": "246ff286-351c-4656-b6ea-2e6913e1092c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129573, "uuid": "a153829f-ba42-4c16-977f-fb8b8cd30fa5", "value": "2021-DDT-0001633.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac5e324-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632153217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153217, "uuid": "5fadb554-ca8c-46ad-9ee1-a3423a9dbb6d", "comment": "Malware payload", "value": "8d2bb22edb685283a6b3e56903f5bd9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153217, "uuid": "907d1e17-348c-4089-87b3-c06e44d8d0f4", "comment": "Malware payload", "value": "67fd7a8effa697feb0501746cf0c5410a8a20817237718a2ca0dd86bb8142f29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153217, "uuid": "910bdd0e-677d-4e7c-bea7-066383f67c38", "comment": "Malware payload", "value": "446458952eaf45a5d5cb2e84e75f6e583cc697b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153217, "uuid": "a86cf03c-f829-4437-b654-aadd66665e60", "comment": "Malware payload", "value": "eafb3aa35e5fe4c04e16197985e41ab93432cc9325d6c4a4c26e57b62a2689a3dc906a86531ac00d178e7bcb4f615928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153217, "uuid": "d6fc2837-2425-4210-a053-524fea09c959", "value": "T1E9921B0ED3919EB8D89CF3308DDB897156F0B074B6B1632B2B65363A3E932114677945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153217, "uuid": "39509cb6-8e22-42e9-a9fe-5a4cf9c606a4", "value": "384:jrlKen0Xvn/3PHfXvn/3PHfayqC6uP1N9AeQTGcUqWSYw/Zb5YZMm:N90Xvn/3PHfXvn/3PHfayqC6uP1rWUcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153217, "uuid": "85cde537-250d-4cb1-be16-a7a6b9be7026", "value": 19752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153217, "uuid": "00b3a638-d269-412c-b777-ab8f96b17baf", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153217, "uuid": "115eed38-2a24-471e-94d0-923fbd495765", "value": "os", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f3f78d-1a10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632141723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141723, "uuid": "1b935d90-87c7-4dba-8cd5-2b136905c65b", "comment": "Malware payload (AgentTesla)", "value": "50695cdd1b5e007381bf35b735cff70d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141723, "uuid": "20749ba6-3d14-436d-9a42-e11c4e276110", "comment": "Malware payload (AgentTesla)", "value": "68051ee97e00b1657b979c43537340b4fdd319c1ef14f7a4fd410c8dd7da2157", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141723, "uuid": "30baf531-da2b-42bb-a312-3a6e008c1b75", "comment": "Malware payload (AgentTesla)", "value": "562decbd326787b116b56026d311ffd4bbe066e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141723, "uuid": "98e1dc47-cb96-4ae0-ab3c-46ccf2d7df4c", "comment": "Malware payload (AgentTesla)", "value": "3fd6c7f6153df914cb02b00e9309a9eff778292f6be0a18b812e896fcffb04dd57a9d5f816e8d435cc1dba45d0395919", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141723, "uuid": "51fd9c3c-228b-41bb-b763-d6e7294a4a26", "value": "T181D2503ED9E788E7DB931AF6793063404DE394156E369B5A3086F089583F7103B1DAD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141723, "uuid": "9858073e-a796-44fe-82f0-c7a6b7dee8f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141723, "uuid": "c544034e-bf77-4361-a2fb-68ca4ca4fd5f", "value": "384:+rEb4fe0l6zff82opvtOvt6Y4BwEapWNJ8x:eEbU2oZU1ZdWNJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632141723, "uuid": "b934a143-f5fa-463e-828d-93e78a78fc96", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632141723, "uuid": "862807fa-f471-4b6b-bd03-9a31b0158cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141723, "uuid": "3993f7cb-7195-4b7e-889a-44fa8508ea25", "value": "DHL STATEMENT OF ACCOUNT - 3300315209_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d21e710-1a38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632159046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159046, "uuid": "d1828fe1-0155-4e94-9ecb-2621c07968da", "comment": "Malware payload (RaccoonStealer)", "value": "d5df770290afb2ecd2d6a4150fa8e176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159046, "uuid": "29b328b9-9600-44ec-94f4-d097e46c96ad", "comment": "Malware payload (RaccoonStealer)", "value": "68057c01ea50c5514b856ded8170ba2285ad782f71c27bcc87cb9aaf91da3166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159046, "uuid": "130c44b2-07d3-46e1-a822-74fa4ac5593c", "comment": "Malware payload (RaccoonStealer)", "value": "e2f8b02bf853c4b2fd5c0759194462e39c16b987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159046, "uuid": "6153b3b2-261c-4197-b570-6631f2c5ba29", "comment": "Malware payload (RaccoonStealer)", "value": "457b726dc1db64ed3f1bcdef2bbfed80e653cb18ceba38859983b1242e8ea9e28fc3bb7e11590447abb4eae6122f1675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159046, "uuid": "96e315d0-3a61-4c94-967a-ae3fef204036", "value": "T13414AE1035D0D472C59A1D3045A48BA3667AFC321A6489877B983BAE3F713F1973AF87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159046, "uuid": "064a94dd-99ee-4032-a04d-ad119302a90f", "value": "1f1778a50f9b54ca062656e19d05039f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159046, "uuid": "85642d66-fc79-4c15-adfe-216baef3bc35", "value": "3072:+GHKPgluBdwqSLm3tDIB5zvOQsWvLA96RS:yP9kq8m6vHLKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159046, "uuid": "3a132427-7b40-4e40-98e8-d8555e726930", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159046, "uuid": "c9985723-c7e6-4cb1-bfa4-1137a5b66739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159046, "uuid": "cd6717c6-8c84-4d1a-8ad4-0e0a7d847c55", "value": "e2f8b02bf853c4b2fd5c0759194462e39c16b987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee243de0-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125305, "uuid": "873ed5fa-0dc0-4123-923b-c5972b509ded", "comment": "Malware payload (Dridex)", "value": "15c5db0834aa8e18ca29a757ef91aa4b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125305, "uuid": "d0436a35-2fbe-4dbd-a93c-35dff3741d93", "comment": "Malware payload (Dridex)", "value": "6840b9d90bbeebd7472957d435e072e9f3a8f3d0fcade639a00a0d1e0124fdd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125305, "uuid": "ca4319c8-e261-420b-bd1f-3047c85dd03d", "comment": "Malware payload (Dridex)", "value": "21338bf88ac60ec2e5a74a4a10b12e0b287a6fc9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125305, "uuid": "46bd7f74-aba6-46e4-8c0d-0ea82afa560f", "comment": "Malware payload (Dridex)", "value": "02a6dc0e25645651acf04e14873a0a0fe5c769ac4a3dd975eb866303a612f4a9ea6bf3b73f8d10a29a609d21cd8ec40e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125305, "uuid": "fe89a2a5-1f42-4782-8dc8-d8ab470285f9", "value": "T1A8A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125305, "uuid": "d69254c7-ba62-4fd1-96a8-27c7852978a6", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125305, "uuid": "c59d47e1-3daa-42fc-b149-56096e8313dc", "value": "12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125305, "uuid": "041a5463-8f73-4817-9de8-b562258bf39a", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125305, "uuid": "e778638d-c368-43be-8fb9-1912a4c293e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125305, "uuid": "f6d7f67f-fbf5-4f09-b888-112bc5137089", "value": "6840b9d90bbeebd7472957d435e072e9f3a8f3d0fcade639a00a0d1e0124fdd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f2d3a8-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632160242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160242, "uuid": "04d8dc08-2f6e-48ef-88bc-425e3b88f34e", "comment": "Malware payload (AsyncRAT)", "value": "341d0462228824b6afcccedc9115de08", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160242, "uuid": "1bc513d3-ff1b-4bd4-a0f2-3005c901ef93", "comment": "Malware payload (AsyncRAT)", "value": "684ba5375876388b35090262df04569834c9258ec67396fd6dbfdd78570c85ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160242, "uuid": "87288679-2bf8-4edc-971c-233be24e816d", "comment": "Malware payload (AsyncRAT)", "value": "4fb4512f052d27badc615d46a8ed46d1a2d9be6e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160242, "uuid": "8a94547f-2335-43c2-84ee-887cbff85bbd", "comment": "Malware payload (AsyncRAT)", "value": "d541fd24122020bf82eef510a8430f3761a6511a0f92e2c10be57ccf4c2980f88566db15cb53b6b5866a2786bb92bbed", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160242, "uuid": "b305f618-b436-46e5-8091-a9a57d5733a9", "value": "T119416F062962104E1B15C3E5B9EB5D691E3BB0237F8B5B3237EB7105E0053E554668EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160242, "uuid": "b5c0a231-5f14-4dc1-969b-f712268e6f70", "value": "48:AuLR0WMI27/tI373I7dbMpI3OVIBOXdIba2CzaIu7KIW72IR72T:RRaIMtIjIpMpIEI0tI8aI7IfI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160242, "uuid": "463fe22b-67c4-4b17-a3a5-4a13a66c14c1", "value": 2244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160242, "uuid": "75e5c649-dd22-498b-94a9-34d812a8f403", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160242, "uuid": "c584e82f-e1b0-4e9d-8419-af868b99089f", "value": "QOJ48GT1(09-17-2021).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d5e2c4-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125204, "uuid": "b78e8ebf-a037-450d-86c4-d7dd637f5bae", "comment": "Malware payload (Dridex)", "value": "e9581da3489e13ee484490cfbe18257a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125204, "uuid": "6d3e728b-d95b-42a5-ab65-1e20827119f3", "comment": "Malware payload (Dridex)", "value": "6924db5cff43133d237148ab5141c42b588e7f08cab05ba29341681860db52f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125204, "uuid": "bfa1943c-e7cb-4f4a-9ae0-f2597affc2c3", "comment": "Malware payload (Dridex)", "value": "ebd09672bc4124f321136b3e1663de9de65de703", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125204, "uuid": "b640c01c-0b06-4e2f-8955-f3e80cb79c19", "comment": "Malware payload (Dridex)", "value": "46bb223348c15dcac7c53cb018ec445774e1ee39585e9ff64a237310160dff6c30bd9b55062f79268ab8d20730df3a8c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125204, "uuid": "bf6b3198-0419-463f-bbeb-bfb46461b251", "value": "T1EBA5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125204, "uuid": "21160ae8-b7a3-4e9e-b177-c3152e5f97de", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125204, "uuid": "8d34b368-fa45-4fe2-81c8-e856316f18c1", "value": "12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125204, "uuid": "9cb8afb5-43c6-4806-8bc1-f8414762282f", "value": 2142208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125204, "uuid": "9ff01cb0-ec9f-4393-b96a-27a75a31f674", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125204, "uuid": "903e0dc6-3125-4c5c-92ee-0dc016437336", "value": "6924db5cff43133d237148ab5141c42b588e7f08cab05ba29341681860db52f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebcc45b-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632160793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160793, "uuid": "6a3f45a5-0e1c-4023-8e4e-55ee0430c7df", "comment": "Malware payload (Formbook)", "value": "61d1b923bce3ebd7b464eebe0ef10f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160793, "uuid": "d4c42bc4-d158-44e9-a97e-678299a3a561", "comment": "Malware payload (Formbook)", "value": "6a031ff99c704ce956ff83791f0face2196fef52ee2672d860dce78e917b8f77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160793, "uuid": "f15b2a6c-07c0-4617-b7af-eb8231708f66", "comment": "Malware payload (Formbook)", "value": "a201784bf28ff4504a9eda4e2caba377be17b855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160793, "uuid": "1059e8f0-edde-4302-b06c-f38573c3a09c", "comment": "Malware payload (Formbook)", "value": "5203a8d941dbe8c5c299173e1667f1a30aff1b47117390c610c684e426736f367f5d1043beb8d3fcdb7984a3393bd63e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160793, "uuid": "8d1fe65d-6588-46b4-90de-d7e50855492c", "value": "T136059ED17D47D89BF0DF2AB3989FC12012656E9D9161C73D26827B2B55F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160793, "uuid": "0bc002b7-0e2b-48ec-98c7-4dc246ff7f18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160793, "uuid": "2b41dca1-d687-40de-be85-3262d23518b8", "value": "12288:T5U0BCDYsmtiK5oUZvZz09F3su01HJgTjXiuIcdxJEXUIUGQK:RBCb+FocZz8cu01pvx9XUdZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160793, "uuid": "8114b96f-4461-428c-927c-c3cb4df9a79d", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160793, "uuid": "8e62142c-f972-4bf5-bee3-ca6556616071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160793, "uuid": "7879baae-cd82-48fb-bc0b-3c07976686f0", "value": "61d1b923bce3ebd7b464eebe0ef10f8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c904fa48-1a05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632137269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137269, "uuid": "e74caa06-5c52-49d9-919d-c859abc97ec7", "comment": "Malware payload (Formbook)", "value": "d3ab888eb56ef9716e5cfaf7fa164ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137269, "uuid": "510a7bb4-798f-4d76-95a8-8c6bb4efe26a", "comment": "Malware payload (Formbook)", "value": "6acf1bec87a9b06a63ac3be623a527d7c419d17bb8a258b67e2f7cc2c607cc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137269, "uuid": "eb052a7d-ba7c-4a70-85bd-074368c7ca1e", "comment": "Malware payload (Formbook)", "value": "5fb3eb9f806aa20633a399931cff86419fa7dd8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137269, "uuid": "ccb8167f-41c0-47e6-b67f-7deda7165f34", "comment": "Malware payload (Formbook)", "value": "b0fff4e48dd1ee18eec96c6249512d56cfca80525a0e24a3b1c7e14d8ff8799f80f42f05a0137ce0197781cd7377e95c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137269, "uuid": "3f6d4f46-aa49-4b83-bad1-c989ef1def55", "value": "T192F49DC17D47D89BF4DF29F3986FC12011656E9D9161C73D2682BA2B65F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137269, "uuid": "93ede931-633b-4eea-b790-2bd0f2adcbee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137269, "uuid": "afc9e69d-c2a4-47da-af7f-6f43a8c129d5", "value": "12288:kFqsmtiK5oCZKTnYKEeLOrV8uWbPL672Zl4P+5AYQAeQw5USLLxDOD5GQKx:Q+Fo31EpWxZFDwDFOD5ZKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137269, "uuid": "477602a2-abc3-4626-81cd-672b591ee5b4", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137269, "uuid": "486400ea-99f5-4475-a06a-8bbecc75e95d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137269, "uuid": "597a0ad8-57a8-4e58-8ba4-96041e811bb7", "value": "R2P78YZdvFH5ZJh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d6bf8-19da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632118645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118645, "uuid": "f35e9d0e-13a0-48aa-aca8-1f487bc0ec55", "comment": "Malware payload (Formbook)", "value": "c32ab169dd005d75f00197aab455078c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118645, "uuid": "1d6d0ea7-1e41-43ba-b4a0-fa6b7e68b38a", "comment": "Malware payload (Formbook)", "value": "6bcdb1b6795c22308aee5d390cfae409d21a3238a304466dd54c1dee43570afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118645, "uuid": "6f51699f-2855-413b-ac57-883b3da69c6f", "comment": "Malware payload (Formbook)", "value": "31c68914c047d1bb761aee297af12461d37e4fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118645, "uuid": "311d9649-785b-49cd-ac81-9b592661093b", "comment": "Malware payload (Formbook)", "value": "b4fc8b87324be989f4ecb2c3e8289b0cd22c761bab235739601af1da01e2f53eb97c9129aa53ec19aceeb9a9f1116844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118645, "uuid": "b35abd0e-a453-47a5-b86a-b4faab6cc59c", "value": "T1CC05C0202264826AE1F7E73DD46294718B3FF987A036DA9A5DC3D9CA0D31341D51BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118645, "uuid": "9856485b-bbd5-4114-9440-cdded16bc5f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118645, "uuid": "d6d38a40-13dd-4765-8013-d64c8955c84d", "value": "12288:8BGiY6HeFuYqLAEq56bIzLdn6pgkF0me8bCW3s7KGrIWCtmtiK5oSklG:8A6+FuYqcEM0wxEF0mPt87B4+FoSks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118645, "uuid": "b9c0cc69-8b0d-4e36-bafa-7c6074a5c1b0", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118645, "uuid": "659f0c6f-8d16-4e36-8496-1ead0e652765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118645, "uuid": "cf1169a7-c6d2-44a8-9199-d8691879e9b6", "value": "Quotation-Pepper Fuchs- Asia Pte. Ltd..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367f6633-19de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632120272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120272, "uuid": "2a080be8-4fd6-42c4-b389-2bbe95744b15", "comment": "Malware payload (Loki)", "value": "92d6fe0417db34883660b19aff276fbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120272, "uuid": "bbaa69a5-0d6f-4ed7-be17-03bb1f027f5b", "comment": "Malware payload (Loki)", "value": "6c94aaedade1edd06fe15389c0ce3f005af3ebb0fee2b8977def98c79a77e4f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120272, "uuid": "aedffe88-9aef-4489-b135-3eaa14c9b17b", "comment": "Malware payload (Loki)", "value": "8df1e656981475cad7b6227371211b486bde9c90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120272, "uuid": "0df69225-d54c-4766-8673-704b173df590", "comment": "Malware payload (Loki)", "value": "57d40636212758ed35e6818df11fa5be34ce819792e4a6c1f81ae4d01827f2414f564247662983a147b65c4d0817c597", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120272, "uuid": "700187d9-9685-4c9d-9607-2ac5f47bc6b6", "value": "T14D349D20B7A0C035F1F712F859BA83A8A53D7AB19B7491CB62D616FE26346E4DC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120272, "uuid": "6bb1e41a-9d6f-4055-8898-cb0ee63cb22f", "value": "99e1335f3817517f11962dc50cb29aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120272, "uuid": "9292de9d-ef2f-48e6-ba3e-c09d06747a3d", "value": "6144:dvZQZoBXxm5yOhcW5KF8UIKxJ/niqfTKcic8:xZVXs5yOhNLUIgpiIKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632120272, "uuid": "f5ef744b-b17e-4e41-8725-5fe5d8e02941", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632120272, "uuid": "c580636a-9a27-402a-8819-017c37d4eccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120272, "uuid": "d1158712-a49f-448f-a515-ca59951e8143", "value": "92d6fe0417db34883660b19aff276fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f65f2c8-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1632121173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121173, "uuid": "db0f4c7d-2e0f-4c16-9816-736353701be5", "comment": "Malware payload (Socelars)", "value": "61e0ed3cd468c91cd0641939a519c720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121173, "uuid": "c8e892e9-b703-4c7c-afbf-6dd0e5db56f3", "comment": "Malware payload (Socelars)", "value": "6c976231d3a4957256814dcba485579c8b1ae5d31d9e8650db52f1eb5d13e6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121173, "uuid": "44f3a6fd-5bb8-4024-9a7e-c264886e25be", "comment": "Malware payload (Socelars)", "value": "4ce08fff1ffd2c6fa5390eaf3a6a78b7b41e1532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121173, "uuid": "577ed630-3346-49c1-bcf1-800c074771c5", "comment": "Malware payload (Socelars)", "value": "fe35ad46ace205848d538140095fe7cccb1a5ffca4c0494ec93daa3600e3073e5b64c4a1b69e0528c68720f15a24b444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121173, "uuid": "6d73b8e6-3488-4f0f-a351-c41c5f149ecf", "value": "T139659F21F642D036F8E300B385FE877E9D68B625031494D7E3C41D699E61AE27A3B71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121173, "uuid": "287db464-9eff-4cc5-ba95-2e233ed9fc63", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121173, "uuid": "da037d1e-64c4-4e56-8e8d-e202488ff685", "value": "24576:HIVFA1pqtg/TnMbX0lwyh0FVmEByU1fwFYyOs6bQCH6S8q4AQ8Yfwv:mFA1pvTMbOwa0TmYpMYEQNH6S8cQ8Y4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121173, "uuid": "11b356e6-863b-4018-82f4-365c1b91a5b0", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121173, "uuid": "4fc42d88-5f2a-40e0-9ac4-84b8020f011c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121173, "uuid": "b93fceb1-4d49-4522-bf55-ec2d04925070", "value": "61e0ed3cd468c91cd0641939a519c720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f674e91-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632160606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160606, "uuid": "d8b6835b-c5e7-4450-a25a-aeef595c5836", "comment": "Malware payload (CobaltStrike)", "value": "43894eba5c6a9c7048ddad4ca301bafc", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160606, "uuid": "2b7fc3d2-b93d-432a-a14b-cdf59be38ce8", "comment": "Malware payload (CobaltStrike)", "value": "6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160606, "uuid": "d71dd039-4128-4df1-892a-d4a9934f5ba4", "comment": "Malware payload (CobaltStrike)", "value": "1b39f54af5933b12a8339d62d13a7e96c78d0f8c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160606, "uuid": "92ed0d99-d2b4-4255-815c-daa42cc8b544", "comment": "Malware payload (CobaltStrike)", "value": "ff24ad49854bc6a23a987b4928daf0519aa198048194d95d522775a57dbef0ad9d166d8ccec5b9d6ea2b3dbb6abd69f7", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160606, "uuid": "822fe384-7c97-439c-91d6-19a646d8b0cf", "value": "T1F6264B03F89150EDE0AED230C6A6D252BA71B8944B3023D72F51EBB52B76FD46E79311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160606, "uuid": "aa07a6aa-2d2f-4dd3-a129-3b6284153ad3", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160606, "uuid": "57368b70-9f08-4dd2-a29d-6b0e2e7446be", "value": "49152:Ned6m8aawXkXTrb/TXvO90dL3BmAFd4A64nsfJjsCymBs6j8l7bbxsHKsM3/dHwA:NedfaW/ajp3r0vuwU3PCVR8n0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160606, "uuid": "aca684eb-68cf-4632-ac81-fdbca4c0fabd", "value": 4592640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160606, "uuid": "be703df7-98b7-4db4-ac3a-06a3d6df1e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160606, "uuid": "fc7dd97f-0a57-45b8-a3f8-d502a6639587", "value": "43894eba5c6a9c7048ddad4ca301bafc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140f65c8-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632115920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115920, "uuid": "c93048f4-985d-427f-804a-887ba547c876", "comment": "Malware payload (SnakeKeylogger)", "value": "92225a7d9753f20e5a5a1f32eea02424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115920, "uuid": "5c80f7a6-0b4e-483f-be62-3d10ee75fb84", "comment": "Malware payload (SnakeKeylogger)", "value": "6cda0c998a3484125f71a4c086e2652a72c977d90ff4e187a5dae1d62239f31e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115920, "uuid": "c977abd3-30a4-446f-9035-7d8ddeeab676", "comment": "Malware payload (SnakeKeylogger)", "value": "57768fe217861ca7c28bd2be516706f8f94a823d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115920, "uuid": "16ea3426-48c3-47f5-ac69-dbf0f3b1bf46", "comment": "Malware payload (SnakeKeylogger)", "value": "1dd8d49efc4b27c356e62b32c530ca4c282e9514f9aa778698e6e53335fc4f1d09e1c3f28c3639f05898335b04868ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115920, "uuid": "46c789cb-5202-444d-b532-595cbe1d16c8", "value": "T10BF4CF202264C26AE1FBF738C47294718B7EFA86A076C65E5DC3D8DA0D25341851BF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115920, "uuid": "8b425ed3-e36b-41aa-99cc-9166f09c1d0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115920, "uuid": "b0f9f560-5e2a-47d1-8366-aebdd2b7c83a", "value": "12288:hBGiY6HvFuowt6S2KYsMtygMzhp5SKGN2J6tJ3Po9mtiK5oetg:hA6PFu36hNyLzBYN2J6tJ3Pe+FoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115920, "uuid": "bc5f0050-3b49-419f-9a12-6b0933ba85f7", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115920, "uuid": "82740695-ca84-476a-8c66-57bc8cbe16c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115920, "uuid": "acd4cbeb-45c0-413c-83bf-ce1f120ef902", "value": "Swift USD5,963.00..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb8bdc3-19cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632114059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114059, "uuid": "776643db-9538-4aec-bc61-468ad78a035c", "comment": "Malware payload (Mirai)", "value": "be758aa064cc02c231a0841745ac7f74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114059, "uuid": "ccbcb9de-8745-4d09-af78-972617f46db0", "comment": "Malware payload (Mirai)", "value": "6d2adf7be043bcffb659b467820d21b2255ee22b1c81fcc534d5ef83943861ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114059, "uuid": "e208df3e-445b-4a78-9b84-737b5dcf7ff4", "comment": "Malware payload (Mirai)", "value": "4ed97db8695fd67cfaa6d2f67318da21b8064350", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114059, "uuid": "bfd2b526-f929-4322-b253-a0866e6060ec", "comment": "Malware payload (Mirai)", "value": "ea328c13a209d1b27799582f3ac9341ca19eea429387e7d7c32b3bc9ceff39970a1ac1ea29140516bbaf5caa775a742b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114059, "uuid": "ecdca88e-1fc3-4322-9cfb-0b299f24f9ec", "value": "T17764F2CAFF11BC3AE984067539AB074DB3B4DA86C3C7E090F2D4C55E3CA9685AB611D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114059, "uuid": "e0722960-35ce-49d4-b352-dc2f16eddb91", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiobPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSi3PqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632114059, "uuid": "fbc2dfbc-f8c7-4581-a0c6-5c002e0c405a", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632114059, "uuid": "c84e8c76-206d-4dd1-a4d4-c30fe7459998", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114059, "uuid": "50532b9d-03ef-492e-bc17-852e2cff8e9b", "value": "be758aa064cc02c231a0841745ac7f74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc97f8b-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125167, "uuid": "53243dd8-6acd-47c5-b432-337e0eca6876", "comment": "Malware payload (Dridex)", "value": "9dcd7754ead2226c1f29abab98e16948", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125167, "uuid": "ee678d39-84ce-4b86-98c1-9c51c22d42c2", "comment": "Malware payload (Dridex)", "value": "6d48b495cbcc1d7e5313765f1adb4ea21f0fe0aed8769bf63d9dc25c7ffc7449", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125167, "uuid": "a5d72ccc-356c-4521-a2ec-64657e87dded", "comment": "Malware payload (Dridex)", "value": "1687c4c6ff1810a9d9f0bb42a0874b78bee1a6f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125167, "uuid": "436be5f4-d781-4c36-8411-24030070bda8", "comment": "Malware payload (Dridex)", "value": "4c7c1e3b1ba7eebf13beda99f418dc0fb2d90cc26fb6317bd2dc33a6bb9de2f352ebeb90346eaa717a0193764d442a32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125167, "uuid": "22d3f819-cbeb-4dbb-8fdf-df6d1c5e9b3a", "value": "T1F1A5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125167, "uuid": "be1820bf-ad67-4cb1-b951-d6f98f560e8f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125167, "uuid": "672eb28b-264d-4020-ad9e-69a33cd1d9d7", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125167, "uuid": "f988db71-b9bb-499b-8d5e-ecbcd10242d7", "value": 2146304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125167, "uuid": "73af9ea1-1311-4eb1-97b4-ce716d0f9c5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125167, "uuid": "bca79c43-6304-477d-9236-795a16916113", "value": "6d48b495cbcc1d7e5313765f1adb4ea21f0fe0aed8769bf63d9dc25c7ffc7449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10c489b-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125176, "uuid": "fcbb43b3-811e-4acd-a9ce-32b65cff196b", "comment": "Malware payload (Dridex)", "value": "758e7a7e010c68616d056d6b3b300cef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125176, "uuid": "6acf33ce-83d9-4942-9e21-20c93fcc4bed", "comment": "Malware payload (Dridex)", "value": "6fc9b14196e1fc24059c0f5eb940fe5c2f08b2ccee9e3f6fca5f744afb255b01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125176, "uuid": "37c906e7-6966-423f-a7d0-1dfca657fdb2", "comment": "Malware payload (Dridex)", "value": "3371e28a4381324d222e23599ce3f467abbceaa8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125176, "uuid": "2b089eac-0cae-4500-8cc0-63cf009e8bff", "comment": "Malware payload (Dridex)", "value": "e0b385c22bd8bee35c3a302630db4ac66c5a2c6947188dda831c9f67388d123d0e6053872836e4565ee29f8ae4560831", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125176, "uuid": "4260b06e-6e24-4703-9afd-d836392586af", "value": "T13795D020EE69E1E6C6B89F3E9408352727B93D75110D608CC392704F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125176, "uuid": "430ce79b-2dfb-4a5a-ab26-118f72a4f675", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125176, "uuid": "c812b8f9-47a9-486e-afb3-9d58584ec1bd", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125176, "uuid": "4a59f4cc-37f4-4ee9-89f4-d753947d818a", "value": 1994752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125176, "uuid": "ba94ccad-a22a-4fe5-98ef-6f1bdf1f25dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125176, "uuid": "88239ab1-5da0-401c-a101-8a3f10d8aa0e", "value": "6fc9b14196e1fc24059c0f5eb940fe5c2f08b2ccee9e3f6fca5f744afb255b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d3d0e1-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632143459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143459, "uuid": "b2479bbf-4d91-41e5-8dfc-50c004715267", "comment": "Malware payload (RaccoonStealer)", "value": "28ea220f0c8f906c66e1ab5657ca0260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143459, "uuid": "02a3cdb9-915e-4432-900e-2b1e005c42a2", "comment": "Malware payload (RaccoonStealer)", "value": "71bbaf19229855f0bfdebbe93d12b5f5fac6c0b542b5ca3b5a00d4b088ccdadc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143459, "uuid": "8f1d2041-e325-483a-90ff-6bc4fa8ffcbc", "comment": "Malware payload (RaccoonStealer)", "value": "04d158591858f17abd9295f481c26ae7ef771e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143459, "uuid": "991527e0-c1f5-4ffe-9510-8abfc862c30c", "comment": "Malware payload (RaccoonStealer)", "value": "9165359888d446c544ee1b0945269b30d226f32b20175e90417985ed55acca72fb7671bdf60ee2e040d63b274a75beb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143459, "uuid": "51f14bfd-8bc2-420b-a708-dc2509abcca1", "value": "T1D0448D20A690F035E5B31EF44ABA83E8A42D7D716B2051CB62EE67EE563C6D4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143459, "uuid": "faa3569b-b3cb-4452-941a-aa2ae7255d0d", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143459, "uuid": "76391e1c-a831-4fcd-9663-b29ac997b14e", "value": "6144:5p7QfPWyR02IU+riqyQS6pUA28NRkkIPQ2Q95OsO:3MtR02b+rcP6pUANokIPQpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143459, "uuid": "07213885-e0c9-4a8e-90f8-e717bb77dfa2", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143459, "uuid": "d9ac2b2a-957f-4c69-a20e-83201019fcda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143459, "uuid": "0af102ec-d1dd-4261-b067-3f54b42fd7ed", "value": "28ea220f0c8f906c66e1ab5657ca0260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deea197e-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632151908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151908, "uuid": "91527bff-7235-4cf2-b337-52f80634d959", "comment": "Malware payload (Formbook)", "value": "4b6fdc338b9e1f8a36d3b8ea8a68f67e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151908, "uuid": "a4092df7-d42d-4aae-b247-9f4892df44ed", "comment": "Malware payload (Formbook)", "value": "71daa9884b21d0a6095f598372981a15db45bd10788189a58e89828daaec09c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151908, "uuid": "86140389-48dd-4b21-b089-a7b3a11949ec", "comment": "Malware payload (Formbook)", "value": "ecb274dc5a448874aa52aadd502319b47bcd2a80", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151908, "uuid": "9faa59da-5822-4a91-aed7-243f3b8964a7", "comment": "Malware payload (Formbook)", "value": "aaa5115253b242d2e579ec9d47be318d7fd73779c202973e258f90b334ee95b70d1853236b39bb1dc71c178d9b53236e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151908, "uuid": "dd543e6e-dd09-4794-ab58-36c9afba0a18", "value": "T119D4E0C7A9F8CF9DEBA28B3501D98C8685B55CC84B0AE9E32E517551F2FCDF00D92462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151908, "uuid": "94ac8944-88c2-473c-8550-b5b36eb44fa4", "value": "12288:P2fL3gzujsYp+Xjytdwdhp9aSysjHjbxfYiBNMutwRSfZNzhL:PA3gzZXmtdwrp8jijxnnMawRKNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151908, "uuid": "8fc0e8bd-22a5-45ea-9a9d-a1868a9b36b7", "value": 602072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151908, "uuid": "f9d97f2e-a4f9-47e3-85a0-222bfe48bc04", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151908, "uuid": "ded321fe-19cf-47a8-999c-8896478cd80f", "value": "LSP18048.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3902572-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632151862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151862, "uuid": "89ca7e8c-80a3-448b-b74c-d500a82ddc9e", "comment": "Malware payload (AgentTesla)", "value": "206a6e1ca128482e77aad3d9334dac50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151862, "uuid": "be25ea3c-092e-4c40-8f5b-6dee40c3b9f9", "comment": "Malware payload (AgentTesla)", "value": "7269b0b91d4a27d01afff5dc6221205193c7275bfea4b30c66261bf1cfa72488", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151862, "uuid": "7ca62f7b-2d8e-4ff1-9b6a-47e924e1c273", "comment": "Malware payload (AgentTesla)", "value": "070825ad95f2c9c227e434e874486998a0bfb55e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151862, "uuid": "8f22656a-e815-4086-8785-0e811b6bc591", "comment": "Malware payload (AgentTesla)", "value": "002a639b4b25a7427181253d4a0289820d8f878476afcfd3787a38a063f13623c17e6b0a02da699015040b2320246164", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151862, "uuid": "8ff236a9-06ee-483a-8d9f-566e5ae46b7e", "value": "T1B5D4027839090ADAF0DC51388638911D6D6F7D5BC5FAD62708FAFBA8B4B360D85106CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151862, "uuid": "aa52924e-4e62-4a59-8e81-390a6bb35a26", "value": "12288:aC7D4E/GJh/cGN4kJuzVNW0Gypgpl2Jw9d40VdSBgZR:adrjLyjzz2e06s4kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151862, "uuid": "8112afa3-b6e7-47fe-8b8a-3da8e82cc185", "value": 601928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151862, "uuid": "8a06112d-add0-4e86-b46c-a6fc1c585ae8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151862, "uuid": "ea557aa2-a335-4a8f-a18b-95085f295b4a", "value": "New_order-3452.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4529928-1a08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632138549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138549, "uuid": "5bb4616e-24d0-489d-81f1-956fd3657729", "comment": "Malware payload (AgentTesla)", "value": "b1568e9e4fb2da868a024791ae7a83f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138549, "uuid": "7fc2781a-dee1-4575-80cc-824fb29a146b", "comment": "Malware payload (AgentTesla)", "value": "733c3892688347a33e76eb41cad96d9cb4ad587ac941a600e37834fcf1af0b08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138549, "uuid": "fd5d6c20-397a-4199-a053-5fbf6d5f7274", "comment": "Malware payload (AgentTesla)", "value": "550253943375e6ece1bf7130a9cdf0ab49a64183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138549, "uuid": "860863aa-6271-4241-843a-e229cb3e30e8", "comment": "Malware payload (AgentTesla)", "value": "923e837ab0e3b83f3cfa9a967e67ce93d62ce31ff1e374ddfd19c0d4ecf287ca715cd6aa5cc64cfcd0dcb1783334b557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138549, "uuid": "6802a3c6-bb1a-461a-888e-9538e1b68341", "value": "T1B2521EBCD45706A88F866BB8272BAF45158C766DF784A133327C9B316BD2D3B411283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138549, "uuid": "f35dc2ef-2d7b-4f08-8195-52973ab529d1", "value": "384:mhJsVl8vInftz2yRfNBL66OwQ1FGRPIzNifoXSOl5:kEjVJNBL66OB2wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138549, "uuid": "574771a4-0568-46dc-a48b-0f68f9e701f5", "value": 14340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138549, "uuid": "efa00635-c2bc-41b1-b321-98c16ce127fc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138549, "uuid": "5213b0e4-7be0-4d3d-baa4-07347875cf93", "value": "New ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b51679b-1a11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632142346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142346, "uuid": "0b6262a2-7fac-40c7-b893-0c29fcaecb09", "comment": "Malware payload (Loki)", "value": "5fd8e545bda0123675a478ac499b50ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142346, "uuid": "72cb8a1c-b449-471a-a941-58147656ac02", "comment": "Malware payload (Loki)", "value": "74a0e30d9a47daaba3c323aeb4e5390cd8e7ceff06bf68a2c875b804bcaa0cab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142346, "uuid": "fe2e6601-4978-4e7e-b325-a8d0fc971e72", "comment": "Malware payload (Loki)", "value": "1d94302e308df3ee5f14c2c7d6d634ae4540aacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142346, "uuid": "4fac3d29-f3fe-4131-ab59-0363f7b1fa08", "comment": "Malware payload (Loki)", "value": "f8711ce4e3cd48000242182ffa58b501e2ede8960d90eebe1fbf142c261559dd9e861609b7169f1018a85a458c0f2d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142346, "uuid": "3a551521-774a-4022-944d-86036aef51e0", "value": "T128C1D706A7D8832BE8B70B382C7357409278BF61D963DF6D3AD8411E9E167449922B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142346, "uuid": "03862e90-c748-4c06-b60f-a3522e0b696b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142346, "uuid": "69a8040a-164d-4bc4-8095-4e904bc1ba68", "value": "96:c8N4z5XkvjP6jZ1+w2bzgKG9F91VWzNt:7yZwrG9F9Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142346, "uuid": "0a9eacca-525e-4211-a548-04f27446c435", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142346, "uuid": "6acae350-8d6e-499a-93cc-c610333d8a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142346, "uuid": "fd03d0fb-e2fd-46c9-9646-dc9e1cde0703", "value": "cotizaci\u00f3n.pdf______________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c3578c-1a10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632141739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141739, "uuid": "15e49f85-c1fc-44ec-bbc0-c0bf9c66157e", "comment": "Malware payload (AgentTesla)", "value": "d685e4aacc57eae515e7539d74dbd458", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141739, "uuid": "a9b2fb60-a086-4838-a799-4107fbaba569", "comment": "Malware payload (AgentTesla)", "value": "7515993451f1172b406b817567273a8b047cdbc39746fad4a38b64bfd9024af9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141739, "uuid": "2d1d5c16-6c7f-4ba1-bd7d-8be185505cd0", "comment": "Malware payload (AgentTesla)", "value": "eed435c0d381b9521fa3c4a187842112a2b5ec9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632141739, "uuid": "2db4a23a-b818-452f-9bec-8cec6d12d6ea", "comment": "Malware payload (AgentTesla)", "value": "3dc07409d78ee8da718b0e5bbb1334d703ba5a8d97236c7d2f0d2dddbaaf300f4a8b0e6d0d92423a22a0737960b60b2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141739, "uuid": "2220eb54-922e-4544-90e2-d4a11391f458", "value": "T15DB46C85EE8166E0CC29D375293BCC355B27ADAE64B4641C25CA3B333FB7A630036597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141739, "uuid": "196dd672-e808-40e0-bd37-30d34b317d88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141739, "uuid": "26c348e0-30c3-4d4f-854f-09c8044dc8c9", "value": "12288:l//f+i75l2no4kCyFgw1kUknUHoe84Eto7uoppvppMkkkkkkkkkkkkkkkkkkkkkF:l/Oo376WWN+65n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632141739, "uuid": "f92c1497-f611-4bc8-8835-e5d982809301", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632141739, "uuid": "b2cfdab2-a39f-4d19-8708-9eb5e12be4f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632141739, "uuid": "3dabe454-bf3b-4ba3-a64e-3e55eb9ec9d5", "value": "PURCHASE ORDER SEPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f70f92-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125352, "uuid": "2803c93e-48ae-4468-b5ae-f474ebe371c4", "comment": "Malware payload (Dridex)", "value": "34b31232c7d6c6e346fc7ef8a7c31d9b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125352, "uuid": "9c0f3b83-2e5c-4faa-8275-ffeae67e1d21", "comment": "Malware payload (Dridex)", "value": "7685d1666ad12e9bdd0a26459a9d0c8db65ad1f391661496b3a9ebad1854a2f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125352, "uuid": "f63a0a8b-907d-4dc6-a32a-da29a695e4f0", "comment": "Malware payload (Dridex)", "value": "291564dfd797b46e1d35914f74c5cb9e64a3339b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125352, "uuid": "88afd0b5-98a3-43d9-abc9-586e8e209661", "comment": "Malware payload (Dridex)", "value": "f7761d10c07597f5e2e358f78b70598773ea3b1e11b701779d0c178ad9dcd8ef850feb91001ab23c99d1003d9460f435", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125352, "uuid": "c350a99f-4f98-4b52-9037-10aba96f2316", "value": "T13BA5D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392708F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125352, "uuid": "2dab6e1f-83a8-4cfb-be81-9df4945fa5f5", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125352, "uuid": "3c4638b6-0477-4421-9f73-e2a616256069", "value": "12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:efP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125352, "uuid": "4120e798-4b6c-4be4-9af5-24d9f3943e40", "value": 2080768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125352, "uuid": "144ffb95-e835-457c-bf88-a244abef4fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125352, "uuid": "04f588d5-3ed8-4650-9229-7b63e1479667", "value": "7685d1666ad12e9bdd0a26459a9d0c8db65ad1f391661496b3a9ebad1854a2f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2978c2e8-19e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632124116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124116, "uuid": "788e099f-32d4-40f6-9fb8-75619a2fccbe", "comment": "Malware payload (AgentTesla)", "value": "c79414ada26ea70641250adc0c990cbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124116, "uuid": "92380aae-99cb-4efc-9cc9-25bc13e98d09", "comment": "Malware payload (AgentTesla)", "value": "775d59572b5c5bdeefcef317127062a9f14f7ab8984834ce1469c750fc3521d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124116, "uuid": "91829004-68c3-482f-aae7-32ebffb44cb8", "comment": "Malware payload (AgentTesla)", "value": "de39415423284094a26cf1ef71c4d26bca28930e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632124116, "uuid": "7e8516c1-8b5b-4b7f-8de9-792d389fab22", "comment": "Malware payload (AgentTesla)", "value": "4c4b43271d31e156bf68094970b5d7deb65d87117ab32d9a4cfce5a22c3606a040bcdfe34e0b24798ab20c8ebeacacf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124116, "uuid": "e287c435-7449-4806-97c4-6aeed1b85d65", "value": "T1FBA4E6BBC13BBCD0D6F214B05742AE56462D93EC13C0B26127ED6169F702A6792ECBC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124116, "uuid": "80ae26dd-ea5b-40d8-a19d-eaded3e09b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124116, "uuid": "f86cf890-a88b-4512-af37-c8d334d32c97", "value": "12288:1v4ug2WsHMzNptuC4MT00x00000AA000M00a00000AG000E000P00000U000H00G:1v4ug2fsjtuCF00x00000AA000M00a0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632124116, "uuid": "5f1f6750-9867-4600-aab5-0f4de0f44d78", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632124116, "uuid": "aba8c8d4-63e0-482a-a347-eedda43f973e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632124116, "uuid": "a8a610fc-d6c6-4a27-bcb9-64619bceae81", "value": "new order NO002984844 dated 20212009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcd429e-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632143639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143639, "uuid": "44442284-6c8f-49bd-9749-9e7f214e4eaf", "comment": "Malware payload (AgentTesla)", "value": "e9f8fbcc5372fe37012b5950e910ecaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143639, "uuid": "1ad4a751-ee1e-423d-9c19-a0bf1c3e0a0c", "comment": "Malware payload (AgentTesla)", "value": "7793b31c7e3372f04cd305e2a98b7a51505c7ed2bd14c11b9498b019363637c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143639, "uuid": "34ee67ce-d863-4da9-a8e9-ae6c0c1a6ff7", "comment": "Malware payload (AgentTesla)", "value": "f4ba3666a6409813270966688c7ba964778ffdbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143639, "uuid": "df5044bf-dd15-4720-9e5b-5f0a33194844", "comment": "Malware payload (AgentTesla)", "value": "6855e19e62a76561ef6b117cf3a5e8005364e8d13d50db3b54710cd581861178d8ad4a173f5f1277d74fecc21a97bba1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143639, "uuid": "32806c1c-d880-4855-89d1-7621a6c2fd35", "value": "T16105AEC13D47D89BF4DF2AB3986FC42011656E9D9161C73E26827A2B65F3312309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143639, "uuid": "d8b5673b-49f2-476e-92bd-6f3750d65ea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143639, "uuid": "9e8066b0-1a5f-44d9-ac68-901c2b5cd4fc", "value": "12288:w5MTdVGhMQOsmtiK5oyZD71UQEkK1eVRfbWCVbEaQcL9Xoxc4j66ONqBO:vU+FoqGxcDfbW2bXp9CuNNoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143639, "uuid": "e044b2c6-e34c-45c3-ba8c-40cec696c094", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143639, "uuid": "50b587b6-f569-4794-a9f8-3878f34f9bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143639, "uuid": "e0b07a3e-ed43-4a0d-8001-22ceb7e59ee5", "value": "Invoice for Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f933aca8-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632145510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145510, "uuid": "b09e923f-302c-4d1c-a8a3-2662a93769f6", "comment": "Malware payload", "value": "767b9f2fb9504525cf9f3d098ab01c6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145510, "uuid": "691d692b-3dd6-4f46-8207-1c94267c0d56", "comment": "Malware payload", "value": "77b23ed0b2f90e1a69e77c3ae7b9a9d8b93402bee72c2e20f7258438da0a4770", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145510, "uuid": "25c973e1-c54e-4638-b8a2-f002f4015b0b", "comment": "Malware payload", "value": "492af795c59f2ee7a0fd484bf618596e0a3a38af", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145510, "uuid": "1e5fb12e-6729-451a-b0f7-c53a5267fff9", "comment": "Malware payload", "value": "0c49e3277eaf0d817eee7c567f6924f25b2b9a269c0d27fcd8532eb14b534cbdb1d816a9773826156d5438402dd1ec0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145510, "uuid": "5b7f0310-a95f-4ae3-9b2c-e089ac933a44", "value": "T12E31998ED909C0695B323395961E4605C9D7018F660DD2413A7ECE8CBF3126069FAEB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145510, "uuid": "bdcfbcf7-1858-4636-9c6f-dce154ed620e", "value": "24:P5H9/+fbMVuHPLeVuxJEbelVQM/DE0tA8EqaS5Da/LOgcKBLAKzdAvBZDs:xH9eMY6MECln/DZ4bAEav7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145510, "uuid": "5fb5487b-841c-49f2-a179-cec858e8472d", "value": 1533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145510, "uuid": "0451d9e2-8ef0-421f-9326-e391c23132a8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145510, "uuid": "4099734b-9cc6-4531-80a5-74918df13bed", "value": "Compliance_reasons_DTD_20_09_2021_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d39a55-1a00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632135055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135055, "uuid": "2ce5df33-dc21-4183-a5e8-c49a19f91a73", "comment": "Malware payload (NanoCore)", "value": "c1239a6855c7eb75bc6fff12bc385153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135055, "uuid": "cb4f8382-8642-46fd-bf13-444163ef444d", "comment": "Malware payload (NanoCore)", "value": "77ceacf80289217a84f8087f070a6955a4be5a93f4c79fc95ff142533f02d403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135055, "uuid": "6e2d5f51-cba0-4f8e-8383-308184e35b14", "comment": "Malware payload (NanoCore)", "value": "c72ae4b3fe9f163fb10c2ae2ec8c016d267d4ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135055, "uuid": "c289ea32-24cb-498e-8a97-2f54442a1bac", "comment": "Malware payload (NanoCore)", "value": "7273bd36b22db5f8024e729c1fc20bfc9ea11ef96ecf12cb54f41566e1c60ad7492b883729e5e6cebdf09d5529ce44fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135055, "uuid": "df29d296-b78f-4453-917d-9788b9915ec3", "value": "T1BD152313B9DD0032E1E194341EFA3952F9B8F938B87AF50AD7A4141EBDB56D1C02A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135055, "uuid": "a090cf72-8934-438b-8561-c24c8784442e", "value": "3c98c11017e670673be70ad841ea9c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135055, "uuid": "6e03254f-0a81-4ee5-83d5-5d41d3cbcde0", "value": "24576:f2O/Gl87j1u1xJ2Z6JKFZPCwmxhKbH3rUO46GV:N1u1SZ3PCwmxUT3id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632135055, "uuid": "b10e4c37-e474-4f49-b91c-e0b9f3e88191", "value": 930558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632135055, "uuid": "6886afe4-0213-4ddf-a0f8-6e2a23164a3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135055, "uuid": "e7286bfa-c5b6-4e29-bc22-b9c4e7025295", "value": "77CEACF80289217A84F8087F070A6955A4BE5A93F4C79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c80f69-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632148777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148777, "uuid": "0116ed99-4b3d-4265-bade-f4f7795374cb", "comment": "Malware payload", "value": "24ba235be1ff38f4c05ce1f452d0b56b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148777, "uuid": "66d52216-042f-4073-8e03-521b2f5fa791", "comment": "Malware payload", "value": "77fd56f76947901253d1da7c3f8ef11fd75be3d4cde139302e74fee490e63b24", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148777, "uuid": "f65358c8-4634-4a1e-af3d-3ca08f715677", "comment": "Malware payload", "value": "ebc585f8730162539e3769cdfcad9f00a6c98ad7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148777, "uuid": "4716df5b-10a7-40c1-8383-82104409b090", "comment": "Malware payload", "value": "a8a22bc96a407c5a869097dbd4adee5fc76b1ab8caddebabd01040a0a62a42bd97843936778d6a5821cc113f1972f823", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148777, "uuid": "f0948045-195e-4564-a678-57ee0597fd0a", "value": "T10FB4239C1EB677674CEB2B3530DD51EA8628D3B99CC31A6EF80E77BA483293055502F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148777, "uuid": "0b58156d-fdf4-4f9b-84eb-de5d7c79f946", "value": "12288:bmrF2VUj/AnpFD5dMem0r5/9+9umrFzwiCkaeZUos9O0lJkGq:ih2Sj/e5dMefo9hxzENeZUos9O0lNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148777, "uuid": "ab93e613-8195-4f82-a592-3640ac7639ee", "value": 510887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148777, "uuid": "9f09866c-eddc-4fe4-9429-9f5712df2d97", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148777, "uuid": "64cd9640-12c6-4cd1-804d-76bc3fab41e2", "value": "BALANCE CONFIRMATION AS ON 31.03.21.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875f3749-1a02-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632135870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135870, "uuid": "743ac0c3-83a7-4a13-8c6b-92aeb23c86e8", "comment": "Malware payload (Formbook)", "value": "93f117ea1f6e392f15d38b9968b3ce74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135870, "uuid": "d8540593-ce5f-4051-99f9-26a11441038f", "comment": "Malware payload (Formbook)", "value": "7811bd14cb7fe9de30afeb44ca4d2f009e0e5f0488ad07f282ad0327b4ecd0b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135870, "uuid": "758ec44f-a428-4b61-8345-de0e36c57f5e", "comment": "Malware payload (Formbook)", "value": "2b327374dfb4e49ba276598c27be4d6d4cba2d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135870, "uuid": "1ef36ee6-e50c-4c27-9993-4f942143600f", "comment": "Malware payload (Formbook)", "value": "3ef1729a4c065013baee440fed2d79ca75052e8922643960012f646c7481bd78d572479001097810d7a3157362c27ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135870, "uuid": "78d6ce44-58a0-4ad0-80c5-e5f216ff4299", "value": "T13974BFC67BB05852DE04D63DC32E6F15A92B2F746BE0A10BD6417873ABF36CD0817A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135870, "uuid": "e23c2bb2-fb8e-4f14-bf5e-ce39c3233a96", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135870, "uuid": "6c9664d9-3895-4a61-b782-ab367c6da220", "value": "6144:78LxBAz+3meeKNf59pCoappIO+QUUM+lFLGeeWFS7bvI2TGWJkvLDXT:mmeeKr95yO6zDWI2TGkkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632135870, "uuid": "998db280-4abd-4995-8c0b-3bde9d7c9b8e", "value": 346456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632135870, "uuid": "58f940c5-c7e0-4cbd-bc81-ab93c9ac28b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135870, "uuid": "f26eccdc-4d73-4c52-82b6-51f773550cc5", "value": "2T65434568--9876543457890-87654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f8174d-19d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632115364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115364, "uuid": "1390c77f-d0fe-4a43-b61b-2750565f02fe", "comment": "Malware payload (AgentTesla)", "value": "cfd1e41ac76ba01ee3db4f9679ee2b16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115364, "uuid": "163c59af-1e35-4fb3-bdba-07f9c3d9f75c", "comment": "Malware payload (AgentTesla)", "value": "78db50e8cd5d962b6b80d5b97895189f8fdc97fbcb68c6ab5bd6afa2884ad405", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115364, "uuid": "6f24a2f2-20c5-4b2f-b8b7-544b36bedab1", "comment": "Malware payload (AgentTesla)", "value": "e7d26153a7f78b15c0dcfa81dedab0e4d99f69ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115364, "uuid": "06994e84-c48b-4c03-a05e-49374566f323", "comment": "Malware payload (AgentTesla)", "value": "fdd172f8736e5a13b3b3665f59f39714041aecb2ba5db76081b8f5eb65e81b7e7322db8cefa9f0c56c0cfdb64314cdfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115364, "uuid": "967533fe-6c1d-4fbb-a45b-22912e304df0", "value": "T17A55EE298D2682F7C7EEC23CD05C4F9EDB62AC837A618F0E9881B6D6167770BD18445D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115364, "uuid": "b6608c9c-f8d9-4f75-a191-16854e24e52c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115364, "uuid": "d5f04b86-6305-4dad-8a0d-137e47a4e5a2", "value": "12288:R3mVngS4pSdwhHuOjneHL3CjgTN8FwN/ChGfP7r9r/+ppppppppppppppppppppt:R3mVspBhHuOjeHL39NFUhe1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115364, "uuid": "ca41cc0c-c04c-43a5-94f9-e4617ff583a4", "value": 1336832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115364, "uuid": "5ebc80fc-8a71-448f-93af-49e5e314a692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115364, "uuid": "d4d9db6f-2a71-412a-8f33-3225e66d4268", "value": "UPDATED e-STATEMENT..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f0d544-19f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1632130333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130333, "uuid": "4c8a876b-598e-4518-a700-9fed78248ca6", "comment": "Malware payload (AZORult)", "value": "d046795e2a50ecdeedb65a1d321bad34", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130333, "uuid": "5e99e733-52ec-4cd9-84f9-0e0ab192db2a", "comment": "Malware payload (AZORult)", "value": "79a6964806cf9e832360392ab362f4d8017952a270aefa427e66dd418772bc6b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130333, "uuid": "f7d79fe4-cbe0-4fd1-84bb-a077ded2df48", "comment": "Malware payload (AZORult)", "value": "ac8e024386210a8e017594cdab9d8cce2dd4233b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130333, "uuid": "0867344d-7b93-4aab-b989-00d9a794948e", "comment": "Malware payload (AZORult)", "value": "096eaa824309faee812c3e1c1e241b95644b74f55bff54728a3899e63a3908a4a4cbbda386d65e21d51fa985ec61c4f3", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130333, "uuid": "5f18f21a-3b7b-4fb1-9cad-0df7b761214d", "value": "T19F449D20BBA0C035F1F712F859BA83A8A83E7A715B3491CF52D526EE56346E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130333, "uuid": "4ffd563a-ada9-4cbe-9bfd-5b301f7b5fd0", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130333, "uuid": "f34759e6-e782-425b-a2a8-da0d1f98dbde", "value": "6144:PrZQJUF7PHyX/uW/8Fe7ZMOKrX1awn4SgCLrcVm2P8:jZp7PHyX/z57ZMOyFawJcVhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130333, "uuid": "a07d7309-3f2c-470f-9d13-a4fe93ef67ca", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130333, "uuid": "18201143-1f9f-4f76-b6b8-9331efe0cc3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130333, "uuid": "43f2213d-2f5a-47a2-b1b9-9f905f062673", "value": "open_2021-09-20_12-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5511792-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632146309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146309, "uuid": "de75dfac-cc9c-41ff-8c1a-2a328420d998", "comment": "Malware payload (Smoke Loader)", "value": "784bc04a037d426d83f41a0c92b7385c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146309, "uuid": "c95713c7-4fc4-4232-badd-28c26f702704", "comment": "Malware payload (Smoke Loader)", "value": "79bbbbe81ce8c75215649bafbf991dd27d59de74d0ce53b1fd943d380fcfbb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146309, "uuid": "ec206ad1-cf1e-42cd-b01a-73af84f7d9d1", "comment": "Malware payload (Smoke Loader)", "value": "87ff0b0f63a5b82b1687be8cef23e4957aa95d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146309, "uuid": "0c5d901c-ad91-4f4a-a574-a8491bc3dd86", "comment": "Malware payload (Smoke Loader)", "value": "3634ae21866381b141025ca8cf4e9d43875c81d86bd7f4e5c6363ceb5a514ebd8d9f47661c875104b0d0355eff21564c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146309, "uuid": "52ca059c-cc94-43f5-bc06-49f93ca3d785", "value": "T1F8447E20A6E0C035E5BF81F4957A83A8A93D7DB15B3051CF22F22EEE56746E49C32747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146309, "uuid": "d7ef11ef-66d2-4d6b-b0c5-30b56576829c", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146309, "uuid": "460aeba2-84bc-4e65-8851-f8963bbad533", "value": "6144:sL7eX3W+aTTIHWrgqWQScrtjJ2ZLbhx9sdy00FOkeiOscXa8yt:yS5aTT4WrKPetjJWLtHsdy00FOkeiKX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146309, "uuid": "ce16b08b-29c0-44cb-b9a9-185d21cbeebb", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146309, "uuid": "a6f4410b-4553-49b9-991d-1c7198e3fa3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146309, "uuid": "198d451c-2165-453b-b2f5-b034c23ae2e0", "value": "784bc04a037d426d83f41a0c92b7385c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076b43fc-19c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632107738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107738, "uuid": "3f593a4e-b026-4699-baed-74fbf6f5fd6f", "comment": "Malware payload (Smoke Loader)", "value": "a1a084cad3819fe34ba882633e6b45ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107738, "uuid": "0ee6a670-1246-468c-bee7-7baa1690794a", "comment": "Malware payload (Smoke Loader)", "value": "79d1a0d0bd8b5672374ab7c97365a6b0276efc6755900cdbdcdb77019e69457a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107738, "uuid": "4cbab0e4-2768-4fb0-8e1f-3e76226dd326", "comment": "Malware payload (Smoke Loader)", "value": "f515d22105594e0b0b1c26b6ce4558b486b328cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107738, "uuid": "0b2dcb51-e080-43ab-a7d5-f265f94e7815", "comment": "Malware payload (Smoke Loader)", "value": "eac98e5cb74324ed39ff8b4452d25cd1870cd0289df38f252181a7d2e7054b50df1e22ccaa3eabdc7a6e895a125a43b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107738, "uuid": "988b748d-c9de-43af-b4ca-e8e393f2650c", "value": "T10E663320F9C687F5CE827334992C0F7241E5838422265DFB33B8953BED68B5D86A6375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107738, "uuid": "87b3acd7-554f-4dd8-8622-85e63657108d", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107738, "uuid": "6164f4f3-d6f6-4ae3-91e7-4d629d2c9fbd", "value": "196608:xlLUCgRf/loAOQeekvyQecxzHDCWjrtlFQ7/d:xddgReAnkTxzjC4Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632107738, "uuid": "1252f35e-a321-488e-8e5f-173e51cdc89c", "value": 6746510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632107738, "uuid": "b9f9c76f-0e97-4925-8082-aa13af6878f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107738, "uuid": "ff1b92fa-8ce9-40a6-b5db-dd14e3284b4e", "value": "a1a084cad3819fe34ba882633e6b45ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f2fd29-19c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632111066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111066, "uuid": "4733c003-2114-4993-adde-f549ad936d19", "comment": "Malware payload (ArkeiStealer)", "value": "5389b036dc60417f5d0df36e82131b63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111066, "uuid": "d7494c01-9c2c-4936-8c41-3741f67c6925", "comment": "Malware payload (ArkeiStealer)", "value": "79f06415909bec7ef3aff251d728968654f8cc0e4a108f29a606acd5d677ce40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111066, "uuid": "ff50274e-69b3-4ce3-8528-0a877d20dba2", "comment": "Malware payload (ArkeiStealer)", "value": "4e5783866336c1ed8d4b1955d5538ab25e348941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111066, "uuid": "c5aa4401-12ff-4e40-931c-c1c05170d295", "comment": "Malware payload (ArkeiStealer)", "value": "facfd375a53b048973ab30d5fd29fd440f3b101caf2ba6e09ccbebeed83e1cfc075b302068f9878c6ba7552c85c16869", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111066, "uuid": "692c0b00-1907-448a-9319-4106ef0216a4", "value": "T18F65B3A5A90D4873F8AA237516C71D5DEA543F83B06D304F715AB92E39BBBC0F886D04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111066, "uuid": "58dff337-a600-40b8-bea0-7bc9fca7b874", "value": "15cdf6e35545e491e70d9cafb0fc7871", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111066, "uuid": "e790a798-d1e0-435a-be10-c64f5364b5de", "value": "3072:CORDINSkUIWnxw8CmtqvylJ10nkcvryr5dqT0NMdIp2uogBpUDZyL+UoPxwAnjac:Ti+qg0vryiT0NMd+2u/NLGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111066, "uuid": "f9f29f4b-362d-4e80-94b8-a3062f249377", "value": 1428480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111066, "uuid": "eb632470-36f5-4835-8701-7b105a518b63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111066, "uuid": "e4a460da-c5c9-456b-96e8-e0003e806ac5", "value": "5389b036dc60417f5d0df36e82131b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5725789-19d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632114875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114875, "uuid": "f662d079-9a14-4b94-b0c1-fee28f9aebd7", "comment": "Malware payload (NanoCore)", "value": "15a650103f42f58cdca27d4ede145e81", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114875, "uuid": "46520ae4-68d7-4803-a435-5e0d897c0c19", "comment": "Malware payload (NanoCore)", "value": "7b0ffc55f7f00629f1395339b706deec29936dc6ce7168b952f6b3006b62acf3", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114875, "uuid": "3a8b99f8-e059-4ae8-be86-09b9ddb09bb5", "comment": "Malware payload (NanoCore)", "value": "fb2fe15e8985a5f919b80f3e3fbded462beb5594", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114875, "uuid": "5ff887b0-7bd8-4397-8195-f00194046ee6", "comment": "Malware payload (NanoCore)", "value": "19a993a020ab33e3cb99e5022bfc76a91ce16f03d97a136fae91fc7503d3bec3f0fc955f8a816b99e3b25092224a60e8", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114875, "uuid": "0c30f1ec-8ea4-460c-b4be-2d9244fa2ba1", "value": "T1AA45E040BEB49F52E83026B4E77389331266BD5B2031E659359FB5697B7F2C20123E27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114875, "uuid": "cfd6179d-fc4c-4918-ac46-f428350da93e", "value": "12288:29xh89oOZiLav/hSwb1vaRihkYKDqxwrNiFTIJo:2f25imHgggohkE6sTUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632114875, "uuid": "876ee247-d99d-4b72-a79d-cf48d5cda516", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632114875, "uuid": "f1344315-3e6d-41e2-87a9-16815817af27", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114875, "uuid": "ddedb856-8bb1-40ee-9a6f-d9a045d07df0", "value": "19-9-2021.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d737ef6d-19c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632111523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111523, "uuid": "30458118-4576-4b5a-b37d-d764566da453", "comment": "Malware payload (Formbook)", "value": "2fa809111f6953a10bcae39ef3f57aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111523, "uuid": "ea4627a7-7396-4b4a-97b8-2e90cc406e3b", "comment": "Malware payload (Formbook)", "value": "7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111523, "uuid": "bbf2736c-b060-4fd9-a471-2ab57b367d11", "comment": "Malware payload (Formbook)", "value": "9415a9c252e39776162749c9131d96274cd6cac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111523, "uuid": "6eb7eeae-75b7-4be2-b14c-587080ca8ec5", "comment": "Malware payload (Formbook)", "value": "17fdff0ba7a08abb1791deaadae47b22be8f3816c48cb486e4362e84689b82776a9894a35efb11838819d6db5fa49954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111523, "uuid": "fc606ec8-9362-4c04-a2dd-f54cc0cd160a", "value": "T14905C0202264822AE1FBE73CD4629471CB3EB987A036D99E5DC3D5DA0D36341C51BB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111523, "uuid": "1651a504-1132-47cf-81ed-3648cd226dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111523, "uuid": "10f7c38a-4449-4024-9a2e-249eeadaeea8", "value": "12288:DBGiY6HkFug86gomJluiCSGV/OeZksg3ifNiYBKkZTIHmtiK5owFGx:DA6EFuWMluiCSk2etf4YXhIH+Fowe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111523, "uuid": "3476fdc0-f180-4e25-946a-c0a2ab1e1955", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111523, "uuid": "babf9606-aec6-45f1-b6b2-2d4d47b64481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111523, "uuid": "adc9198f-545c-4e2c-8abf-7f24722c932d", "value": "t0ID2yWRERNRIz4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41c8f38-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125181, "uuid": "0d074f74-184e-476c-a016-2bef9a4bd4d6", "comment": "Malware payload (Dridex)", "value": "1168e7a474b9831d1222913287d27088", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125181, "uuid": "b2bd5702-5b1b-44dd-8165-fb2b34850488", "comment": "Malware payload (Dridex)", "value": "7bc178ec11a2f41dc2570ee172918050528ee51a74ac42d19935a012e2842335", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125181, "uuid": "46d31f16-9674-41be-9685-7a861b76c7ee", "comment": "Malware payload (Dridex)", "value": "a9938dc76e206e4128617e50993cee6d9e06dc81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125181, "uuid": "429080d7-1e21-4ee0-9552-287caf11f239", "comment": "Malware payload (Dridex)", "value": "75b6a0b8792016859d352adb049a08056e7e9d285691b7fd8f4cca92073b726f48f3db78dd4ed2e24357d9d8682e0fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125181, "uuid": "19751e6b-e769-4b01-ac2f-a5e39683ab4d", "value": "T13E95D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125181, "uuid": "4169a7ca-fa07-45bf-bc9e-2e455175692b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125181, "uuid": "9d9448bb-ed3f-4ce4-9d7b-73f192737c4a", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125181, "uuid": "cddbf23f-b40b-422f-8024-e1ac6e1232d8", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125181, "uuid": "6fa68ff0-f72a-4bbf-b72a-4092687a918c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125181, "uuid": "f6dcfaa3-1289-4015-936b-704cf823a81e", "value": "7bc178ec11a2f41dc2570ee172918050528ee51a74ac42d19935a012e2842335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab88d80-19ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632113569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113569, "uuid": "8ed1f533-cfdf-43aa-9b51-dfa0e8ec5bd8", "comment": "Malware payload (Loki)", "value": "814ed4cef05e9da8e3cd7f57869c7479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113569, "uuid": "557f8e13-8965-4e8f-a119-f68a0a764bec", "comment": "Malware payload (Loki)", "value": "7cd6d59439d525ccf002e777f2118121cd494a5a6d5de8710298344beaeb6c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113569, "uuid": "b92336cf-e0f7-4a66-b05f-5c16d88dac82", "comment": "Malware payload (Loki)", "value": "dd4237aea107ea25500a070e2121047b79156d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632113569, "uuid": "f9a9f529-acb3-43bb-be3a-c23065b03377", "comment": "Malware payload (Loki)", "value": "1a597b311b67b1b577278a282d81c037872519a5aa5e96ef454a0b9a5f0be70e83f2cf60d6840099a6c548649ef28637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113569, "uuid": "22c78381-8c20-479d-88ab-13ce21e0a0da", "value": "T1BCF4B02422D482DAE0BBA778DC22B471973EB982A036DD5E5DC2D4DA0D35341853BF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113569, "uuid": "06724678-b706-4b4f-85d9-5c299739d772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113569, "uuid": "177370d9-1095-41c5-b1eb-5a8c20f57a11", "value": "12288:hBGiY6H4FudUg36Ov0wBqGfNsuDO6YmKkR902AU0WAYkcbItmtiK5o3mR:hA6YFudEmhuuQXkf7AU0WAMbE+Fo3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632113569, "uuid": "58b4f252-173c-493a-8d42-06bb985fcc71", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632113569, "uuid": "5a3a8812-21ba-4af7-8885-af633687792f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632113569, "uuid": "cf855de6-be7b-4ecf-877b-14e2a43fb616", "value": "oOxgzVaToDnIEQ8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd663bf-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632160550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160550, "uuid": "bf2e2106-7c76-495b-8a0d-f8de6c4da03e", "comment": "Malware payload (ArkeiStealer)", "value": "b3b92939fc7f619e94d6b3b43aa0104a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160550, "uuid": "cdeed240-5cef-4f63-b820-d942794c58bc", "comment": "Malware payload (ArkeiStealer)", "value": "7e581f8926032ee0362c0341c6072be7e1f630265bec02077984ce0f5686da6e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160550, "uuid": "ffa0feed-2719-4281-8fbe-583b09f7380f", "comment": "Malware payload (ArkeiStealer)", "value": "34768925d9ea56e540235dd3b675e740d92afcf2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160550, "uuid": "1acdb4a3-6e34-4bd5-88de-2f8ca7e27ea7", "comment": "Malware payload (ArkeiStealer)", "value": "51399d6e4330fa75d8e27cc182098f2b47f568fe94b55b237526e76472e694988889ec2c0808d93c9caea51d4ea7ea1d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160550, "uuid": "97636bc1-7c7d-4792-8c37-d03199a39542", "value": "T10295B023B2934433C67F2678BD3752689825BE112A38648A2FE51EDC5FF46413B352DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160550, "uuid": "cc166063-efd2-4be4-a45d-1f52a75e70ce", "value": "ec88d30de283c50d44daff3be84036bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160550, "uuid": "6aefb284-f857-4013-a8cb-958b1db22587", "value": "49152:k7IMK8HmWcd/8luYj6zT9SrajsO1CsSGGKE:k7IMK8Gt/8YzzQrjsS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160550, "uuid": "577b97a4-5d32-4031-93c7-4cf5fcaf2c3b", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160550, "uuid": "d371e756-5633-4f07-a38f-7588226065b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160550, "uuid": "d72f12fe-e4cc-40e4-865a-8bf44bcb23ec", "value": "b3b92939fc7f619e94d6b3b43aa0104a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a042cf2-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632148786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148786, "uuid": "2bea345f-185a-4655-b0b4-213aa62b3e46", "comment": "Malware payload", "value": "1b00949c94278fe8aa68dc49f0fa650b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148786, "uuid": "de06893d-aa4e-4334-871a-ec07a795a645", "comment": "Malware payload", "value": "7ec9056e682c9506221bd2bc7f3ea1970b857a07024137100ebd96eec1ee9b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148786, "uuid": "751b08b5-82d8-4505-816a-19a0bd21f955", "comment": "Malware payload", "value": "54992adef6a6c95c54a4335635cfe38f87eb1f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148786, "uuid": "db11e7b5-d772-4a7d-88b9-d24b3d2b14ee", "comment": "Malware payload", "value": "b393abf07f13e221dfe0b47de3663fb616b06bd7926c0f9fd0e19ab4848a670d576dde41e75111437786bef558513a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148786, "uuid": "7752f953-c286-41ee-a6ff-523f922c1873", "value": "T1B335DD294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148786, "uuid": "de3c36d7-31ea-4908-9367-cf1644aa04aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148786, "uuid": "ccf7ac54-6dd0-4be7-8bbf-23193622e56f", "value": "12288:LpP/hMJFgVQNqC3yICQme4ApegQ9Fd7Rpj4r8+vg:LpP/OJF+QUiyIqe2pEZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148786, "uuid": "04f35bf4-d437-4805-a04f-900788d5a80a", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148786, "uuid": "0114eefe-2f3a-4f75-8a63-403693d442d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148786, "uuid": "2048aedb-681c-4124-99a2-4d48cb792ab8", "value": "BALANCE CONFIRMATION AS ON 31.03.21..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e163be-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632146305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146305, "uuid": "1a6a802e-5426-4133-9197-77a57aa30952", "comment": "Malware payload (Formbook)", "value": "ebe3576a9462983e9172e733369fd1f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146305, "uuid": "e2628211-524c-470e-a634-79d32aa09128", "comment": "Malware payload (Formbook)", "value": "7ed2e1a088d8af23bee0d7b23fe435a181f597991cebfffbcc1ed43f31198f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146305, "uuid": "64400c52-0634-49af-8601-f59ed1eb1712", "comment": "Malware payload (Formbook)", "value": "1a2121f524a461bbb7240d804a15088fbfa3b43e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146305, "uuid": "5c349590-a975-4ee5-95b1-796023ee4534", "comment": "Malware payload (Formbook)", "value": "6f3ef5f0a3f7b7400d2d32ff529400b794be73a9554a347f1253f259f688fcfe42c72d8044ed991ada74323ca1452f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146305, "uuid": "148fff92-144e-43a3-b1f7-874c95c28bc3", "value": "T15C059DC13D47D89BF4DF2AB3986FC12011656E9D9161C73D26827A2B55F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146305, "uuid": "b8f37bca-a0c5-4648-86af-e91bc09bcc56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146305, "uuid": "43964c1e-5226-47a6-8feb-03af98254e55", "value": "12288:Q5MTdsoMvsmtiK5oyZ0pIsURAk+uibvrZPQzosJQZASN:Kg+FonlvhQzAZRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146305, "uuid": "6471970e-cd44-4f73-8f18-6fdc8d59c3f9", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146305, "uuid": "d6045b58-0a7d-4029-8ee5-f3d4c066d7bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146305, "uuid": "088316e3-3313-498e-8dea-fd62af431ed5", "value": "ebe3576a9462983e9172e733369fd1f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c344b7-19c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632110930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110930, "uuid": "3f634386-ed2f-4725-84d3-98cec1e838f9", "comment": "Malware payload (Formbook)", "value": "0a6d9f4af51990a6a50bf65fe8404959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110930, "uuid": "20b03c4c-a085-4fd1-8a8c-f3a9699b7479", "comment": "Malware payload (Formbook)", "value": "7edea6fe44458e087954bd189d33214f74cdb0d25dc3ea598554a9b2e3808abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110930, "uuid": "574c426d-43f9-4809-aa14-463578eb4e96", "comment": "Malware payload (Formbook)", "value": "37f8ff69c52fe6720e34b724938c558a2170a2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632110930, "uuid": "06ddf1e3-f7a9-4edd-8bd4-a29d7bba7295", "comment": "Malware payload (Formbook)", "value": "9421026fc4f0afcc381d79ecd93b6823c695d7772cc593a5207d303e9c568577069e7467a6da6f0d89b79d75b310300c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110930, "uuid": "32828dcf-4143-4b16-a551-6c31f9049b45", "value": "T102649C46AA80C040DC3E5BB0E43E9DF4561B7D6AE874B14F6F497E393BB30D3252664A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110930, "uuid": "b47fc9a4-0e11-4f06-92f2-ea2cf7ddc1bf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110930, "uuid": "a4d37903-6707-4b0a-92c0-94795c28d363", "value": "6144:b8LxBDto637W8Q4aayBQ72u1CHpfcUd9LlXsAYBDxwUup3eaUNEP:OtoSW8Aaym3C7dtZszBDxge/EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632110930, "uuid": "aa4e8d12-e503-4c06-8bc8-57148599b5be", "value": 329746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632110930, "uuid": "2ca7de1b-c1c9-4fa8-ae02-c37e33b3d6de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632110930, "uuid": "23a44d15-7b54-4d1f-b6c8-6686a71cfeb6", "value": "Bank Swift Scan pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21266d00-19ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632111647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111647, "uuid": "6a6b451b-6f31-437b-99a7-86c17ba4bf09", "comment": "Malware payload (RaccoonStealer)", "value": "db1e2f69fec5233a6738141c364689db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111647, "uuid": "a1d16b21-0e16-430f-9ee4-f09c6d8504a9", "comment": "Malware payload (RaccoonStealer)", "value": "7fbbd00196a571d86684b068eb31a23516bccd2cacff35eed53480cc91753ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111647, "uuid": "6ecac85d-fa30-4bb2-94f8-2e31503c62cf", "comment": "Malware payload (RaccoonStealer)", "value": "1a29d236c443df8331b1b2f452ffe1691a3d1b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111647, "uuid": "2afc5617-60d2-4ed1-98d6-91b17657e514", "comment": "Malware payload (RaccoonStealer)", "value": "e4cbdf1b6a77a06b6090861bd90b6eeb58b3602c8e20316de821dfe98cd6a2d5487d3fc10d8d7a14ae2d8329ed8766c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111647, "uuid": "7f999fda-1fa8-410b-adec-6ad08682f0fd", "value": "T120348C20B7A0C035F1F712F859BA83A8A93E7AB15B3450CF62D616EE26346E4DC70757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111647, "uuid": "0d71da2b-e2c0-4677-a000-9f9d83a44d2d", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111647, "uuid": "50a1ced5-3a03-4f9e-bca5-5c6293102b80", "value": "6144:MkZQOA93Q7wZh19pFrTX+UPipdCcXnvYi0kc8:bZ83Q7ehPTXplcfYi03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111647, "uuid": "8ab12b0a-a096-4404-a4b4-752015e14a3e", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111647, "uuid": "2f0d85f9-00b9-4db4-a023-37607af319a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111647, "uuid": "2d46e004-409b-4215-957f-ee6d651d1e8f", "value": "7fbbd00196a571d86684b068eb31a23516bccd2cacff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618c9f41-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632145255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145255, "uuid": "456fc58f-1fd6-4422-99d1-25a2843495c0", "comment": "Malware payload (Formbook)", "value": "6b9fa778151d9b0210008fa1c73835d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145255, "uuid": "cf17af27-6cbd-4446-b015-7fa1416eec61", "comment": "Malware payload (Formbook)", "value": "8072ca29a8527b0b1c1fa59ca07d85da4ce692ba73cc0471c73b47d08f839845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145255, "uuid": "25148806-c876-4de2-af44-c2ce1787027d", "comment": "Malware payload (Formbook)", "value": "f9baffceff409a3bdc4cc9334e7c5ecb38926c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145255, "uuid": "1140f9ad-97ab-4e0b-87f8-b7ae40a16310", "comment": "Malware payload (Formbook)", "value": "ebcbec91ca2a977969be01473c416bcd32df5d31a319d46af2785a0c66abf7d68628c71650f4c11bb2ab827101f1f829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145255, "uuid": "34a868d1-fac1-4eeb-bc13-0cdb5937578c", "value": "T103B423A5F4C4853EDC820B7328783AB9F7B71358B11E654347FAB47A18B95C62A00DF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145255, "uuid": "c7e80207-7229-4d96-9fa1-c7cbeb214e98", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145255, "uuid": "1b580823-dc7d-49b5-a74a-afbefc8d378e", "value": "12288:pwG7VJZt+hlAQAGJvqNfSQqbxpd+T6qB34FnE8uQIzv:pR7nZ0s2SxSpx3dql4FnE8/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145255, "uuid": "7f61fadc-a6c4-4929-a1c2-455f23649740", "value": 523846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145255, "uuid": "34a15b52-b752-4109-abd5-a623d098cdc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145255, "uuid": "10e4198c-14a2-4f75-84b0-bee055ba0f06", "value": "0986543456T654567T965456T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f55a66-19c0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632107439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107439, "uuid": "68422e40-1e77-4a48-a455-4402f3435e62", "comment": "Malware payload (RaccoonStealer)", "value": "ba785eeac548b2dc1ff2911ef18c4c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107439, "uuid": "d8a42225-b7c4-4426-a98d-889e4ec61f87", "comment": "Malware payload (RaccoonStealer)", "value": "81591058e5bba5cc0cc0eabf671441d0618311e9915acd6e89be88eb02764ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107439, "uuid": "42e92951-d7bf-4a19-aa97-c0f30cc71b86", "comment": "Malware payload (RaccoonStealer)", "value": "8c02bae6f0767f846c4103cd439b70804033407f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107439, "uuid": "1e41665b-2108-4946-b98a-84b517b85355", "comment": "Malware payload (RaccoonStealer)", "value": "913aa58c7c0e2d36cf858ebe01c899495be6d02eb61f95cb4ee3b000390d80bd40f32fc6c0318a0270deceb0132dbe9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107439, "uuid": "8ca2baa6-5975-4a64-87a9-5c710388d959", "value": "T18CB4E020B7A0C035F5F712F849BA8368A83D3A716B3491CF62D556EE6A346E4DD31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107439, "uuid": "e00d7478-b5b2-45de-a016-ee1b35be040b", "value": "84b4e1608c2b803bd96f193ead776993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107439, "uuid": "58153502-a7b2-43f1-84b5-457d7906090c", "value": "12288:+ZD7dZ6yBEPcaw+SYC2IBetgsipDuFF/6Sr:+V7dZowA7Iw5iJuFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632107439, "uuid": "daec02cb-64e1-47e5-9962-6400725212fb", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632107439, "uuid": "e4ade0e5-6f1c-4cdc-801e-0682bf69232e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107439, "uuid": "890e1a09-d25f-4055-8cf1-100a07d7cb05", "value": "ba785eeac548b2dc1ff2911ef18c4c59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a65609-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632155991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155991, "uuid": "2b4f9c80-d56d-487e-b512-cd03ead35b9d", "comment": "Malware payload", "value": "3a880a562fcfe0a7cf68fa04f8cacc85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155991, "uuid": "7745f033-d35f-43ca-8f6a-8a5b922fd3d5", "comment": "Malware payload", "value": "818a8b53b8f1f928c834caad235b19181458694a4f2e8b6c13eed3bb91e69e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155991, "uuid": "25104c7c-92d8-499f-9054-e4c74acfc34f", "comment": "Malware payload", "value": "bd4d9dbdae109e62933d19e90999f50cca376512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155991, "uuid": "84b3d762-3d66-4ad3-bd91-b728bed06b4d", "comment": "Malware payload", "value": "f69412805e8658d1335f8eeecc1646c561127ae491cb7447ba3eba7cff3c66ab2a7d115e58c456c0afc48faefbb3d8d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155991, "uuid": "f3824b0c-27ff-4803-a111-45cd04644285", "value": "T112E2E06D0D44A5EDDC33663A23B207B159281BE23726CC076F73E2676E42A537553EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155991, "uuid": "561bd23c-f85f-4cfb-a9a1-cbca7489fd5f", "value": "768:JmQSRhK6y2j3CX+V9H2Ig88S7dF/uH0JgGlzDpxYsJ:cQSRhK6y2OuLH2LsVrYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155991, "uuid": "8d220ef7-0282-4380-8439-3a70957c5576", "value": 33344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155991, "uuid": "d56ab65f-f223-41e9-98b5-24a3c0c76fa3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155991, "uuid": "181c9b5f-0c09-4fd4-ab0c-14adc5cc8db3", "value": "3a880a562fcfe0a7cf68fa04f8cacc85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2e446d-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125300, "uuid": "97f9bc4e-6c5b-4517-930e-9db0887a2384", "comment": "Malware payload (Dridex)", "value": "eaae2be1e8d2df7cd286d23124366015", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125300, "uuid": "29fbfac6-a8ca-43ca-a1a2-e4067b9a3aa9", "comment": "Malware payload (Dridex)", "value": "81a60c5a9d34907d1abf6b20b2b5d82275edf0a581836b8612d6b0e6fd383af7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125300, "uuid": "4ee2af6f-bc36-485b-b2f4-b23f252d73d7", "comment": "Malware payload (Dridex)", "value": "ce089c978217fd6702685c50d12528b84e0e7f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125300, "uuid": "1654eb35-4a01-458e-a044-6ffd989bc8dc", "comment": "Malware payload (Dridex)", "value": "44ad9a1320a2652b6ced7d3cf1301114a958fc18cec1c9a6712639129d50800b54eeef3b604381ee0ea2f72f972c2485", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125300, "uuid": "0f6cac7f-b730-412a-bbdc-c70a7b5ab521", "value": "T14AA5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125300, "uuid": "f7eda7d6-1932-44e2-93bf-ad52cf35af5e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125300, "uuid": "a1e94765-df16-42fe-b347-519d06f2c574", "value": "12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125300, "uuid": "8122186a-db86-497f-a472-1a9cf1992ce1", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125300, "uuid": "3cb2397a-cadc-47bd-9809-4d128456a211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125300, "uuid": "d7fdaedc-5104-4b73-ab60-3f9b1756b64f", "value": "81a60c5a9d34907d1abf6b20b2b5d82275edf0a581836b8612d6b0e6fd383af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542d9d2b-19e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632122470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122470, "uuid": "29911e7f-21b9-41cf-97f1-11d458827cbf", "comment": "Malware payload (RedLineStealer)", "value": "52f179c6f7b447256733e51212f30214", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122470, "uuid": "04938e28-86c8-4dfe-88ec-61c0b98aa5e2", "comment": "Malware payload (RedLineStealer)", "value": "8267e3a2002581b81d54572d899f2043dfc6a4ccc99792b1d063ef256c37aefd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122470, "uuid": "a6ea536f-744d-41e1-8b1f-37318c2a2df1", "comment": "Malware payload (RedLineStealer)", "value": "dbfd96a1887c56b8f8a5f1453fd92259efc58142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122470, "uuid": "d83c2f4d-c404-4a7f-8e44-836c772c667a", "comment": "Malware payload (RedLineStealer)", "value": "3321587bedd114c261b4c0fae852f12dc5ffcf547c4676afbcef9fa0e8b584ca2f2a9b41c4bf6f1d13c2c47fd14b8d25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122470, "uuid": "1e74c2a9-86b8-4488-abfd-8ce7f9e59495", "value": "T12664AE20B7E0C035F1F712F84ABA93B8A83D7A715B2491CB52D516EE2634AE4DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122470, "uuid": "fd32d235-befc-47f2-a7b3-d03169b3015f", "value": "99e1335f3817517f11962dc50cb29aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122470, "uuid": "a546b42e-c8fe-4ac7-858a-aed3e97d3a1b", "value": "6144:vJZQpfBT2YLWOeWCFJItH6klNm/Q0ZLLecLTdwg6KjQxAFfir2Y8:hZqT2YLWOT8ItaGNm/HRpeKjQxAFKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632122470, "uuid": "0079dc48-3475-4111-bef1-666954e700d5", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632122470, "uuid": "59e31f66-19b5-405c-a391-1c458363b429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122470, "uuid": "1f87e7a1-b75c-4989-b366-dc325655d141", "value": "52f179c6f7b447256733e51212f30214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb9e910-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632121732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121732, "uuid": "6d900aa2-a688-4599-a26f-16bdb7cf5b12", "comment": "Malware payload (SnakeKeylogger)", "value": "f6891c52e289b55f672ea148fbe8777f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121732, "uuid": "f585fa25-42c4-40a2-9eba-1a921cbe4787", "comment": "Malware payload (SnakeKeylogger)", "value": "826b617ccaa552d1308e1528146b9728572e634ed5b4facd30610cb46eca8010", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121732, "uuid": "e4522737-d8fe-46ce-8aff-9db5ee93cc5c", "comment": "Malware payload (SnakeKeylogger)", "value": "5db4994962e5a3b6a6edcba2d007699ebaf0b9a7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121732, "uuid": "5dac7d8c-1574-4a9f-8a8b-bfc4fa7bcde8", "comment": "Malware payload (SnakeKeylogger)", "value": "2a1b2eeced8363a627027dc89437ef5bf64e7270aae8f628a61e423265c0a7a6f1731ec9d879d47d934412498528e52a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121732, "uuid": "b10a8db2-3fdf-4f5a-9db2-092a8e1ebdfd", "value": "T1C98423AD138CDAD5D2309DAC705F53BB3C9AE0A78A5940748A77F83CE855A0DCABF114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121732, "uuid": "000c4768-98d9-4c51-b7f1-dca5c66e1fb0", "value": "6144:pepXx+Ock6SFxX6I6P917q7y6ERy8z+hE4Uq3QYa+0qL7xwEcqmy47Pu6GJ10o5Y:peFBckZxqI6P72e69C+hc0Jl/xwEtmDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121732, "uuid": "5dcd06f2-2034-4e2b-a097-8ee844a77a0f", "value": 385943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121732, "uuid": "735a5372-ba37-4eeb-975b-c449f7476d87", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121732, "uuid": "594be1a9-9d25-4a87-b053-440056d10645", "value": "STATEMENT OF ACCOUNT NO 5674.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4d7d25-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125544, "uuid": "e94464b5-23bd-4ee8-a228-8cbf07440f6b", "comment": "Malware payload (Dridex)", "value": "2dc8e43b1e45e53af7ced5d9282e8b1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125544, "uuid": "8d688390-b88d-43d1-bbec-d4d119d9e5df", "comment": "Malware payload (Dridex)", "value": "82cd7f66d12c3950029a9fa23949ac26bf3fa7a827dfbb04d9d2fc3a75c0d881", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125544, "uuid": "f5c66887-3882-4a08-8aa2-9bf9afd33f0e", "comment": "Malware payload (Dridex)", "value": "a12a270ac5c5743185adf2f7de076cf475377818", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125544, "uuid": "6240dd0a-691b-43c3-a437-b7124d70156b", "comment": "Malware payload (Dridex)", "value": "c843846216e94ccd6a458a218d640cc9eeb426aa8418a272f596bbc8a1e66d5b7c7815ba5dbf15187d1c94360a95b28b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125544, "uuid": "19d602fd-fb1e-473b-876b-bec8ed1e00e4", "value": "T17995D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125544, "uuid": "3148e596-b5dd-493e-9601-5c96ec7a0be7", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125544, "uuid": "7f3aa796-413e-48c2-8836-b30eab387264", "value": "12288:3VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:+fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125544, "uuid": "eba7d6c0-f6ce-4314-99e4-18f46e6eb344", "value": 1925120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125544, "uuid": "a7d3c026-a89b-4709-969b-6d1156df350e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125544, "uuid": "6eb2b6ac-b40a-4103-83f5-e74a81cfa98a", "value": "82cd7f66d12c3950029a9fa23949ac26bf3fa7a827dfbb04d9d2fc3a75c0d881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e479cc5-19ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632099213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099213, "uuid": "8e6db487-cb5d-4365-8e2e-876254a436a0", "comment": "Malware payload (RaccoonStealer)", "value": "c4c54c2e0692030586e6872371b50877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099213, "uuid": "8d110497-fb93-4e59-ace8-e8063138e355", "comment": "Malware payload (RaccoonStealer)", "value": "8305a87ead1a68264f4d0f691a4314f86c3b2bdd909d01028219e0d480238cfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099213, "uuid": "78a7056e-2fe2-4e9b-a732-a8f9545db556", "comment": "Malware payload (RaccoonStealer)", "value": "d1d56bbda8f1024ec11badc200254cb16d696f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099213, "uuid": "b24f2e3c-907a-43af-bd7a-36f32006cfe1", "comment": "Malware payload (RaccoonStealer)", "value": "402de1c6a636108b75dd29bb87fa7b5b0cf17fed27548969c6ec0bbef0fa5a755e81f116f732486bce6f6fd02ee61f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099213, "uuid": "d2a5210f-7edc-4a1a-b115-255fed614d6d", "value": "T104B4E120BA90C035F1B711F8596A93B8B83D7AB15B3401CB62DA56EE67347F89C3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099213, "uuid": "ecd09775-6316-46cb-a7ea-e719678a4317", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099213, "uuid": "d0031d10-c261-449c-b120-3a9dabafa8cf", "value": "12288:dZClO/zh/9JEu82KwXRrlkwCrI+4kqZ+IWlUPgli:dYlOdN7LCryR7Pgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632099213, "uuid": "b227c708-ac64-4017-b304-c6ea94f638ab", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632099213, "uuid": "0b390370-ec30-49b0-bd8b-a5fcc5df82da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099213, "uuid": "0d7f6047-91c6-47a1-877f-b8105687c088", "value": "c4c54c2e0692030586e6872371b50877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adb92db-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125434, "uuid": "8a2e0bba-c791-4f7d-8238-b68883d0c0cd", "comment": "Malware payload (Dridex)", "value": "0c4718a518a3f3c753ef26dfc3b1e6fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125434, "uuid": "75df102d-bb02-4eb7-bff1-4831c87ce9b9", "comment": "Malware payload (Dridex)", "value": "837e1a4b7f89e0ab8deb85c6aac30b8a28c47703cc6749a7a4b9d38585ce3f48", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125434, "uuid": "323b9c44-017c-4e26-99d6-08fa4ce2b6b2", "comment": "Malware payload (Dridex)", "value": "6439dd1344715aec7334c6ecc32293efdaa4a595", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125434, "uuid": "0357bbcd-d993-4178-bb6a-64472914866f", "comment": "Malware payload (Dridex)", "value": "65bff1c019bbda5f59871936164a2f3ba099c2e981985675072f9a81c40df88bcf6081c3ed25b2b6a1546e9068e2a24d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125434, "uuid": "5a3418a6-7803-407d-9a8f-73d2babf7430", "value": "T1ED95D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125434, "uuid": "aab2f174-dbd4-49b7-ac85-9e91f7550191", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125434, "uuid": "15095c21-8695-4090-b21d-d9ec12562ee7", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125434, "uuid": "b4d8d58d-231c-4c5c-b8c9-e936fbb4070a", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125434, "uuid": "66dc81da-e016-4196-8e4f-ac5b13074a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125434, "uuid": "49d33632-7a3d-4fd5-b477-32f601a108dd", "value": "837e1a4b7f89e0ab8deb85c6aac30b8a28c47703cc6749a7a4b9d38585ce3f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219a4ef2-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125391, "uuid": "dd5ba0f1-89e4-478f-b3f2-6098df5df86f", "comment": "Malware payload (Dridex)", "value": "40cc7ef6f667251c37ce7c596fef1cc3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125391, "uuid": "478c5aa2-3c7b-42ed-b44a-e4678fdfcf8a", "comment": "Malware payload (Dridex)", "value": "8391dad3e4b6ff905d08f0a1ca42a502481cd04c0be860aab0f4696b706a0a8c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125391, "uuid": "8da3ee3d-7172-49cb-81d5-3a0bd1ad0be2", "comment": "Malware payload (Dridex)", "value": "18b04eec9b1c9b7eb5e8f0f1128ef92a7e35ee53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125391, "uuid": "c0d355a8-26e4-41ad-ace7-6e1460a3a09c", "comment": "Malware payload (Dridex)", "value": "0ef8ba10f8b9c825aac13007265472a440a1d9f8346327c9d59df21e373c25d7118d649490d28a7eab053ff1d2f7be11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125391, "uuid": "2699b9e1-dbfe-4d9d-a4ae-1b70f086f441", "value": "T19EA5D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125391, "uuid": "cf80fb41-6bc9-478b-80f3-8840c4e7eaf8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125391, "uuid": "87155adb-7493-4887-a460-21533c1314fa", "value": "12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125391, "uuid": "131ff26e-17b9-41d0-b01a-70b74f62754e", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125391, "uuid": "50e32ec8-5bfa-483f-ad6e-827fb53561a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125391, "uuid": "cb08341a-3993-4b96-9d93-505be974a716", "value": "8391dad3e4b6ff905d08f0a1ca42a502481cd04c0be860aab0f4696b706a0a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a3d3bc-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632160592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160592, "uuid": "4b6551ae-a088-4d45-8ba9-e414699ca724", "comment": "Malware payload (TrickBot)", "value": "c2d307861ad9943473ce9dc8e66690ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160592, "uuid": "fdde3ad2-22cb-45f1-a4ef-c74cf467513a", "comment": "Malware payload (TrickBot)", "value": "83f374f57d674ac1abf87f968ba37237e5403bcae01ded47b7a912c4c5a58163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160592, "uuid": "d3ffad2f-17a6-4885-97cc-fb7663767d76", "comment": "Malware payload (TrickBot)", "value": "d263626d911c7a3224fbe27d8c0ddb7484e8d1f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160592, "uuid": "bacf6a02-4544-418f-8603-024299413fea", "comment": "Malware payload (TrickBot)", "value": "3b4c2955dd9cb9757ba3c5516970b17d82749e1342de41f6f65f3bc3bf4e31f5b69c0e09855ca7b99f96a10bb55177ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160592, "uuid": "d0887847-ebca-484f-8db1-f2bec881d8a5", "value": "T1E4B4D031F7915C33F577463158FD4A7AA66ABA610B6094CB73C82F1C8972AD39232723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160592, "uuid": "4485b8fa-57e5-4cc9-a675-1bfa038a43da", "value": "a0ca75b029da440554f770214388c9ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160592, "uuid": "4664eec8-b59f-4eab-a2cf-96e306b4d38f", "value": "6144:mz9V6+fc1iZG9csCpXYJzMYhtuJJmBM7wAqEgxjFpzksmmyCGespf/:mzD6+fc1i6csCpXYdMYyJ4KS/jgsmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160592, "uuid": "e5804668-bcb7-4831-b2d6-4a17daa10ec6", "value": 502056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160592, "uuid": "df25217f-f305-4ec9-9cfc-96b1be5648e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160592, "uuid": "065120c6-9578-42a2-87b7-495cf5d6e739", "value": "c2d307861ad9943473ce9dc8e66690ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace4f905-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632121330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121330, "uuid": "a70bd549-5827-4df7-994e-564ef89ae962", "comment": "Malware payload (ArkeiStealer)", "value": "772ff176fd23ff1cb1c23fd11b292531", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121330, "uuid": "46721f3b-bbf0-4c27-acb4-9ec46e8e5f4c", "comment": "Malware payload (ArkeiStealer)", "value": "843c4a039c1e51f366737973ab98a5f78f698401d491f1e290d26f803e410938", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121330, "uuid": "aa5b242e-f632-43c8-af2d-9d5e169c5412", "comment": "Malware payload (ArkeiStealer)", "value": "1bc7c5384fae0181c254f74c2558b0012d9fa0eb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121330, "uuid": "fb2b6fdc-ff19-4b58-8bf7-6ee0b6384081", "comment": "Malware payload (ArkeiStealer)", "value": "f857d233dee8ee33b85ef38c602d7cb0887e6011d94bcaab5f6b623e68361ada8776aa46da19148774a8e4db5e04fb6c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121330, "uuid": "c407cf2b-954a-49e9-b993-4786de598c15", "value": "T10D95B023B2934433C67F2678BD3752689829BE112A38648A2FE51EDC5FF46413B351DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121330, "uuid": "30c93ac9-2341-4b68-96d5-d2d1a808e4d4", "value": "ec88d30de283c50d44daff3be84036bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121330, "uuid": "974a41fb-f298-430b-9b53-faa6e30897a2", "value": "49152:k7IMK8HmWcdA8luYj6zT9SrajsO1CsSGGKE:k7IMK8GtA8YzzQrjsS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121330, "uuid": "0e0e0571-23bd-439f-a898-4b16af5b09da", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121330, "uuid": "103a26be-c12f-46f1-b5fe-695a24465980", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121330, "uuid": "553b3e2e-5859-47a9-8e70-77c78313bc73", "value": "772ff176fd23ff1cb1c23fd11b292531.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81195e0b-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143590, "uuid": "bd85e510-9b0c-40c7-8851-d94bf1868673", "comment": "Malware payload", "value": "4e69c5f9f487915b4ec70938b1739a3c", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143590, "uuid": "6af8f634-1aa7-41f6-8205-1f4bb0470d08", "comment": "Malware payload", "value": "8458f9cde277ab2eddbd8a87b45a3680a52ec1a52a8fdccc753d8a4f854fbc42", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143590, "uuid": "f372f383-281f-4f4e-bf50-a6482101f93e", "comment": "Malware payload", "value": "0321a283ce7ea4e46aa965d1fa1117c2dd99b315", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143590, "uuid": "a2dead22-c3ea-413f-8d64-a1a14a3fbaac", "comment": "Malware payload", "value": "6df9009a119eeb20eea24005940731b2fc33e074db4e996d272fbdb4b660045907b673325288e7f970df49b2f82cf9a2", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143590, "uuid": "b2ae42fd-3fc0-4245-a82c-aad6b2ce985f", "value": "T1D5414017B449A657F294F87D94E437381025A03184B5E8A19FEFCD4B45F43E6C9C6390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143590, "uuid": "0a0e28de-a5a3-4ed7-9b43-6f54374c7cd9", "value": "48:LYkr26XpyInhwIuhvYMrBqNM5Ro0ySvsOr2QfZACjmfAtntNn3tCT:jC6XENDCMYWtr2Qhrm45Pn3AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143590, "uuid": "3d05531b-9b4f-4862-98f8-7c73bfcb11f2", "value": 2363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143590, "uuid": "1f6256a9-c2c7-48f5-9f87-2c1db632fe5c", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143590, "uuid": "8d816ff3-6a8c-4df4-9132-f589a22fc030", "value": "dhgdghd.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe71c7d-1a33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632156742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156742, "uuid": "79b76ac7-3ba7-48e6-a01e-c2ff23798e69", "comment": "Malware payload (Quakbot)", "value": "17a9d59c0c446044dab21104aea729b4", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156742, "uuid": "d56f48d0-a89b-4480-ab61-2f09c11385b1", "comment": "Malware payload (Quakbot)", "value": "84c1d424a67b35ee39f07084a21329c89d809664b0bf9c8da5bd9e8fea3c9c2b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156742, "uuid": "5ce8230c-9db7-45d4-9d88-fb54e56ce9d4", "comment": "Malware payload (Quakbot)", "value": "0c8865540b1a3663cd12e28e211c5a2942c34427", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156742, "uuid": "768ee6c7-b390-4727-a8e5-cb06d8145de9", "comment": "Malware payload (Quakbot)", "value": "2f0ce8108427d0c8861fcb287be33f7751019914051ddd941b6fc22292ad961685f99cbccc0d74c88be949d3115c4898", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156742, "uuid": "15297ce0-e1dd-4818-ac20-f7d585018f6e", "value": "T1DD149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156742, "uuid": "9955efae-41ca-46f0-b28f-991cb5b5503b", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156742, "uuid": "1183d28a-1c88-43dd-bb3f-ff55bbcb9369", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156742, "uuid": "52013206-afbb-4a46-98a4-140260a51172", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156742, "uuid": "f148d6e8-9653-466b-9598-e627b6cd9f75", "value": "Document_368815822-Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace7b1c5-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632118324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118324, "uuid": "749a8898-67d5-4349-ab6f-38f682ac1af6", "comment": "Malware payload (Loki)", "value": "fb44f44d4ceee9c7fa1830fddaee9efb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118324, "uuid": "81bc5878-eb4d-4d13-b7d1-79d4b0b095a2", "comment": "Malware payload (Loki)", "value": "84fcfd1c71d437667fd51eb8409202b796155e57b40d57bfbedeb4dea9024dde", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118324, "uuid": "01094eb3-3950-4aac-b424-f9abf5b26e20", "comment": "Malware payload (Loki)", "value": "d5a7d13781c0efdd488f7ab7dc9b45dcb45c2432", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118324, "uuid": "cfd78c48-98d2-4e4d-9659-1cb18569ee7d", "comment": "Malware payload (Loki)", "value": "dee25673af0518211a6df231eded5b0d0944dde2e34e01a64ae6caf93517f9d2f3f8cda10039036eae65d188f775130e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118324, "uuid": "63701b33-0e94-420e-a02a-7fb15fad2734", "value": "T115259B294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118324, "uuid": "49c0e055-d26b-4287-be41-df2730c52bcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118324, "uuid": "c5fd9246-f8cc-442b-8420-d9b1ca32207d", "value": "6144:npSm3ruhGz76PoJv6+MGNTdqtyXEXhlG03WRwzS9c3xXQxyT8df+9ck65IWGneUF:npP/hUXn1ViRqV0BpYCYvlP+5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118324, "uuid": "ad628f4a-aa64-4a8d-b7b0-4cc2d4bc6304", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118324, "uuid": "3d3e955d-14bc-47a2-8d44-3114961eba12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118324, "uuid": "17ce7518-2a0a-45c1-aa07-7db3fb0c7b2a", "value": "dhl document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18264ca-1a30-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632155805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155805, "uuid": "b469ac64-b35d-4831-b9ff-453d936c8a23", "comment": "Malware payload", "value": "f30c7ec6b9359aeaeb0618277705b1a9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155805, "uuid": "c2f307e8-2638-4c20-b8cf-e8139afc6c37", "comment": "Malware payload", "value": "8544a136a8dbeab83a3151d9e2b8c12c708aca0274f981af99f9aa1121f2d9de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155805, "uuid": "844eab54-fa5f-45c6-bba1-34f165276e4f", "comment": "Malware payload", "value": "5b503d8d48f649943a2caed89e1eb664c41b7bc2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155805, "uuid": "381914c9-d13f-4b94-9353-af6cbb2b71d0", "comment": "Malware payload", "value": "aa893cb0b991169f3a9323ab7d3ebcd3bec659b9297a99d031d96128541a22ae00ed075c717d2704fc8d6c26e9db9f9d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155805, "uuid": "240ff13d-11c4-4967-a1d9-e8fbb46fde71", "value": "T161566D16B384913FE0A71A3A496BE694A93F7FA039668C0F5BF4398C4F355407D3624B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155805, "uuid": "b71c9896-162f-4340-8f17-3dc77ebbe646", "value": "98304:z1oEt9zie18XgJvitAtTYD5eT13P+jOOQOofYOYhA:zTJ5phQD5e53P+jOOQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155805, "uuid": "a3fe7e66-ec04-4b29-9e38-cd220e86c9bf", "value": 6400512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155805, "uuid": "94695a77-d50e-465a-91a3-eae9144dc7f5", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155805, "uuid": "1ba4efad-bf36-49ab-b723-7215ee972d24", "value": "Correos_Pedido-2Q00BQR71JHUUSG.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedaa46d-1a24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632150620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150620, "uuid": "15f6dc08-bf96-4262-8831-4aba31b2bae5", "comment": "Malware payload (DanaBot)", "value": "706933f5a3bf551db6c24401cb6787f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150620, "uuid": "89312b8c-3ad9-4160-b9fd-44f255dc10cf", "comment": "Malware payload (DanaBot)", "value": "85ac2df36fbc7048408cb56f36ddc419fff3402f857772e400c717b0d6f2ba92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150620, "uuid": "e0986853-76f6-4cb9-850f-ac9cdfb150ae", "comment": "Malware payload (DanaBot)", "value": "d89da96958e9374b9ffcf14e1dd9b765544d2cbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150620, "uuid": "7ea72c38-d9fc-45f8-9110-8cd4e3a20228", "comment": "Malware payload (DanaBot)", "value": "e42222542862c8d1551ed09d2ff48d1e456289f1be6613915b2c6d40842f4bfa4e1e25e3256ea54a638ca655c4be3764", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150620, "uuid": "f679d355-f324-4ea1-aa86-e87dd82773d2", "value": "T150263302C175BC77C6CA1DFE629286B3B3E1AC132A24CA17DB0FF9CB869A445950577C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150620, "uuid": "c9107f57-0670-4520-aed9-fa549acd1ab6", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150620, "uuid": "08cfdbd9-391e-4131-953d-e879d22e3d95", "value": "98304:FZGpj2AKlIZ3qjoVqcPp7FcxPQPQkEa+nyrvQnb/htxiV3ZA4:FQYhI0zUp7FceYlBuvCLGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632150620, "uuid": "cffbbc5b-39f7-4c48-a2d9-7e4bcfb54dd5", "value": 4720992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632150620, "uuid": "a1a6bafb-4ec9-4ea8-97f7-610c7dffc242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150620, "uuid": "cdcea8af-dfb3-4dd7-b13b-f1b11846abe0", "value": "706933f5a3bf551db6c24401cb6787f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcfeaee-1a64-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632178163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178163, "uuid": "aca3fe6f-0904-4168-b03d-bcbcfad5c982", "comment": "Malware payload", "value": "7d964125d2efbd607b0c45be01141085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178163, "uuid": "3902b78f-69b2-4e93-b6e4-b5a5671b893e", "comment": "Malware payload", "value": "85de10b209c04191bfce62edb9b2252a901f4b1c7fd746e0615eb1cd319e7359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178163, "uuid": "08dcbd2e-0361-4424-a047-11c31438b404", "comment": "Malware payload", "value": "32350855a85bdb17a12ff08ee4a91485dbe1c5de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178163, "uuid": "c1585bf9-6ffd-4037-b37d-f77d64587650", "comment": "Malware payload", "value": "cab6ccd70f17457123491dc95024f1e9d22dbb3e74183ce32c57f7dd0ff99f91dad5c1ddbb03f333e7ac9db4dca3f1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178163, "uuid": "b2795011-3cd9-418c-baa0-c6b550fe2877", "value": "T1F5159DD13D47D89BF0DF2AB398AFC02011646E8D9161C73D26977A2B55F335230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178163, "uuid": "e2c3129a-8a3a-4295-b79f-94de55117d43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178163, "uuid": "53a494ce-e98b-400f-875b-533a738ed2f2", "value": "12288:of1jCmsmtiK5oUZaWiuLHh7OpFsq876pLDXZBfMpFokAHg9BphXGQK:CCt+Fo5VUh7Op2FynfckABZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632178163, "uuid": "e6e29112-44bd-461e-bb2e-083e010adadf", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632178163, "uuid": "f2e48097-5098-4378-9f85-871debf79ae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178163, "uuid": "066041c7-3eaa-40db-89ad-316bf0298a43", "value": "SecuriteInfo.com.Scr.Malcodegdn30.24885.30346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6712b7a-1a0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (XpertRAT)", "timestamp": 1632140754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140754, "uuid": "a3aa1283-0b7c-46e3-bdc0-c798264badb4", "comment": "Malware payload (XpertRAT)", "value": "f6200b9b9789794de4a8d78f4ae96d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140754, "uuid": "4ee96d4f-0833-4bb2-a094-3a93ce3b0c51", "comment": "Malware payload (XpertRAT)", "value": "85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140754, "uuid": "457d9414-8515-47e4-b325-645b32297f22", "comment": "Malware payload (XpertRAT)", "value": "1d18c71e7e4de5c6216653db5effba586345597c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140754, "uuid": "ae67bb0e-2a89-44a1-a3c9-720673c01334", "comment": "Malware payload (XpertRAT)", "value": "abb8a17fe033423639ac0b0907a5c255e6fafcbc94e1a793aef4227a80e97f05999b7570caae70075fbf574b65521d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140754, "uuid": "6d92be9e-6d0e-4751-a184-ccb625840785", "value": "T1C554127362504AFDF0285AF7ED73A19686A3F23E686AD37C04C8B4AE0F436716136158", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140754, "uuid": "e13d2995-8587-4755-aa8f-dbedb91de30b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140754, "uuid": "29b1908f-5022-4202-b949-681ca0a4d10d", "value": "6144:VEbufNiZt9LR3rzPUyv9lYiMikZ/5OQgiLUmU1LAml7LwYiE7hyxcYUUM:TfqLdPPU66iM/Z/8cUmU15cY7acYZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632140754, "uuid": "cdf8d261-dc5e-44a8-84dc-7df446ee0e7d", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632140754, "uuid": "21c26b36-dbb2-4d87-8701-5e472c0a402e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140754, "uuid": "b1c036c8-f85f-47cf-9284-0f917d536df5", "value": "f6200b9b9789794de4a8d78f4ae96d22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e0339b-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125555, "uuid": "f7ce8804-e07e-4ed4-bfeb-01655a159b10", "comment": "Malware payload (Dridex)", "value": "0544764d22132c3d1f3b75893aa82e68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125555, "uuid": "21c42d6c-c0c7-4021-b7fd-a46a70ae5cd3", "comment": "Malware payload (Dridex)", "value": "8629b1209a6926c687ed6e22cdfdeaffe0f96a729b80d1fdfd67ed6e4aa4991b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125555, "uuid": "42018179-e714-4370-bd52-6c47f4b26c37", "comment": "Malware payload (Dridex)", "value": "9d3643718c501a29672e8ec8cf99145a7f34746f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125555, "uuid": "6437ed1a-e9f5-4ad9-9085-ad6f06cb0538", "comment": "Malware payload (Dridex)", "value": "617acc33c7eab0e53ed2456c349268e42504c5a214e3c54c31786afae6b0ac6f7eed1f4fd9e7ca1a81dd3d7b90757b5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125555, "uuid": "c4fcf7b9-c01b-4537-b931-c0342443f951", "value": "T18B95D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125555, "uuid": "5e67581a-3549-4fd1-b5df-4c992c36df8f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125555, "uuid": "c9854a97-e26d-4c6e-897a-afdeb837677e", "value": "12288:NVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:UfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125555, "uuid": "7438c2b5-a8b1-403f-9e13-43fef2dcb52e", "value": 1925120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125555, "uuid": "12ed215a-7309-405f-80a6-d7e267a205ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125555, "uuid": "5c8d267a-bd1c-4f8c-83da-b9bca8a3c62a", "value": "8629b1209a6926c687ed6e22cdfdeaffe0f96a729b80d1fdfd67ed6e4aa4991b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a71ddfb-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1632118266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118266, "uuid": "2515e780-c4af-401a-8a85-41be8afdb8c5", "comment": "Malware payload (AZORult)", "value": "a938f4b1da64206aaa4407d36163cdcc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118266, "uuid": "7bb73723-2434-4e2d-9e33-214c770e7a3d", "comment": "Malware payload (AZORult)", "value": "865c3d355eaf051241f621f24a13dda3e8500d28a7c3c8eaa779df1b90da1ccc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118266, "uuid": "8e786e37-16a5-45e1-b290-ceb0ab1512cd", "comment": "Malware payload (AZORult)", "value": "cdbe8e33c6a343f0f5ca226d9320fd65915d3f6e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118266, "uuid": "a38b021c-03f2-49c0-9550-ee5aa76fec96", "comment": "Malware payload (AZORult)", "value": "a452bb074882d3396d07f1e05863974c7b5e501f92e98662fc8c8442fd092d1b01434c2e97725b0657d82099f89b43d6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118266, "uuid": "951a522d-8491-4aec-8d4e-261b38a82507", "value": "T1F4F4C0202364C26AE1FBE738C4329471877FF996A03AD95A5DC3D8DA0D26341D51BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118266, "uuid": "f01d40a5-ce38-499e-8641-3fb72bdc721d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118266, "uuid": "e552ebd3-e87e-4acf-8bbc-621fa78d0502", "value": "12288:XBGiY6HDFuq4I3ixDitFr3X+YZQqp+iWth4QlmtiK5o8cJ:XA6jFuHIqMxn2qp+iA4Ql+FoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118266, "uuid": "c41fa1ba-5a70-4242-86d0-9905be56e221", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118266, "uuid": "ba0c9789-c24e-47dc-b59d-19dd06886d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118266, "uuid": "8f38699b-135c-4675-9ddd-e4382592b1be", "value": "HALKBANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f98b82-1a4c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632167813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632167813, "uuid": "6df9029f-0307-4e3e-99ec-2b24e3fab51d", "comment": "Malware payload", "value": "71f5605c9ad95d946c48458df7c9ca21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632167813, "uuid": "5405684f-9435-4df7-95e0-06bab57995ce", "comment": "Malware payload", "value": "87dd76a90161511313f755adb4cb0009c03e741e4cca2273d6b81658dd2a11d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632167813, "uuid": "c54fc692-fb57-42f8-8ffb-e62d2dcaf7de", "comment": "Malware payload", "value": "d485a08079a77adcf550931f29e39b26683b1bce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632167813, "uuid": "e22ecce5-8d4f-4b2a-96fc-a3fb26a77370", "comment": "Malware payload", "value": "a553a7bbd535e87b3b9a03e703902a30a2d630dd8cc9a36fc6b14885b3ebf352bd7ce91fdb92d9d376816673645927c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632167813, "uuid": "bf3d65f7-ed9f-43c0-bcea-0336fc683c24", "value": "T1A7059ED17D43D89BF0DF2AB398AFC12011646E8D5161C73E36967A2B55F331230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632167813, "uuid": "44d8c1fa-623c-460a-ad0b-bbdee13a6813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632167813, "uuid": "edad790e-0875-439d-8775-3a797ada25a8", "value": "12288:4CLSB8smtiK5oUZqU5Grt94N59uFcYNYf8IWDQMpjKJLMnEaGQK:3GBj+FoS44/uFcYNYkRHtELMEaZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632167813, "uuid": "ad2dd081-5180-426e-ab6d-880bf01b0814", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632167813, "uuid": "68bfdb87-405e-43c1-8bae-357e96b0aba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632167813, "uuid": "b2ffde6b-d2c1-4b0b-8f47-b7c44aece6ce", "value": "NEW ORDER FOR PAYMENT #4346776_SEPTEMBER 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5d3650-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632121683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121683, "uuid": "8c1feb01-d52a-410d-a261-cdd4e52717d1", "comment": "Malware payload", "value": "354115d7bb67d5ae80980581efc76a2f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121683, "uuid": "d16c37a6-0413-4259-8435-b0327c78f052", "comment": "Malware payload", "value": "88bac0ed38d147941bbecc08e7a8d21cbd23f21937155f18d2eb59cfc644e4f0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121683, "uuid": "49245cf2-38ee-4e4b-b83b-bda39ea75fa7", "comment": "Malware payload", "value": "0ccf3888b67552f00153105c5ce4543735c48cd8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121683, "uuid": "ac11708a-91aa-44e5-8827-b000393508e9", "comment": "Malware payload", "value": "e7f9f3a0dc8721eb4db1a6b0523e24c23999e3a332bc5de16b0f839c355976f65a1f9a73b2a2542f0517f16ad36ae78a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121683, "uuid": "2ad49c90-c21a-444f-9980-3dd4f78c84ce", "value": "T135B412811E82883AC46523BAC43BAD5068233472CEF53759B29DF52EFB27743D81775A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121683, "uuid": "003b7710-34cb-4e30-b302-a1d1e4e056fa", "value": "12288:gYV6MorX7qzuC3QHO9FQVHPF51jgctx7z2mre:/BXu9HGaVH6+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121683, "uuid": "dce7bcd4-d794-4a99-a98f-6e2f53fc834e", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121683, "uuid": "f0237a0e-f5c8-4eed-a1a1-822dac44ba10", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121683, "uuid": "c1abe251-5d73-4d1d-9431-e55c0a983253", "value": "dhl_tracking_shipment_document_009.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6381f218-1a21-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632149124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149124, "uuid": "098ed5f2-c00b-49ba-87d2-dba649cb85c1", "comment": "Malware payload", "value": "fc8554b367a08696ba85d412cdd182d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149124, "uuid": "a710e4f9-296e-4185-a22a-c804caf8b441", "comment": "Malware payload", "value": "88fcc7a3828eb28655cc8f5996036e7bec372459895c133c5ab76294270789e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149124, "uuid": "5ea58a09-36c9-414d-a208-46f08a443246", "comment": "Malware payload", "value": "b4fb6e53acd4e7584880add29cc39d9e58d3a8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149124, "uuid": "9b805e98-858d-48d7-82b4-d2aa0c56c86a", "comment": "Malware payload", "value": "40f1ebda58a32c38e6096f6da669d0b2624a3b8c593a53f5b68c691f275c1b7b50dbe95a8d403d056c6eeea6439aed77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149124, "uuid": "6fdca168-415b-4e41-92f3-4a5334b9535d", "value": "T16B56F103BCA164B9C5A9C232C9B592513731B889073577D32F46A6FA2F777C42E39368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149124, "uuid": "6213b737-c7fa-41e8-86ba-565405569d76", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149124, "uuid": "aeccbe96-0e69-46b1-b334-5489d3017e95", "value": "49152:IL5Q0pU2rb/T/vO90dL3BmAFd4A64nsfJdoHrV5P4XVwQvDl2QmBlwLHIXRlbXaZ:ILPMMrQmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149124, "uuid": "5e72de66-0e5a-4261-9b20-97f24cceb6cc", "value": 6024192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149124, "uuid": "fe3543e9-f5b0-4c42-ba37-1a2f39763dd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149124, "uuid": "a2588df0-cdf9-4351-b834-f780a7d6d5c3", "value": "fc8554b367a08696ba85d412cdd182d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08f8d52-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632145361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145361, "uuid": "c6fb2faa-19ee-48d8-bc16-ac15156ec030", "comment": "Malware payload (AgentTesla)", "value": "bbff3d02c5d7c87053e6432555d1c35f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145361, "uuid": "7f98a91e-1787-43c2-9df2-d8e7ae5bc8f1", "comment": "Malware payload (AgentTesla)", "value": "8a2a2f30c2d0e96fabdd7b35775f9ea05fd63f694b5666487db3ba27fdf74ede", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145361, "uuid": "f349cdb4-71a4-47af-9b1e-b2abba4243dd", "comment": "Malware payload (AgentTesla)", "value": "243ef609d6847a27cec1a443e7415682d2711de8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145361, "uuid": "d22df653-62b1-4d39-beaa-ef45a3d6797d", "comment": "Malware payload (AgentTesla)", "value": "48f3630feba2bb70f667286c981d63635ef98d160b443a8d12cd1bb1206897ed748f38c9f20a78bec5bce9a39f328235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145361, "uuid": "6779ee39-7c9d-4adc-9438-3400a4f2167c", "value": "T13482B57CD09706948F86A7B8672BAF09068C762DF7899532323CA73527D1E7A9117C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145361, "uuid": "a5895e35-dea5-40c3-8ccf-7904d37ebad8", "value": "384:3gvphgx5j6/PDoz8UzHSUSib+hJi2SbXGi89az7s9oBCkyT/Dp4Q31c:QvSj6joQUbSUSpy4WY9rFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145361, "uuid": "f250ece4-ad64-4192-a53c-f71913dbf43d", "value": 19277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145361, "uuid": "f7914dce-b0a4-496d-b907-df30ddafd125", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145361, "uuid": "c364f60a-b4e8-4bf4-9a86-20cc5eebdd47", "value": "Purchase Order PO81-36A2DC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a323e0-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632121291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121291, "uuid": "eb4c43c8-1784-4176-8ddd-bdd47b5ee726", "comment": "Malware payload (Loki)", "value": "77e0597ea42ce5173b4b9d2ae1aa8f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121291, "uuid": "03dc6230-b5bf-4483-b876-08dad67cfc08", "comment": "Malware payload (Loki)", "value": "8a88211f7dc2c10cdbdc9b2c024c7ab7584f4a87594861b0c701549e3129314d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121291, "uuid": "9b5f7ea5-d9ba-4c4c-956c-eebbb12206aa", "comment": "Malware payload (Loki)", "value": "5f13dc4cf2f48f50b3e99072c9b5158a8e538025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121291, "uuid": "0b3fe735-e6d5-4d18-aef2-e513b924319a", "comment": "Malware payload (Loki)", "value": "9bdbc68ac6adb5eb4d4421a3ba547d0bf09b8080f681ddb7f47da0e7319b95ef44f6759070f22f205f258c9c414326fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121291, "uuid": "b0868a3d-8eb1-4e88-bb23-5d0a4cf54a07", "value": "T12F943C296F70D874F38632351C077E24BD256E78D6F8228D2923F66A98736DDDC39248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121291, "uuid": "d9a16a92-4c17-4253-bbf7-d4cf05105931", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121291, "uuid": "7051dcf5-4fd5-4da2-85da-32ace8c7402c", "value": "6144:Y8LxB2Uk/MKjE0dN3IkTzocqQRWd3Ie8HAcyR8oyhuXqKfrc:WUk/1h/3Ik4pd3FsAcyR8oKWqKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121291, "uuid": "76b86a8d-5027-455e-a761-42ff2c04f400", "value": 427829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121291, "uuid": "c522d9d8-8b47-45b4-825e-7d34cd58d4c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121291, "uuid": "62d3e23a-9ca2-455e-b8b0-6b16c5dc5907", "value": "77e0597ea42ce5173b4b9d2ae1aa8f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a91a9d2-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143633, "uuid": "50299501-ce08-48ce-afc1-664e8a9e89f0", "comment": "Malware payload", "value": "af4d828179873198f0654b8fedb6fa3c", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143633, "uuid": "ff240c66-a184-42bf-b927-31f933fd8963", "comment": "Malware payload", "value": "8a9ba749791a50370cd182200c339245a45cdeb2bbe37cdbde8fe3dec3bd24d5", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143633, "uuid": "c5b2fd06-949a-48b2-959c-0deacf5a42ca", "comment": "Malware payload", "value": "fc66d86faea9d1f1969ecec8d8b53dd44b108499", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143633, "uuid": "86645bfd-357a-4a27-9f01-c966cb92dfd3", "comment": "Malware payload", "value": "8f4b0dd652f86517afa31acda6738608fd256f2908d22b8309a41030936bd84754bcbf985064914019a8863bcd20576a", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143633, "uuid": "904dfc04-bc3f-4a81-8bb2-a0bcb1ad599a", "value": "T1AD32621792AB1887B103A0FC26E473E833C14530E461ACBA5FD76ECECDDA18A560779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143633, "uuid": "10a44767-f33f-41e2-a71a-e97b4bc38341", "value": "192:sSysbOo0ywSnXfbW17LrjJYc915ci5OClNlvVvltXvFlNlvVvlt/x:Wsbd0ywYXQjjp97cPm3D533DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143633, "uuid": "582484bc-2a54-4b3f-a9be-db132c3e1efa", "value": 11658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143633, "uuid": "bbc5bbae-b0f0-49b1-a1c6-e3f9a0d164f0", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143633, "uuid": "54329c33-b31a-4214-b063-21d7888fd0ed", "value": "Main.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d0b7e3-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632143571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143571, "uuid": "7a0322f6-07a8-4c59-93e9-25598297eb66", "comment": "Malware payload (Loki)", "value": "39a41f7569b44be76a3e289199c6905e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143571, "uuid": "977724d0-e88c-437d-a821-fe3dc0079a71", "comment": "Malware payload (Loki)", "value": "8b961b656d8ed0511e128f929e87c715821f3683429ae2a5591f65d5b3b5e302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143571, "uuid": "0593bfe1-b6f3-4525-b1c9-eaaae3b766c7", "comment": "Malware payload (Loki)", "value": "ed1f0a676f64c96b2e1ff23f1a008f299b965e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143571, "uuid": "9019a305-afd5-4d7e-aea0-45ec2cafbb46", "comment": "Malware payload (Loki)", "value": "8e9498264b82ce40d25a583597c69df91b9e840c0f22c4566b1a3248b3773c51a7e862837af46adc3d9b997f30ea7d02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143571, "uuid": "7aea394b-a2cd-4095-bb4f-d7ce5aa42665", "value": "T198F48CC17D47D89BF4DF2AF358AEC52011656E8D9161C73D2682BA2BD5F3302306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143571, "uuid": "c380c1ad-a453-4cc1-b8c4-a6d44c10612c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143571, "uuid": "676cd085-ff12-421e-b6e7-5ac7b72e9a00", "value": "12288:H5MTdoH5iJsmtiK5oyZ4Akc4oyImAd2v2dc61hUyiHBKR4LBQK:18O+FoBV5ofJIyayigR4WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143571, "uuid": "1a722ae9-393f-4d6a-81cf-ce929a8bf150", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143571, "uuid": "1ecd3c67-3579-4a6a-9776-3c36506480fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143571, "uuid": "237387ce-abd2-4381-9f12-c16e9c50cd9c", "value": "Euphoria Apparels packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577f8078-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125482, "uuid": "9130f3a8-1e83-424d-a942-3ac5dde6ef65", "comment": "Malware payload (Dridex)", "value": "a1c8c4e7253c85e92a508067817c1887", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125482, "uuid": "c8bbe567-55a1-4fd8-8b4e-09a996af2105", "comment": "Malware payload (Dridex)", "value": "8bfcb557793a341741c1ee0a8446b5e8ca04b1a59c219b341327e401b0cc7e30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125482, "uuid": "2b856b8e-7911-4a12-832b-3b62815646b6", "comment": "Malware payload (Dridex)", "value": "13ca4488ed9500ce5c611fe97a097b0e1a21d9b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125482, "uuid": "0c7aabf1-db86-42c6-902c-269d0d48eccc", "comment": "Malware payload (Dridex)", "value": "764fb0a8d768e2fa2f980d590d67e3f681278fa3a60b9659db01da6367e1351306028602607e84dd4cce98d82221aff6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125482, "uuid": "2d7c2ad1-e360-4110-8964-4fea5cd7adcb", "value": "T1C595E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125482, "uuid": "0f1cff59-5665-4e68-8a3b-7c2a19475d00", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125482, "uuid": "b939f721-368e-49b1-9370-06a998eab987", "value": "12288:dVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:EfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125482, "uuid": "c7276ba8-ce17-423f-9f7c-de1cd0ae4d03", "value": 1957888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125482, "uuid": "d2d1beea-840f-47b8-8c92-5e343bc49add", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125482, "uuid": "fbc02a89-eca5-4f07-8e06-2d1cf8665f39", "value": "8bfcb557793a341741c1ee0a8446b5e8ca04b1a59c219b341327e401b0cc7e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435996fa-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125448, "uuid": "34f0a3ce-9bfb-4062-9818-424442819ad3", "comment": "Malware payload (Dridex)", "value": "18c0592a2ed1021ac486ffc79eb96385", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125448, "uuid": "4e837ea3-ed64-47b7-928d-061f6c6c6d78", "comment": "Malware payload (Dridex)", "value": "8d7d6d53e0fbaa412e6bb2561423c21c45230ba36b93c94fc4d66d91d1d0427f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125448, "uuid": "09bfe23a-b34c-4ab0-a97d-85988ecea983", "comment": "Malware payload (Dridex)", "value": "abdb4c02ddc389426bb55c1659742fc745f761c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125448, "uuid": "92bf97c4-100e-4bb0-b8d2-e3ec685d778c", "comment": "Malware payload (Dridex)", "value": "1c3a101ded452265675855956a741cc5f87b9af54e0491d7cb898c076404271879063a31bdd5d079bfb688ff1c4a4045", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125448, "uuid": "82008b26-b606-458a-95f7-f972d2310116", "value": "T1FC95E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125448, "uuid": "bc49a4ea-f7b3-4c2c-a6eb-7eeda3beb665", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125448, "uuid": "6f12be30-59f5-4b09-98d9-c4f6f3bdb797", "value": "12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125448, "uuid": "8d568f03-22f3-4f82-9210-ce32a9f6c5e0", "value": 2007040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125448, "uuid": "ede75d7b-8d50-48c3-ab8a-9fdc33664045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125448, "uuid": "acc9a57d-eadc-4872-ac56-de47d74738a9", "value": "8d7d6d53e0fbaa412e6bb2561423c21c45230ba36b93c94fc4d66d91d1d0427f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d90b80-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632151888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151888, "uuid": "f30fcdc3-ec0d-4864-9841-231932562206", "comment": "Malware payload", "value": "29461f3c4e1a73f1f70aa94046dc2375", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151888, "uuid": "8e6cbc38-42cb-49b3-8969-15d894636b62", "comment": "Malware payload", "value": "8e71e0aa04986a301503e8c12084da938110dfd433d571ca02c576b65acc8b2c", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151888, "uuid": "60c8570b-0f86-4298-bce6-7fdc3678f331", "comment": "Malware payload", "value": "2112878731978200199376ff0d83f734939d2eee", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151888, "uuid": "ddce6f55-8a00-4135-87e4-ce6c02b066b1", "comment": "Malware payload", "value": "e4cd3f2c0c9b7e03f53b0f310846c22568e073abebab36f2b80e7b9c8ebdee65ab1dd459d326a0cb2d6a54925eed7b04", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151888, "uuid": "d8b7ca6d-7795-4b5a-b4b7-8374d00d5024", "value": "T134D4F1D3357E06ABF1DB22788350420B52E2CE005E5071FBD994BA15CBFF5B2F4A9892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151888, "uuid": "d2a37acd-e6db-406d-ab7a-77c7d0e13f10", "value": "12288:tcKrGb+tdaybfHAbDdi4WkJSVy88ujnf7kpS6WZ0tYb15KGpxcpd:t9MQdlbIbo4nSVy8pjnf796WZ0tmM5pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151888, "uuid": "43cf4390-498a-48d6-8093-5a96747ff002", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151888, "uuid": "fc0ec178-004a-4cff-b5f3-f063a412e9b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151888, "uuid": "54d9dbef-e44b-4ea6-827f-fee7d2e94d6e", "value": "Compensateur en A37C1_Rev 01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50024893-19ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632134489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134489, "uuid": "cd2ba781-4ccc-481f-a13b-4b3931577ee6", "comment": "Malware payload (RaccoonStealer)", "value": "271dd1b7b71a59842bac41e1be96b697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134489, "uuid": "062e1b16-4cd7-45a1-8441-4d4f3c10feea", "comment": "Malware payload (RaccoonStealer)", "value": "8e73f95c7c02b3ca287a62abc5e71fd374395777d83b3cb025e837a2b17d44a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134489, "uuid": "6bf16b03-11a0-4a7c-a7e6-3d00bd2fde1f", "comment": "Malware payload (RaccoonStealer)", "value": "9dba53ea25d67a8f272f62bc994cc221d67a658f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134489, "uuid": "0f42058f-3695-4cbe-bfe4-c1037d52f499", "comment": "Malware payload (RaccoonStealer)", "value": "76e9e86fe472a0f7719baf7a430f6441e4c80a6a5ea6bbdfac9c210034c19fbf999a1492917d5049d8e99fe3ff933cab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134489, "uuid": "ff8fa95d-fdd3-436a-afb0-14cb1a0864c5", "value": "T1EFB402113A98F431C6934D706423D6E9EE7ABCE2756C904F7B943B2E7E30B91563930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134489, "uuid": "0c9c5134-f844-4e6c-87a5-98a8459a2b72", "value": "474c7fded3c08ff2a423f2b3da510d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134489, "uuid": "d9a9e092-547b-43e4-9265-d19e0a1e7e46", "value": "12288:d0QTV9hg2uqG4Uwr8E16Stt/XCRyp0VPP:XV9hiA1I3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134489, "uuid": "fd04a793-ddd4-4e59-a076-a510376422b3", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134489, "uuid": "e7a05292-73c6-4c26-be58-92bffc0299dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134489, "uuid": "f3c33ffd-ac28-4b5b-9826-3eda3d528e72", "value": "271dd1b7b71a59842bac41e1be96b697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad29af3-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125514, "uuid": "f6ae64f7-429b-43fe-b349-a523aa407ed8", "comment": "Malware payload (Dridex)", "value": "1854b275ab21316706cc9256426fe516", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125514, "uuid": "de390a43-a072-45c3-bfd8-d1e2db5efb82", "comment": "Malware payload (Dridex)", "value": "8fbe42ee1c059fba6107bafcd16b4694952e3761fe0cd181692d90774df2a770", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125514, "uuid": "b6796074-1b72-4249-84ee-04f451ca2f60", "comment": "Malware payload (Dridex)", "value": "f8211c62b7284d330b55d8863d238d5b567167fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125514, "uuid": "d859ceab-5d3d-459e-80a2-24146c2c6ba7", "comment": "Malware payload (Dridex)", "value": "6eaa96336328479643b12ef245b6e498a47fd6bf8f88801e68550b36bdb89c67f12549a12c7e94d09ca39095fd35ee86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125514, "uuid": "d400ab1d-88a3-4991-80a4-895d7d206257", "value": "T16795D020EE69E1E6C6B89F3ED408352727B93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125514, "uuid": "1bf2ba64-d810-45a6-8f58-a5e08dcfaa89", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125514, "uuid": "c6150ad5-c78f-4dd4-b52d-2de3354c271e", "value": "12288:eVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:DfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125514, "uuid": "ee938c9e-9625-4e95-a19f-384c0b916680", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125514, "uuid": "f592aa9b-7216-4b89-8176-933b6c9c708d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125514, "uuid": "2b504e46-6026-4328-8e15-b992fb146c14", "value": "8fbe42ee1c059fba6107bafcd16b4694952e3761fe0cd181692d90774df2a770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22c5f4d-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125258, "uuid": "d99c6c6f-189b-414b-af9e-8c0b2fdf7bb6", "comment": "Malware payload (Dridex)", "value": "1320620c9475289df06f8f8fd76d35ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125258, "uuid": "4f87a9f4-a341-4f6d-9f6d-4ae2cf17ed5b", "comment": "Malware payload (Dridex)", "value": "90158b0bdab7619b464f65dce694c66324524c33f4213e217f6dde45548512a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125258, "uuid": "66d653e2-279c-49b1-9ba1-e797b006d803", "comment": "Malware payload (Dridex)", "value": "a873172928526fbbfee2163ae289cbda2fe71a38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125258, "uuid": "54bc6161-10c7-47ea-920b-2db140a2be17", "comment": "Malware payload (Dridex)", "value": "1d079f6a530d23787a9426fd01ae854f61006c6203be3fab72f65f10109a0ae58a37a93ecac2f18a3aedd5347000324c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125258, "uuid": "c82835cb-14ce-43eb-970e-1b251214d0f1", "value": "T15DA5D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125258, "uuid": "7b5c9961-26cb-4932-bd31-8d0880e1f9de", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125258, "uuid": "0b82b255-8691-490b-a26f-56aa8bdd3e90", "value": "12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125258, "uuid": "7ae6951d-e0ce-47fe-b02a-921aeeda9542", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125258, "uuid": "d60f0892-e7e9-41bc-9900-64289e35a5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125258, "uuid": "345c827d-4ae6-4a0f-afc4-d097e6c7203d", "value": "90158b0bdab7619b464f65dce694c66324524c33f4213e217f6dde45548512a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bad47a2-19c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632108658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108658, "uuid": "d3c04555-e2ef-4c52-ada1-7fa5582d6160", "comment": "Malware payload (RaccoonStealer)", "value": "a8f9a08868396c691207daaafe596569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108658, "uuid": "47492138-844a-43a0-aa02-5bbeb438c19b", "comment": "Malware payload (RaccoonStealer)", "value": "90ce980b980b372a90c20b959ee2ad27dcea764ce2e858043a8e02aa307cf3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108658, "uuid": "8a11062e-b7ae-4790-850e-1c8c85d6e6f8", "comment": "Malware payload (RaccoonStealer)", "value": "04ffa112f37475283540dcc2d970e74267c86ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632108658, "uuid": "bde86f67-8db7-4eca-a30f-cae0fe0871c0", "comment": "Malware payload (RaccoonStealer)", "value": "8062c17dca9706c28e62f59df53efb467ee4ef92690c97753cce9fe1014e8ef1cde0e2156807ddc3cfd5629da9069ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108658, "uuid": "5b128d0b-783e-4199-b618-33c57b3403a9", "value": "T154349D20B7A0C035F5F712F849B693A8A93E7AB15B3491CB62D616FD26346E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108658, "uuid": "791b118c-4e2a-4856-a4e9-742cfcb738d4", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108658, "uuid": "5122d838-8ea3-4e5c-89fa-e5461f114fde", "value": "6144:vcZQ5D+3bQqFo1iDFEfna702tR9RnKBjVPlqoLZc8:UZx3bQkonfnanLgx9/L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632108658, "uuid": "c2dfd099-bf53-46f4-ab96-d23a94fb5894", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632108658, "uuid": "155d29c4-df18-400d-82f8-8dc1b2768d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632108658, "uuid": "898a13d9-5f1a-4e30-aca4-ee796ccfa110", "value": "a8f9a08868396c691207daaafe596569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1263a06-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137765, "uuid": "6923684f-b64a-4453-b5f8-836f654c691d", "comment": "Malware payload (SnakeKeylogger)", "value": "2ce48f858b0c807ea52949db68f57396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137765, "uuid": "fa58e335-b62e-4ab5-977f-3a9f735fbe0e", "comment": "Malware payload (SnakeKeylogger)", "value": "914acf58bff82b119c46026d4f70b370262227c4964f310a3a94c6305aa7cdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137765, "uuid": "ca68c682-450b-4e18-8a7e-ac36138e9c31", "comment": "Malware payload (SnakeKeylogger)", "value": "617a0328eb9761c74591bf6b50ee48f60b8d700d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137765, "uuid": "7350a0db-4ba8-4010-9ee9-73d959a1f28f", "comment": "Malware payload (SnakeKeylogger)", "value": "484f4ba4ec3f09e1192e9bf5de541d6b7314b74af7ec29a79e33c36197edff25409d2118056fc3dbddc0b23e46a7742e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137765, "uuid": "7faaab13-35dc-433c-bcaf-296fdb1e8f7f", "value": "T17F54E01665FA73E2E5BA4FFC9D21B21047B87EA50847EE1A1E4070D81572B0153B2FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137765, "uuid": "441b5f37-44d4-4647-b005-e086379ca887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137765, "uuid": "087b2d64-eef0-4e82-9535-76c30f632497", "value": "6144:vbtvJ/xaWAKaPzcC+eWeK1kH2utFIUgW82hoMJFBC0ItFNIb2xD+VdIKDtiJpfVX:vZFxzhC+en+k/FI8F/5Y82xKVdlID9vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137765, "uuid": "a483f8d9-0284-4aa9-b207-26282a36670e", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137765, "uuid": "45d1bc62-a724-4518-95d4-3635adbfaac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137765, "uuid": "805859ed-b2ef-4606-82ea-4fddbbde5e72", "value": "product portolio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a10bf1a-19dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632120010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120010, "uuid": "47138d0b-29bb-450a-ae55-00ccc81f14e7", "comment": "Malware payload (AgentTesla)", "value": "1b4d9985eae2737b8cc344aef840ec85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120010, "uuid": "0bfc91c3-087e-450d-8991-b9f001dd8ebb", "comment": "Malware payload (AgentTesla)", "value": "917ddaf640b1c7479c4d56a975cdb6709cd144c2e3e3825ad2ba632ca19fbbbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120010, "uuid": "0c4c8fc6-e957-4915-848b-11e63f69334c", "comment": "Malware payload (AgentTesla)", "value": "e1cdc669d09958b743cf16f1fe9026f506c57478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120010, "uuid": "80344f23-81f7-4a89-87fd-834ac0ee8699", "comment": "Malware payload (AgentTesla)", "value": "59dcefce6ea5e3eaf4cface46a8fca1d0c87050b7ded597ebbb6163b63f97eac852bc96ffb749ea1ac09354d1d0a41f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120010, "uuid": "59130d3f-c046-400c-bb6d-102325aba4a7", "value": "T1D815D604A3464F45E1B2FB3692A9210E43F9F4E7E752CFBD6B494BD904A3180DA1DE39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120010, "uuid": "2b4eb173-f517-4321-b112-f5fde587334a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120010, "uuid": "2fb9ebf5-d3a5-45a9-b784-5a4c3e3640e2", "value": "12288:G3trQlL/BOZH4qOoga8weZNPRalULppwkVJvVFvVNUVc:wnnUPhJt+Vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632120010, "uuid": "b979630c-981d-4ec2-ae43-418a41c0ff9f", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632120010, "uuid": "a493d176-f282-445a-936d-23dac0e5d894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120010, "uuid": "f8a091e9-d252-48e4-8c77-bffdb8d662e5", "value": "1b4d9985eae2737b8cc344aef840ec85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa4a16d-19c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632107743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107743, "uuid": "33c18f5c-e144-403a-9b52-ea616603713b", "comment": "Malware payload (RaccoonStealer)", "value": "09314789bacf563f014d7414c276a27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107743, "uuid": "aa5e89b4-ec3b-40f0-b89e-59309530250b", "comment": "Malware payload (RaccoonStealer)", "value": "935b43a2adeee1d5e8fd4aededaa6f246766e0b8ac23303a33094740dc2d0f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107743, "uuid": "abc2ce25-99e0-4d06-9bfa-7d2556a70ce9", "comment": "Malware payload (RaccoonStealer)", "value": "0bd81bad994ba89260df3b270d8a2ed27686fa3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632107743, "uuid": "915b03be-dd11-47d9-96de-e5309f5a3c1d", "comment": "Malware payload (RaccoonStealer)", "value": "80fe758345aafbed5bb0e1dee598b6550e8099d97466d0de12e58d200e8390347a566c1f46625e76a082142fd00343c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107743, "uuid": "766c68a7-4435-42a1-bfb5-c816dc63213a", "value": "T103349D20B7A0C035F1F752F849B99368A83E7AB16B3450CB62D626FE16346E4DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107743, "uuid": "073a8c2d-3725-4c3d-8815-20f2cdb894b7", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107743, "uuid": "ebb3f1c9-dec2-4755-a3df-e861750a6aa5", "value": "6144:O7ZQjOP/QVvLL1XwFB336NvALLzMzqMdHNXc8:mZj/QVjLo33c4L82IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632107743, "uuid": "37d23243-9c5e-4fd8-a46e-b02322cc7b27", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632107743, "uuid": "2b5dba5d-0180-4e3a-a438-383878260be8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632107743, "uuid": "dfcf1c27-b7e6-41ef-8da1-fc98eb962f6e", "value": "09314789bacf563f014d7414c276a27d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c871a823-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632121376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121376, "uuid": "f75ac6ed-4a74-4488-9caa-8df7c7aa76c4", "comment": "Malware payload (Smoke Loader)", "value": "6928dd50275521dd7d5abbab0fbbdc75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121376, "uuid": "57b12252-e92d-4ada-a7e2-7209ebe11e64", "comment": "Malware payload (Smoke Loader)", "value": "949ae0d353bdca690361cdb9fe53ad53e939b2a5ef6a54a9ab152d709264ca9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121376, "uuid": "daf90d90-c8ad-45ba-8a32-ab3df9663783", "comment": "Malware payload (Smoke Loader)", "value": "8fd7f490545beeb5211d51c702c7d940cc3b8012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121376, "uuid": "8ccdd2fa-5bc7-4533-b9e1-00cda4b8858f", "comment": "Malware payload (Smoke Loader)", "value": "957a6c6ef43c338df9b91ddf449dfe47dcf4f91ff06b8df4881d39678ff2d132f30ae80bc6b51308c82b0fa05367185f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121376, "uuid": "8dc76ccd-5448-4fa7-bdd3-b34a21b23a67", "value": "T1EC349D20B6A0C035F1F712F859B697A8A93E7EB0AB3451CB62D216FE56346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121376, "uuid": "f104f510-e0ed-4fda-a795-c578c681aa01", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121376, "uuid": "e64d0433-aac5-46d5-8617-d8897f8bdf8b", "value": "6144:t/ZQFXNbJ3FOr7qbQ7UAH2FBrCxgAg0DxFTdSuWZ:9Z6bJ3FOrWVAHw3Q/Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121376, "uuid": "1ae29b98-74dd-4476-951a-40c84f11b801", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121376, "uuid": "160639ab-d878-4393-8c0a-01d60025dc0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121376, "uuid": "8a5894a1-0d52-4a12-8ea4-35b9278658eb", "value": "6928dd50275521dd7d5abbab0fbbdc75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7ae12c-1a33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632156733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156733, "uuid": "9aa3e0a5-b631-4abd-8c71-ad12c8dd334a", "comment": "Malware payload (Quakbot)", "value": "b8e26973e1ea3a93065aecf63cef24dc", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156733, "uuid": "f1ad5877-e757-4e9e-a482-04620a0b3c29", "comment": "Malware payload (Quakbot)", "value": "94d4ccaf51e8ba1d40ecaa55ade06d878a2b0d78f3c146d586cd2f401eba8bc6", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156733, "uuid": "2b867b71-ea86-4816-bfb5-75042213f791", "comment": "Malware payload (Quakbot)", "value": "1e1634509912c7d28139293e57780b18c06273f7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156733, "uuid": "3a041045-ac1d-40f1-b74b-7a4dc088b7ef", "comment": "Malware payload (Quakbot)", "value": "18ac608a048f6591cecc9eb8662fd6596dfc5c3657600072d4d4038d52b622869adb7e3c4827f59d7c265ab4eb3a1067", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156733, "uuid": "706cf84b-e315-4976-badc-31131dcb9723", "value": "T1E2149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156733, "uuid": "6d4a7cad-a79a-4d53-87c4-86e7ce361297", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156733, "uuid": "a6d37141-37d2-4d79-9b55-9294268d0689", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156733, "uuid": "6bed46d4-e0d2-4941-bbbd-21d7421a24c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156733, "uuid": "eb034764-5840-4df5-9eaa-40f30f986e06", "value": "Document_348129449-Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdf4b1a-19a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1632097471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097471, "uuid": "8a30622c-344e-429c-91e8-697a17a63913", "comment": "Malware payload (Socelars)", "value": "7385933688de140748e591d9321994d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097471, "uuid": "025d6de4-3670-4dfb-8fea-15d78adc33c4", "comment": "Malware payload (Socelars)", "value": "95788c4e856f27ba6a044d59ceb914c356cabad8be76e4da51a2acd690fa4d00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097471, "uuid": "e000cf60-1fa5-4631-aa45-f8e38b0e7097", "comment": "Malware payload (Socelars)", "value": "5c311e70a680744692abea284272b08b6dc4141a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632097471, "uuid": "d0bac123-cebd-467f-9c48-79e75b413839", "comment": "Malware payload (Socelars)", "value": "a02d0135448a6f67275d0d55f9d2645419459c7183b4dad4123744094c715476144e6ca4ce65da0ac253dcab1295a4be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097471, "uuid": "2c385344-816a-41ca-b55b-dc0f6f09f8ae", "value": "T133659F21F642D036F8E300B385FE877E9D68B625031494D7E3C41D699E61AE27A3B71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097471, "uuid": "a271e446-6d2e-4fb6-a305-83e2f5b5fde2", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097471, "uuid": "36a7fc3c-0fc9-4004-8744-e40308db7555", "value": "24576:uIVFA1pqtg/TnMbX0lwyh0FVmEByU1fwFYyOs6bQCH6S8q4AQ8Yf7v:DFA1pvTMbOwa0TmYpMYEQNH6S8cQ8Yjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632097471, "uuid": "0012c5e2-a04d-4a59-aa87-c9b8605d22a7", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632097471, "uuid": "d39acccc-363d-4066-8bd6-5b4016e7e839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632097471, "uuid": "eff7e852-9e92-4627-b200-9b55e78b048c", "value": "7385933688de140748e591d9321994d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccca30d-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632121410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121410, "uuid": "becfe20d-fd09-420a-ae2d-b857dcc9eb9b", "comment": "Malware payload (ArkeiStealer)", "value": "a4a9b253aa59a59c2040ad1dbe95c47a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121410, "uuid": "ae7fde95-b014-4ff3-b86e-0152fcef8bb3", "comment": "Malware payload (ArkeiStealer)", "value": "95cc8eb2e2e0064a0788032bec3c3bdcbd4edef6b0952e071d5dac5b29f6e51f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121410, "uuid": "ad3d6fbc-00c9-4747-8285-f592a2a3f8c6", "comment": "Malware payload (ArkeiStealer)", "value": "793d258a41c66760d38988f683e4f6696e13e045", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121410, "uuid": "2af924a5-12be-4239-997b-7f453719bb30", "comment": "Malware payload (ArkeiStealer)", "value": "31c3e3b14547dfd2ba219cd14a08eeebeed4da53a7aebb9e1f4cd5df4ea249672e5368ca1970ffe9c07502385f67da6a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121410, "uuid": "5bf0d4f3-22d6-4a08-9652-753f658c7622", "value": "T173E4F120AAE0C036F1F742F456759768A92DBDB29B3490CB62D212FD17396E4DC30B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121410, "uuid": "a882e19c-d886-4f29-9b4b-b5410f37148a", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121410, "uuid": "02bb099e-24d5-4529-820d-b7ef1bbc0caa", "value": "12288:VZ0TJh4Z5WBYbdbmCJ+Ju4F6zxuIY1ewLp6xPuXrztpVEEhkltyyGZ9+DN7d:VSTJhQRmuwyzgIIp6xP2RDklgyGZ9Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121410, "uuid": "9ed6b245-c6d1-4062-8a05-738f02052c48", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121410, "uuid": "0d07c0a3-62fd-4e7d-a451-308fba29e8e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121410, "uuid": "b9cf6aee-1639-44e8-b262-5588da70b9c2", "value": "a4a9b253aa59a59c2040ad1dbe95c47a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070b189d-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125347, "uuid": "6aa273ab-e403-427f-b8d1-14c6593ee8c4", "comment": "Malware payload (Dridex)", "value": "d9b209e948ef23ab5feca0112cbb5744", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125347, "uuid": "e9a7dfde-a915-482c-a9d3-ab32daee4f22", "comment": "Malware payload (Dridex)", "value": "96e7dbc31aa22528aada6691f684b886c4f8b2ad08357aa32939f264535a3807", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125347, "uuid": "0ae23438-cafb-4ca5-8368-6c1894efd187", "comment": "Malware payload (Dridex)", "value": "30d2ee1d88f88643c31469aa6f5ed0dc5185c61c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125347, "uuid": "9427f263-40ac-434e-8f50-b4451341ad15", "comment": "Malware payload (Dridex)", "value": "612e14972cb0880241bb50d963c5e89d9d3bebaccd70e02b404bdbba984ea58e9f90e923a4e7d84ee8aab6c35d45740d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125347, "uuid": "00b088c8-ffd8-4a9e-8544-84979a3cfe02", "value": "T192A5E120EE69E1E6C6B99F3E9408352317B93D75110D609CC391608F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125347, "uuid": "46d5e30a-4e32-43db-b4d6-38fb51b5abb7", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125347, "uuid": "fe0998cf-1fe8-4ee0-b3cd-75d3995f30e6", "value": "12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125347, "uuid": "ab33e0cd-8f8d-4620-a513-3f1988bfc4c6", "value": 2080768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125347, "uuid": "b745a2ad-3ba3-498a-abbb-c06cea868a57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125347, "uuid": "d77aefba-db44-4a44-aa16-893d47196b15", "value": "96e7dbc31aa22528aada6691f684b886c4f8b2ad08357aa32939f264535a3807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cebc060-1a11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632142107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142107, "uuid": "30319c21-5040-45c8-ae4d-4fe9176c7f51", "comment": "Malware payload (AgentTesla)", "value": "b481fd3297df2598aaa3c337e815e868", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142107, "uuid": "d89df879-180c-484c-a35a-62ac5043cfd2", "comment": "Malware payload (AgentTesla)", "value": "97c8b204e97ba3f6f28fe31d5c1459a11dde74755fa97d89cb5c133f8a91d230", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142107, "uuid": "9faaa2bb-226c-4e16-9baf-01fe09323511", "comment": "Malware payload (AgentTesla)", "value": "715f8cc9c665cb893e0d937dbdd4d81572d53842", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142107, "uuid": "44734f1c-b5eb-4147-bfba-75b05b9df24d", "comment": "Malware payload (AgentTesla)", "value": "81d8fe6f4f59a9ee983280d19df4591e732b4660741a9cfe81f0df09e5b37dc9952f1c05fab298b9c6eb9030a959ef29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142107, "uuid": "28ab55dc-1c2a-4825-8849-673f4d3ece96", "value": "T137C1A79963F94336E5B78F356DB382511278B627CF67DB6C24E8012E5C20710DE23BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142107, "uuid": "9092780a-73b6-48b5-b043-4529c13e97f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142107, "uuid": "9059070e-01f4-4816-a002-20d783397dc8", "value": "48:6ba94Pbz4efuJaXVw2bzt0nDx6wn+3I/1ewwthq8PA9iFlaoVl2FnSfbNtm:Zabz1w2bxADxPGUtAOSzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142107, "uuid": "183cc480-4177-4c65-8812-c1d7196a1d4f", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142107, "uuid": "7730a06b-b8fe-4f86-9281-6ef64c43e6ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142107, "uuid": "94edf483-eb5b-4d93-9962-64ad490ac785", "value": "vedo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f83df3-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632160624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160624, "uuid": "269c71a2-f251-4c04-b14d-e3142fee7baf", "comment": "Malware payload (DanaBot)", "value": "686e868d531352b9031c6a083c211dc4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160624, "uuid": "ce93ca26-fba3-474f-b20b-1e9df002bc7f", "comment": "Malware payload (DanaBot)", "value": "97dd1a40479b38e1c9c4d719d67087cf7b5d5cf546ec379ca153902a593091f4", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160624, "uuid": "e89483dd-0c25-4980-866a-441fcc01d387", "comment": "Malware payload (DanaBot)", "value": "2724d308565dac054db177217b9cc3b5996ffc68", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160624, "uuid": "21690361-23c4-4536-8eee-04f7a718def1", "comment": "Malware payload (DanaBot)", "value": "a5e07308c83bf9cf3ef5fe80a9ec5882171a8d7befe8e524ee0bdbd959a49e851de37e115140ef5c083fc520f6be9353", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160624, "uuid": "1eee646e-a791-49ad-b6f9-788a460e4349", "value": "T160451220BAE1D031E9B312F869BE57B8593D3E715B3451CB72E53AEA66342E48C31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160624, "uuid": "6ac926cd-32e4-4e65-95cc-3e91611634ca", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160624, "uuid": "64f50cdd-57f7-4b6b-a232-2c7fd2cb3d21", "value": "24576:u2cfxr59VRhvS0mBxy+RJKJVddoL1K2A0fvm8xSPdS:C7RVSVBxyuKoUs+1dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160624, "uuid": "478b98f0-1a3f-4b2d-ba0b-bd92d979a0b3", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160624, "uuid": "8e93e78b-aa7e-4ad0-b36d-3ab9c4c5e017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160624, "uuid": "f8788f18-ba7e-4b08-a5d0-34868a8417d3", "value": "686e868d531352b9031c6a083c211dc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec3fd1c-1a24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632150646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150646, "uuid": "304f3f8b-5833-4329-9a7d-fe43d175f70a", "comment": "Malware payload (NanoCore)", "value": "2a5bff7bd49565f71c0102375d4bf629", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150646, "uuid": "c10ee63b-db1b-45ff-ab66-89b5852e254d", "comment": "Malware payload (NanoCore)", "value": "9834ac16937d9ff37624909fd25d2ec31122dd1fda8d91c1f32b63b2ed69fecb", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150646, "uuid": "6d4afbf0-5783-4918-b63e-e7aab0ec2b64", "comment": "Malware payload (NanoCore)", "value": "2d0c6a5b6c5bcee86180cd6fd3a5dd8d22a9f287", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632150646, "uuid": "261bfb0d-9967-4200-a7c8-e5f93cc3e835", "comment": "Malware payload (NanoCore)", "value": "f26bb7ef8cf467c13ab32e155da771d17294f8ca3f08eef42ec36a70bd1ba36c009fea2202e7549ffdf4c8724991017c", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150646, "uuid": "3a4bca7e-fc1b-481e-a7e3-44ec186ed357", "value": "T1F3F11B2EE0A3D5514769C302CB98BE2C5C5D0889CA35B95CA5F36680AF30FA46A54F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150646, "uuid": "5de85ec4-997c-48f5-a205-0fedf9679e77", "value": "192:jxEFXNIFX0zREJXCIjX+ReEIX2IhXodN2cxVpN2cC:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632150646, "uuid": "baebcbe2-a7e1-4da5-8e9b-89eeed8cad75", "value": 7732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632150646, "uuid": "990b967b-7a9d-40fa-b4c7-9d426f725d17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632150646, "uuid": "eb0bb09a-c591-4c82-9944-e0e87c3d2678", "value": "Invoice #3022.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa8fe3c-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125415, "uuid": "44880d6e-11fa-4aae-8c6e-237eca64eb92", "comment": "Malware payload (Dridex)", "value": "19adf7b30e9cef2efd60c4e0b063a61a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125415, "uuid": "5d5bbf5a-8163-45e1-825f-d2b10ebb5d8e", "comment": "Malware payload (Dridex)", "value": "990f03d16bd4e8cf2b21d8addbbc9bd342b0c4911be11bb6057352faed58b918", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125415, "uuid": "bca8214c-780b-4c25-a445-eec3fe2631a2", "comment": "Malware payload (Dridex)", "value": "65dafc6a90c945bd029e40b1fabc0d8808707658", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125415, "uuid": "c8802ae3-29a2-47dd-9edc-b1cff9961166", "comment": "Malware payload (Dridex)", "value": "3681f8457fe849d0ae577b9b585aa067c1033cba8b21572e41ff67e251d356f7256f1b8322dcc6383e862cff3e03cf91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125415, "uuid": "c2515773-49aa-4724-bf02-1d237611da32", "value": "T12595E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125415, "uuid": "4b7d6148-e36b-4b50-b897-02c9fed5e21c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125415, "uuid": "81cd3212-179e-47ee-baf7-22958f216c5b", "value": "12288:pVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:IfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125415, "uuid": "1a3fef4c-61cf-475c-b81c-624161ee88fe", "value": 2043904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125415, "uuid": "01df04df-611b-4476-8e4e-9d3638afa4c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125415, "uuid": "7b8598aa-f6c5-4b28-834a-90365d341c53", "value": "990f03d16bd4e8cf2b21d8addbbc9bd342b0c4911be11bb6057352faed58b918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fb1a3d-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632125187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125187, "uuid": "5254a79f-1b74-41fc-9221-ab1d00132852", "comment": "Malware payload", "value": "25d68f55ee8b6a3b0a1ccfa8a364aa90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125187, "uuid": "4700a591-976f-4b52-91ea-24efb1153304", "comment": "Malware payload", "value": "99f3e7882462acdde4a5da9fe0839dc4cfbc2eae8edf0786db5f2b0f73130882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125187, "uuid": "ed56be29-0b39-4efd-9db0-bbb38cad4c8b", "comment": "Malware payload", "value": "d3651fea239a834bb9269f2eecc0dfb0477702a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125187, "uuid": "a0532c38-43a8-422e-8ca1-f75defb36c77", "comment": "Malware payload", "value": "565b60cff7f5c1b878efd8f7871b9b178555f975a7dde21ec58ec8164ab97d4ca825927493bfcd2e80209a9267a9966a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125187, "uuid": "42dfac68-cbd1-4d5a-9005-cab342b5bf69", "value": "T156A5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125187, "uuid": "025c813c-1809-4edd-b7b0-d6ab4f9592a6", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125187, "uuid": "a63b9403-de07-4978-92e0-7fef29c2dd56", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125187, "uuid": "0392a355-fcad-4c6c-8280-b216cf4a0898", "value": 2150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125187, "uuid": "f22701c4-7e6b-43db-b840-da266e4191b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125187, "uuid": "1f56cebe-cc60-4b64-9660-026cd76a1204", "value": "99f3e7882462acdde4a5da9fe0839dc4cfbc2eae8edf0786db5f2b0f73130882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57a9d7e-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125290, "uuid": "7eb208f2-cc00-484f-aaca-466b5c5548ff", "comment": "Malware payload (Dridex)", "value": "13c1c3c96603508338d0728dc344b776", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125290, "uuid": "a711bff0-1efd-4a54-863c-ab6d92d4a725", "comment": "Malware payload (Dridex)", "value": "9a5f28b3e88ce40126ccea06a6397faf22a64d759ede53a20236b16ff31f6ec0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125290, "uuid": "fcf2a617-14a3-4981-862f-8394bbc4cb0a", "comment": "Malware payload (Dridex)", "value": "13825891524b76d46ad327c534f7f3fd78d28b14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125290, "uuid": "94447ecc-ed7b-4d5d-a6dc-91eb01ca812a", "comment": "Malware payload (Dridex)", "value": "fbbc412461d70679e9af7e572d06f4319a869dc52e7f51babcd064e6ff93f586401515e6af967afa8e665a41ab1f953c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125290, "uuid": "034e6a42-d0f7-4bee-bdac-9c3773745bf2", "value": "T175A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125290, "uuid": "b60bbecc-f9c4-4a5a-b390-d9238e8c0e1f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125290, "uuid": "3a024555-5edb-44ab-a0a0-399d83c6e7dd", "value": "12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1i:afP7fWsK5z9A+WGAW+V5SB6Ct4bnbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125290, "uuid": "dabff2c6-03a2-4142-98eb-878a6aba24ed", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125290, "uuid": "d6d20826-5f47-4784-97f8-e66855411e8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125290, "uuid": "3fa79a3c-ece6-410d-9d71-ba6b2b6edc63", "value": "9a5f28b3e88ce40126ccea06a6397faf22a64d759ede53a20236b16ff31f6ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc26f00-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131398, "uuid": "48f7a0bf-7d63-4739-a593-ea5e99295ec0", "comment": "Malware payload (RedLineStealer)", "value": "d441d6c4f001dfc617a8f23f9ef2170b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131398, "uuid": "c928117f-898b-4069-9905-8bbedec879b3", "comment": "Malware payload (RedLineStealer)", "value": "9a62aca3402b4999b3db621daa96af02e7cd5d2059d0e99fbce5e39c034e6146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131398, "uuid": "4c2c6ea8-8ef2-4917-946d-b888e9dfca57", "comment": "Malware payload (RedLineStealer)", "value": "003146fa82aada03297535f4e1e268cb62edcdfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131398, "uuid": "f5a9f077-ca84-4cdd-b63d-d9a69203e29d", "comment": "Malware payload (RedLineStealer)", "value": "31321dd7ae4fc709fb2d3aa7d01910b95945fc7d982ad8ccbed3218229dd7a731d823b6413e3bec1ec52428ba14100ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131398, "uuid": "64ec8b70-3682-4bc5-b98e-7b3bca25bc38", "value": "T15305122275D1C032E96315709CE8E336FDB9F5709A75A58F77C44B2D2B31AA2831AB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131398, "uuid": "fb0d254d-05fc-4dff-8ff8-415f8aaf85b9", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131398, "uuid": "78c19b11-769d-4e8f-b33d-649994a841da", "value": "12288:oY20AljdZgBPfKfm/c9twQxAogJfqsUsz0cX0JWQK5qY/CNzgYMmBXF:t20gPgFKaOwQxAVBbIcXIWWHNDMmBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131398, "uuid": "75335206-63b9-4de3-a4ed-b89a637319dd", "value": 857459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131398, "uuid": "4f9eb433-2b39-469f-b40b-063e315118ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131398, "uuid": "ac5db164-19e8-4ce2-a729-d8d055b9ac95", "value": "d441d6c4f001dfc617a8f23f9ef2170b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983bb6f6-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125590, "uuid": "79710363-5d06-43a6-ba04-8c94d516999a", "comment": "Malware payload (Dridex)", "value": "56edbfb312bfb115f008511b9efe50b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125590, "uuid": "fda07121-2f4b-46a9-a242-cef93e84042e", "comment": "Malware payload (Dridex)", "value": "9b03a3773e7bdd189ef5a202d12accf40e57c3f6d1ebddb7162e09bd65c4829f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125590, "uuid": "f90ed111-6666-4300-9314-e78b77ea039d", "comment": "Malware payload (Dridex)", "value": "5580e23ce7c57746776911e6d7256ae354cbca8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125590, "uuid": "8f23a67e-bec6-4bb9-9ddd-d14951e062ae", "comment": "Malware payload (Dridex)", "value": "be020831c6cbbac29d5ecb9cdc3877da6b7b3c2061590388047ea5e74433655ae1f363415fa19799773ab03a9d726ff8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125590, "uuid": "94513583-bfc9-415b-bcb4-a184322987d2", "value": "T10F95E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125590, "uuid": "f9d45528-f869-4455-8ba8-1ef6a3b54624", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125590, "uuid": "2b83c1b5-6432-4857-854a-2bfd98404eff", "value": "12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125590, "uuid": "5ef476e1-4394-43c1-8760-99055f817fde", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125590, "uuid": "db4f686e-e906-4e03-83e5-dbca46da570e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125590, "uuid": "7e0489b6-e876-4405-a192-c729a36eeb90", "value": "9b03a3773e7bdd189ef5a202d12accf40e57c3f6d1ebddb7162e09bd65c4829f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c4d06e-1a3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632162251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162251, "uuid": "48aaa943-63e3-4468-adab-6781ad8a5708", "comment": "Malware payload (njrat)", "value": "f3bc5f7625cfb7d4f44f784561b05faf", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162251, "uuid": "0dab3221-61c5-4932-bfa2-49ca2a339e97", "comment": "Malware payload (njrat)", "value": "9b08fe9109b0e4b68f52624894d0ea9261f4a434f07d022f2d2b2d7c12877460", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162251, "uuid": "e581edef-f4e0-4816-8115-82619f230d8f", "comment": "Malware payload (njrat)", "value": "8831e8de10c1365cbc23bf50b96b6292fd09af29", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162251, "uuid": "7df79347-370d-4fda-8398-9d0b3f8109c0", "comment": "Malware payload (njrat)", "value": "40359a0d3cae641b5f26b0dd85e8eaedffed6c0f27fbc51d2c8968268be1cbc88e973d7727af5311bf6348a28ac650a0", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162251, "uuid": "c4b0315d-8b2b-4259-b0ba-4b3487b0b69f", "value": "T111F12D2EE0A3D5514769C312CF98BE2C5C1D0885CA35B95CA5F36680AF30FA46A54F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162251, "uuid": "0c11a938-e805-4ca2-8fa5-f6c00af57b86", "value": "192:jxEFXNIFX0zREJXCIjX+ReEIX2IhXodN2cxVpN2cC:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162251, "uuid": "451f6464-131d-4e61-91f8-a85fba900e6f", "value": 7741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162251, "uuid": "ceed468e-61c7-420f-996c-d9857da1a083", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162251, "uuid": "154e2b84-f1c3-46f6-8bc9-0e887ee0205a", "value": "INTERAC PAYMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2c3aff-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125486, "uuid": "0331bf63-20ee-4c9d-9b0a-a55fc52a3159", "comment": "Malware payload (Dridex)", "value": "71202557a44f4c493bbdce334ac550e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125486, "uuid": "eb8c1ef8-cb04-4aa1-a9bd-11dbca41f76c", "comment": "Malware payload (Dridex)", "value": "9c4e8521bb0e96fe6c5a1359d086dc6ce8dd389a27ad787c6ca1c87966b14d1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125486, "uuid": "d96eb2ac-1a60-41ae-b2d9-3a9cd2425b6f", "comment": "Malware payload (Dridex)", "value": "1f853fbff851697f1695f9c816cabf2ed4a256f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125486, "uuid": "5bc7f23d-640a-43a4-af9b-06dbb4bdf94f", "comment": "Malware payload (Dridex)", "value": "55acce7be4c37d7abd03c6d57daefc9f5749c5964d69c31a37cc2fa05657768f1a772fd2f250d9f7c7e7cab96878ee91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125486, "uuid": "4a587fb1-e20e-4fcb-bdfe-aeda521fbd38", "value": "T1B495D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125486, "uuid": "7605e383-92fe-447b-a8aa-e7e63007b339", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125486, "uuid": "dd821bd0-f6bc-4921-8b37-bddcfc6cc8d9", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125486, "uuid": "9d525d8e-2519-4b07-924b-aaffca1893d9", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125486, "uuid": "16b85b74-bc09-4a17-be2c-b5e0a4b15733", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125486, "uuid": "6deae9b2-0723-488f-8611-d43d7a73b4ab", "value": "9c4e8521bb0e96fe6c5a1359d086dc6ce8dd389a27ad787c6ca1c87966b14d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286afdd7-1a66-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632178660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178660, "uuid": "943bdf7e-e31b-40b3-b228-2350bfe34afa", "comment": "Malware payload", "value": "fa0469c74632450ff280cda736e3b589", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Process", "colour": "#5533DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178660, "uuid": "60d538dd-5878-4035-915f-02a9347c689d", "comment": "Malware payload", "value": "9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Process", "colour": "#5533DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178660, "uuid": "5c2fb5bc-707e-48da-b361-d3cf5b2cab41", "comment": "Malware payload", "value": "2a125739fc91b38f69c021d8c1e9f66f15da7c1b", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Process", "colour": "#5533DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632178660, "uuid": "9bc57093-eb69-4fde-89f8-b55b86f66018", "comment": "Malware payload", "value": "08e4cc83ada8c4c5959a6099d74b4caf8d54cefce26243e55622130f2891926adc0a20ea7f96224c238848c73c7db23a", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Process", "colour": "#5533DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178660, "uuid": "5074dbc5-df33-4905-8b2e-25eec0c8322a", "value": "T154C49E36A2908833E1233D759C1FA66C68297F513D3568162AE93D4CBB347C6352F2B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178660, "uuid": "26e07d2a-254e-4902-8176-3cf336a43e32", "value": "38ad9792f7fa6b6ac1e23d8fa5be56e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178660, "uuid": "64cdc3b5-b83b-4687-a02b-5623a9f68690", "value": "12288:3zs+9JTcoiUi3vD/aL9x/KNRODP9aXnRKYxjv55qeY1iWGQ:33vti3vDcx8R09aXRl7555Y1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632178660, "uuid": "32bf5e6e-c624-4a47-a8a9-d22fd6cb3074", "value": 589640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632178660, "uuid": "4993726d-de28-4851-b27b-e127225da011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632178660, "uuid": "9da260b4-5cf4-425c-aa28-92beb9b71c0d", "value": "adobe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf0787d-19db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632119208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632119208, "uuid": "be70f1f9-949d-4b6d-8006-b6924af6b83c", "comment": "Malware payload (AsyncRAT)", "value": "7723e7e14bc45785d5997974792fbd09", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632119208, "uuid": "6aa1c5df-2526-4276-a7eb-beb492064671", "comment": "Malware payload (AsyncRAT)", "value": "9cb4e02039b434c4bd42fc35380a65b7bd949b611c7ff9c8593220485aa3d35a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632119208, "uuid": "26723a67-2454-464b-9de7-cc9f3b632b4c", "comment": "Malware payload (AsyncRAT)", "value": "8580b6b47c2fcef3bf02bce31acde6522b331a87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632119208, "uuid": "21f262a5-7aae-4d3f-b48f-c8f499c94ad0", "comment": "Malware payload (AsyncRAT)", "value": "11905379612f880dacc344d7119e95538d1b664876e3e172214030443e39746349686b028c35457116713e4586214b92", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632119208, "uuid": "eeed411d-8fcb-4edd-a8b9-b77f6e5485b6", "value": "T12A5402012B98A763DA3D0FF8A012190013B0917E3931FB899FD635DB5AEABD44653F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632119208, "uuid": "b33ad5bf-c06d-47ee-b5e4-afb039ab5073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632119208, "uuid": "4901415b-6c00-48a0-a7e0-220e38a57df1", "value": "6144:SmoR/sIMrHoeNUChiGYE2vHzOh5m8w84ced8R8ryqnloR+Wdn1NlIl8Zxd:Smb9WC0LEwKjCd8RoyqnY+Al+8Zxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632119208, "uuid": "b758133a-ddd8-420c-b16f-e378cf0bb7b6", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632119208, "uuid": "1f59def5-4ae8-4754-a79e-f3d094f15a1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632119208, "uuid": "8df2742b-a860-40a4-b226-368cca557924", "value": "PO1104994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b640eb52-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131654, "uuid": "b731ec34-be7e-47b0-8bb6-031454e2af3c", "comment": "Malware payload (RedLineStealer)", "value": "54e127a42f86ce2577e926a8c178bcca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131654, "uuid": "9b36e03e-41fb-430e-90a5-2e1a25a18470", "comment": "Malware payload (RedLineStealer)", "value": "9d74e360e7cc12d3a64b12365c2467c0ff10949e54c4065470b7f4ca57fa3395", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131654, "uuid": "9c284b3c-fd18-4fcd-a6dd-fe05e79a41bb", "comment": "Malware payload (RedLineStealer)", "value": "ea29f519e20284d265ef241714f02ef1c88cbea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131654, "uuid": "5fa1a7da-191c-434c-8e85-9377c1405a29", "comment": "Malware payload (RedLineStealer)", "value": "d44e49ab8767e45bfae665bf3da29917594f903987e6a93c5d998548f55d73f8342c5e707a0f71bcb95af6855b79e8ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131654, "uuid": "88e31020-afd6-4510-a1bb-09710636b2b4", "value": "T18DA5011652A86289FAEE0F328A7672B15832FD5A7950C53D5033F37E48397C56E0239F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131654, "uuid": "0ace0eae-f89b-4e06-a437-7ae39368065b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131654, "uuid": "051dfb2f-9582-42cc-a89c-3c16402b8452", "value": "49152:WCF+Xo21Ik0bbLWBONQOBsCEnnzVYU7h+IgM1cD:W6So21I/PcL2EnZl1cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131654, "uuid": "171a727f-c51d-426e-8dbd-4cc18f55ccbe", "value": 2086736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131654, "uuid": "9d20c9ef-eec6-4bee-91bf-2b0785ca5afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131654, "uuid": "8d28fbb0-c834-44b9-adf3-430bfe7bec35", "value": "54e127a42f86ce2577e926a8c178bcca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739d1b16-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125529, "uuid": "50940555-9724-467e-a631-686f3c9be479", "comment": "Malware payload (Dridex)", "value": "62730a8b275508f229132de59e6bf965", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125529, "uuid": "0f82d303-17a1-47bc-86ef-7525f9ff98f6", "comment": "Malware payload (Dridex)", "value": "9d807b2d0f25b251c8ee8b0c788159062af4ac4b734f08c96ead93a8a5c4ddc2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125529, "uuid": "e87bcf17-1846-410f-a15f-a7860dbacb68", "comment": "Malware payload (Dridex)", "value": "b29f28ec7b8d1f55f755e8ddf418bb0ad7a48d84", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125529, "uuid": "5210e23a-3478-4266-ae3e-221bd9cc8eb8", "comment": "Malware payload (Dridex)", "value": "a5d6f3b69383eef56636f5ba03ce9ed0937c1f32d428e082a76aef010619c3ed2e41f5f54daf63b47581c5958ca66205", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125529, "uuid": "e2fb5035-317b-40b3-a888-517534dda2c1", "value": "T1B595E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125529, "uuid": "c51a1826-73ad-417f-b57f-7aa0d2db0355", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125529, "uuid": "0ac3c4ac-9483-44f3-98d2-0ee58ebf6efc", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125529, "uuid": "6016685d-9ebf-4a73-8279-219422e5f561", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125529, "uuid": "77645b74-b32d-4914-8066-d09ff4f36359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125529, "uuid": "e1818eab-eaf4-483d-ba81-9bb63ef4adb0", "value": "9d807b2d0f25b251c8ee8b0c788159062af4ac4b734f08c96ead93a8a5c4ddc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ae138b-1a56-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632171759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171759, "uuid": "b49e433a-df55-4bc8-86d3-bf2a32c69288", "comment": "Malware payload", "value": "3911c8d211f9f9beaa2eec75b6aa5fb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171759, "uuid": "c0944bbc-c4b6-4851-ae82-f545d51c600c", "comment": "Malware payload", "value": "9f7b738f2ff2ae60844f22c5b4e6e6b42312c2f5f32b3992dc65e5ac6d7a177b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171759, "uuid": "1e8e981d-abea-4af9-8157-28739d48123c", "comment": "Malware payload", "value": "f4ebea65a8d3e27569ee7f78c6ef05871480345e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171759, "uuid": "f7067640-7205-42b1-8008-f95c2c7ffec4", "comment": "Malware payload", "value": "4c90ce8ec2be050601d01f5a20fa7b6023d394fe76cfbd683c5fb93b5e993312b60b1c5bfd9121e58b5538f8dcaf519b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171759, "uuid": "0934b3f7-1853-4dd9-b424-0c0aaa167fd5", "value": "T11FE402207AB1C039E5B746F50AB9D378A93E79B26B2490CF22C517FA16346E4EC31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171759, "uuid": "a4d89982-13b1-48c1-9fa2-a1bc86f4324e", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171759, "uuid": "d3bd11a9-835e-4ad9-ae1f-56263f446c5d", "value": "12288:VuPvHgMLkvV2CYGSw1ZvRrqUkLhWfbuYGzgJRiDLtV/PvqVpRzmPlnCksRdt:AvxLdGRvd+FWDuYGgRiDLbqVp0tCxRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632171759, "uuid": "30481ee5-7c7f-40ae-a7e8-76891bbfde64", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632171759, "uuid": "40fc01df-5e9e-4763-a904-4b95bd42509e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171759, "uuid": "3c99ec21-c4a5-4091-8171-c47ba0813454", "value": "3911c8d211f9f9beaa2eec75b6aa5fb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acfe55f-1a39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632159310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "36539338-b207-4fb8-8f6d-35cf5fe298b3", "comment": "Malware payload (AgentTesla)", "value": "859844cab58336875049674df2673fea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "b3ddd095-b423-4d74-8c13-c92a5dc3e851", "comment": "Malware payload (AgentTesla)", "value": "9fbeadaf544ed557ddd2d1ca3adc1fc4fb15e20981f313e1ed28b7afd3ce296e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "d2b1549b-3b03-4127-b7d2-1445982c52b2", "comment": "Malware payload (AgentTesla)", "value": "3589fa15090814d4ef24a09734181b06488349c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "fb34192f-2870-43d6-9bd5-fccf87f3e6a8", "comment": "Malware payload (AgentTesla)", "value": "b423d6f343ff315cab13220dc65939337bb0a80d82e63709db959481a9a9a477f2535539af95edde2a7529f8665e17d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "ee217fe4-7077-4dbe-9651-2a5de7982569", "value": "T1A6058738ED0B21B7EBA6D334E4BA590AA5F418BB33349D5EC192774D090760374DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "7a67b025-0b9c-4bdc-a8f6-dda3281fd92c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "517e4f12-a811-4eab-9d9f-a7c1c6b9d0b7", "value": "6144:hy87fViis7lBGy4ttJJqvAYC9NCzkTEy9Z2eoUxo45QCaiAZQjSaVWJI95brGWbl:a4tHJSA5Zo5eUTrQjZWJWGW19tpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159310, "uuid": "bdee1a39-e44e-448b-84c1-204dfe7579e3", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159310, "uuid": "450aac0a-5fe8-48ec-9d4a-2cf45f1ba32f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "519aabd4-e69d-4476-9d77-d9deb1e8f8d0", "value": "859844cab58336875049674df2673fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25aa8d0a-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632160617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160617, "uuid": "010f305f-bfb1-4a00-8d73-51331404753f", "comment": "Malware payload (RedLineStealer)", "value": "c565a3803c260de03824dfc3a29ff44c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160617, "uuid": "8798102f-1830-418f-8b9e-a0d56b7812a9", "comment": "Malware payload (RedLineStealer)", "value": "a008bb0729de684e5924e241190f6ac3d3fcc780cc409449a594e4fb9a1e8bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160617, "uuid": "ce4db650-2edc-48ae-9e20-d708cb6ea114", "comment": "Malware payload (RedLineStealer)", "value": "f0ab6585fd5fcdb1a9bd4eb2e53f39972db79c4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160617, "uuid": "d7409e49-94b8-4765-a07a-c04249099e46", "comment": "Malware payload (RedLineStealer)", "value": "39db64fd438830f7c97ad3feedc69fa452693673cbc24ee48921830bc7bdc24802176ee96cb7ca769bc0dfd871b3a09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160617, "uuid": "eec2e97b-0cc6-4b2e-8b7b-92791fc69895", "value": "T13474AF20B6F0C835E5B712F459B993B8A93D7DB05B20D1CB22D2E6EE56342E49CB0747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160617, "uuid": "d40b028a-6bbd-4bef-af5e-0cf51c6ea633", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160617, "uuid": "d356fdf3-ca71-4806-af77-3a0d4c292133", "value": "6144:MM7lZFG2m+mI4ursqvQSZtTKs8Avm07vwxS4VRTaTem4AlFMsO9ZFOsfmW:BBpm+mTurnPZt2RAFIS4VRUNlatZFxmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160617, "uuid": "0b0ca012-0533-4a08-8f48-b6a3ee01eb19", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160617, "uuid": "a592a803-5c84-4b2e-ba66-716b63f290f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160617, "uuid": "d0b0a906-2d99-4bab-bc8f-c67641e5d965", "value": "c565a3803c260de03824dfc3a29ff44c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e59b1b-19de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632120278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120278, "uuid": "904e3c37-b382-45d2-83a1-897ce603a3d7", "comment": "Malware payload (Formbook)", "value": "f3cd05456f93b132ced1cea2934691e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120278, "uuid": "2be94bc8-6fd9-46da-a2fb-84ff49d9f399", "comment": "Malware payload (Formbook)", "value": "a0d1e3fbe11fcbbea9dcad1880e23ea531c01c20fbbf383174cd420349657a01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120278, "uuid": "7037e0b9-9e3a-4484-a1e4-1b7b5307ccd4", "comment": "Malware payload (Formbook)", "value": "f08bc30497f3265d749d029a0d26f74982af22ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120278, "uuid": "92d49584-2c63-4570-b231-b407446036fd", "comment": "Malware payload (Formbook)", "value": "0eebc25e06ac6625177e971b0aac79232ee43dd6eed4d2c4d6c81cf6edb4657966fbd262bfb685e1d2c7f3bbaec0fffb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120278, "uuid": "3f8f17eb-a441-48fd-8efc-e8862e63291c", "value": "T1B5B4222A72B82F56CF3C5BF06234049097B1621BB1A1FB194FC9B8C76D99B55C7A1E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120278, "uuid": "648de830-1863-4686-9c53-499616a58b22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120278, "uuid": "825e595f-64fa-407c-9e94-dc11643c3fb6", "value": "12288:pyp0eOoRD1XhQSkiOeIaqBUyB6r5Pv+WwakIscOf8bx:pyeenX+ribm985X+HNUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632120278, "uuid": "78f66e4c-ade2-4e85-9f9b-0285db2b48c4", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632120278, "uuid": "8b566a6e-4ceb-4bc0-9f3a-3a8f1e88271a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120278, "uuid": "3e89d91e-e1ad-4ab0-a75d-1f39c29644b5", "value": "f3cd05456f93b132ced1cea2934691e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25249f01-19b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632102634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632102634, "uuid": "949ac403-9b61-4af0-86fc-971a90b405e1", "comment": "Malware payload (RaccoonStealer)", "value": "69f17b2dfb7dc4362114a6fb66aa8df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632102634, "uuid": "302ef686-dfb9-438e-a63a-8eaa688bb9f3", "comment": "Malware payload (RaccoonStealer)", "value": "a10988cafea84ff676e2f8a3c24f9a4f6af043e30437a0673bbfed5034c764f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632102634, "uuid": "d12c5789-f572-48c1-bb70-ce5d4b7a7a2f", "comment": "Malware payload (RaccoonStealer)", "value": "ba355aa4390f5f7300e79c13156b535e8cc97764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632102634, "uuid": "17191dd5-fe9e-4f15-a6c0-a22657aa2d45", "comment": "Malware payload (RaccoonStealer)", "value": "e2f4042905eeb881d74dd3c64b350816af6aae8841ed9a74aae3e18dd6a19c4a01eec21e9238830767f8c23b3d46475e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632102634, "uuid": "c9788e83-807d-428a-bec8-962190dcfa27", "value": "T15EB4E030AAA0C035F4FB52F849B593A8B93E7EB15B3051CF52D616EE26346E4AD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632102634, "uuid": "30906ce0-9da0-4f3c-9317-89bc893745d2", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632102634, "uuid": "b305a635-c46c-4d88-b8ee-1779e870a6cb", "value": "12288:5ZnLU002CWQER9WXHJ2dXHLnWiJ/EsQI1z:5ZLU0XcXHJ2dXHLn9MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632102634, "uuid": "31964c9e-8f36-4926-8d6b-98e221d4cb57", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632102634, "uuid": "aa1c4b4e-1ab9-4136-9460-6b3e909bab6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632102634, "uuid": "3726bb5c-54ec-49af-a59c-e897152a0b62", "value": "69f17b2dfb7dc4362114a6fb66aa8df6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522a2b43-1a11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632142223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142223, "uuid": "edec06e5-4fd4-446f-a7cd-73651debb066", "comment": "Malware payload (Formbook)", "value": "6e1476a40e4f1b65294f5ff5df9f99d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142223, "uuid": "8851523c-aca8-4561-8dd7-33d2e758eab2", "comment": "Malware payload (Formbook)", "value": "a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142223, "uuid": "75e0e4e8-731e-488d-89a2-e4eda1df439a", "comment": "Malware payload (Formbook)", "value": "da3f2a6fb40d243ece92534253c79c2669bd4e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142223, "uuid": "0e1fbf09-d131-46a4-8648-6bdc28cd5ce1", "comment": "Malware payload (Formbook)", "value": "1942540f36805b4ad7cf5f5a62494e39ca95b7dd4001fe3db0bdb62778a7903cd136175e0de71dab75a78a512dc3a41f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142223, "uuid": "332eeb68-d6ad-4152-aa7e-b7dd425e1c3a", "value": "T1A205C0202264C26AE1FBE73CD4229471CB3EF987A036D99E5DC3D9DA0D25341851BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142223, "uuid": "a0033589-ada5-4242-b8e6-ba8acb7ad199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142223, "uuid": "64564122-0114-438b-bf40-bfb6e32fbac2", "value": "12288:MBGiY6HGeFuL/LlsOTb7SSYCkdfejQ0hu8s9Tc9wEFqiOxtmtiK5ocFh4x:MA6meFuL/LlTYXRp0Q8s9Tf13+FocFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142223, "uuid": "2e663d0d-1124-4bae-89ab-1f4e585dc4bf", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142223, "uuid": "b9eda577-bbed-4b54-867b-63919aee906b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142223, "uuid": "25d3c74a-9374-4343-bd32-77e9d2dfd272", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec20287-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632125440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125440, "uuid": "c72a01dd-bb35-4954-822a-d27571773e45", "comment": "Malware payload (RedLineStealer)", "value": "b0af040697dd94c38fdec8c6faf0e7ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125440, "uuid": "d7ccc9d9-092b-4842-ae02-fd7713f4f3c9", "comment": "Malware payload (RedLineStealer)", "value": "a24441968ca077c1815b1b038292951ceeb8346bea45d63f87360354be9b6c8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125440, "uuid": "74ca0282-b1ab-409e-b0b3-66f5ff65b8d1", "comment": "Malware payload (RedLineStealer)", "value": "694a70a5451c5719f1cc8f60e3a5982251ada1d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125440, "uuid": "2b83f664-fe21-4890-ac51-e80020dc286f", "comment": "Malware payload (RedLineStealer)", "value": "0c4cb58127048e9744a7c29d5a899b749c0f6681ae94eac8fb1fb23d2757835a7995503cd1a5557d66b2d2abed6b12bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125440, "uuid": "4b3617a7-bb3d-4375-af16-a5e1f8b182e1", "value": "T1FD64CF207BE0C036F1F712F859BA8368A93E7A715B3490CB62D616EE56346E4DD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125440, "uuid": "550572c8-4616-44c7-bb86-098500c7901b", "value": "99e1335f3817517f11962dc50cb29aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125440, "uuid": "609ed847-e422-46a6-8782-c7ffc1d0a4c9", "value": "6144:G2ZQ5PZjG6+FIeWFF/0PUy1eYi+sNgDmZO3yUv08:LZOjG6+FITz0PZ4fgDmZO3yo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125440, "uuid": "c666caca-eb98-4e97-905a-a5d43f6764d6", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125440, "uuid": "35954db2-00b2-41b0-b1b2-64ca4a5e02d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125440, "uuid": "a5d58ed0-486e-4dfa-8739-427d5e69a8d7", "value": "b0af040697dd94c38fdec8c6faf0e7ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7fbe55-19e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632123044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123044, "uuid": "346961a0-1eeb-4acc-9f3b-0084db8eca94", "comment": "Malware payload (RedLineStealer)", "value": "5aeb767b510b7f98e34bacfb48ad6aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123044, "uuid": "40743c98-0605-4ce6-941a-af50f526a1a7", "comment": "Malware payload (RedLineStealer)", "value": "a354c672e502b1f84041b96c0db87f9f63868908ab01a9d993476854de4834a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123044, "uuid": "ab3fb4e0-c8fd-49db-a1ab-c083227ffe2c", "comment": "Malware payload (RedLineStealer)", "value": "c76d2a201687988213bf097e07db45a840131025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632123044, "uuid": "e06b0e7f-949c-4185-ae37-1de87a58ae12", "comment": "Malware payload (RedLineStealer)", "value": "ec38b7baaba2b23c8fabaf87e7280602abb9b5c5127b13fffb847bf0870944b2accd624d8398188393551f26c629b607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123044, "uuid": "2e31b973-00f5-4cd3-861a-31bba95a1138", "value": "T1CBA34A3913BCAB35E6BE6B752471161583F8E08B5812EB5F9EC014DE2F23F41A6542F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123044, "uuid": "ed1af2e7-c0f7-4c68-b064-9dd408a5bd74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123044, "uuid": "b3f6de93-59cb-47ba-a03a-6626c092e484", "value": "3072:WXqVF3iofVp8CHXbA7m8PYU0ymdwzpsd:Rs7meYlyt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632123044, "uuid": "6e5c0c27-8239-43fb-ae5c-6c953476104f", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632123044, "uuid": "fa6d4d42-6a3e-4d07-af3b-04a3c5f3e957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632123044, "uuid": "0c001fa9-9301-4ba0-8dd3-0887e1855131", "value": "5aeb767b510b7f98e34bacfb48ad6aee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c91ad1d-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632146187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146187, "uuid": "90dcfbca-8f32-4306-9f91-d55c176a1afa", "comment": "Malware payload (GuLoader)", "value": "c666c22685d135c1efe709cbedd0eb6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146187, "uuid": "b4d84bb2-0576-4dbc-9fb6-0549bab26223", "comment": "Malware payload (GuLoader)", "value": "a393c2aa773ef090f5e907c90c5cf90d67c2b6db2a2ffedac0b75c748f3a7b45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146187, "uuid": "58ba80ca-a8e9-447f-bb21-77eb00da2acb", "comment": "Malware payload (GuLoader)", "value": "0da7aed60d8a194da98c44cd5ad76efc57e00dff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146187, "uuid": "c1756a0c-eb83-48aa-b017-6861b3cc88f4", "comment": "Malware payload (GuLoader)", "value": "1c21ecde3b167a968cb31f3e5ec32eb0d928568a716b9ad0fa391126a29f9d7acb5eaa3fe3258b56347576f6eda08f16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146187, "uuid": "5ada0577-d687-473f-b643-02d35cfcc597", "value": "T166836C9966F86EF3E456667C04E676B44306FC130925BB0F9844BF2C7B31A02E768A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146187, "uuid": "dea222b0-c5e6-4412-870d-376cee2f0560", "value": "40768f14753bfb2d577d092577251956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146187, "uuid": "b3e578b1-bf74-4001-911e-b3dabb60f5f6", "value": "1536:/TJxxcRTQhxdpIElhB5IdO5w9VRvk/wD:iqxdpIElpnw9fvk/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146187, "uuid": "c8ebe9be-5da1-4b8e-a9ea-343c01a4235a", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146187, "uuid": "7fbe9a5a-c7f3-4d22-b8be-9579b06d58ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146187, "uuid": "12cfb5a0-e08a-4752-b883-6c3a7e808064", "value": "c666c22685d135c1efe709cbedd0eb6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0319d5f-19bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632106303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106303, "uuid": "2952b31e-41eb-4749-9d1d-74a999b83463", "comment": "Malware payload (SnakeKeylogger)", "value": "8f51350565372c90c6287fc56d312e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106303, "uuid": "e0dd51a5-5c86-4289-8ba1-ce77e72ea08f", "comment": "Malware payload (SnakeKeylogger)", "value": "a4b233fc40d4dc87b1b0083d75934909ec0fab27bc718a83428f679747128c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106303, "uuid": "0505a0bf-bd92-434b-86d3-8f2cba485c24", "comment": "Malware payload (SnakeKeylogger)", "value": "30c4f9d4ff8407330e0a7e999409b1076f77c045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106303, "uuid": "be484645-623d-485d-a799-7cffe3a7505f", "comment": "Malware payload (SnakeKeylogger)", "value": "795510e7ba97eaa740738de81756a12448ca15e71ee5adeee70f549ef021dcf97fffa8e04a22bcae88b869c100353078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106303, "uuid": "12ff4428-9f36-4542-a80a-160d565b4fe4", "value": "T167943A693B385EC6E514883CA95D11F896FACED2D7D4E10E74F0798C2EB28734D1326A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106303, "uuid": "0e57cf7b-fff2-4689-a127-43a34b771711", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106303, "uuid": "85125d46-8088-49fc-825c-6902909ff6ad", "value": "6144:I8LxBw/vYgoa+ojiIQ9lLB3/zt0nyM9LWzB9u4QRLxFekUwSzML:Awgoa+ox0jmn19qzB9u4QRNFekU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632106303, "uuid": "4518153f-0d9b-4034-a9ee-b44ebcace4ef", "value": 433253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632106303, "uuid": "ce2fcd60-fe38-4357-ad0a-1a6747858a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106303, "uuid": "8ada0e3a-5632-499a-86b4-2f8baf5108f1", "value": "mikenzy new week.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e8ceb2-1a28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632152266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152266, "uuid": "80a060c7-d293-4342-8e90-7871a7f26d3a", "comment": "Malware payload (AgentTesla)", "value": "1a8d5083dc0191b6db7782a0ad82bdc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152266, "uuid": "164f7b20-4d39-425e-a95b-dc4d71996b8b", "comment": "Malware payload (AgentTesla)", "value": "a5f9feaa8f93e30f196c24739d5f9c0580663bebafd87c2bd460a5c188c599e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152266, "uuid": "1d6a2f2c-241f-4d84-8258-a14461f14149", "comment": "Malware payload (AgentTesla)", "value": "d16ec49080f1302b28784dac2bf5a3cba7cca94d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152266, "uuid": "9fbda719-cd1b-4811-961f-4e9fcd5db720", "comment": "Malware payload (AgentTesla)", "value": "bbb1921eae63f373ae1f33d28da1ef6d8b0a9707fdb291fa20c48c7c80cb4dc9f2409af2d8e357c9c3ed9addb6f52a84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152266, "uuid": "9a41101d-5476-4a7c-ba47-b1ad338e2cdc", "value": "T17A05AEC17D47D89BF4DF2AF3986FC12011656E9D9161C73D2682BA2B54F331230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152266, "uuid": "a51ecc3b-108d-4246-9d04-443e0cedecde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152266, "uuid": "fd5ab4b7-17a8-4be4-bc9b-9319997cb5f5", "value": "12288:a5MTdI6fPpsmtiK5oyZ9sbQFu/ALLTrMZLvzkqi6iAdHHUgsWcSAQ3gFqmu:oyu+FonUFuIfMhvznAAdH0qg6K7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632152266, "uuid": "ee6aca84-46b1-4483-b53f-60a1941fb3b4", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632152266, "uuid": "743a4161-86ac-4f24-b475-223a4de0a352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152266, "uuid": "d3fec628-0022-4294-a767-99ab4b65c31d", "value": "Taskmgr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2127ba2-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632151833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151833, "uuid": "79eab422-c014-4a45-92e6-0d6223c9ff98", "comment": "Malware payload (SnakeKeylogger)", "value": "7106de834f0764343afec0717ad34707", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151833, "uuid": "fdcae094-45f9-48bc-84ab-8d02c4da7e3d", "comment": "Malware payload (SnakeKeylogger)", "value": "a66d3d8a9929d439176d866dccc4492e0838bb5b17cffe44f1f9ee1373b211a7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151833, "uuid": "12b6c740-678b-4e29-b508-4b69e1710a9f", "comment": "Malware payload (SnakeKeylogger)", "value": "9669819832184c375ac7b6755f01e69e768bbda5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151833, "uuid": "d3a6837c-e0ba-485d-80c6-ce1c4b7dd39d", "comment": "Malware payload (SnakeKeylogger)", "value": "5287cd54d58de320fbfc50d2874f95a16df42812bfe3ccc47fb952efc0b9f6215ec9186efd13fd69a5db0904151617c5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151833, "uuid": "5ae9186d-cdbc-42c8-8af9-e5fcd8eb93c1", "value": "T18872A4ADD0A742A48F4567B81B2BAF1401CC7A6EF389A533727C573527E1E3A811783D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151833, "uuid": "49e4242c-17e6-4b25-9d7a-bb1a3b85e2b1", "value": "384:hGPO8O44E/dAHSIbXkbcZWS7ku6psVLfkZfHqdKb2nLD/ICJ:sPXL//delkbAkuZV7kdKdKo/ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151833, "uuid": "e9dc6264-e5e5-42bb-a1a3-63613a469501", "value": 16296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151833, "uuid": "7aed297a-d76d-42e5-b5a2-8c5bbd93b0c1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151833, "uuid": "e20fc8bf-4308-4f05-ba88-6ff2e6fef894", "value": "invoice-E-2-S-2122-1235.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0320b58-19c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632111565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111565, "uuid": "f7ebefe3-0b15-4478-a688-dc1794927e5f", "comment": "Malware payload (DanaBot)", "value": "cf291da490b721fbd70d266de30edac8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111565, "uuid": "0e2a058e-d521-403a-9865-35a6c7fcbb29", "comment": "Malware payload (DanaBot)", "value": "a6b22caff1133b84c4d5595ebdade9aa4d1d0a8058903af7f6c55f6423904997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111565, "uuid": "431433f7-ade8-41a2-a897-57c045c7aa85", "comment": "Malware payload (DanaBot)", "value": "c99b8330057685380c95e2a5901253fc39bafe49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111565, "uuid": "c442b865-8eea-4175-bbbe-7457997aafdf", "comment": "Malware payload (DanaBot)", "value": "923f7936934551387084674b405ba1d820aea25a9941f2dcf6ee13273ad39e02a472375b85ce19b44bf88b3de6388896", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111565, "uuid": "7dd06a32-2166-4710-b439-5055bd4149d8", "value": "T1642633C0F6DA5AADE9052E321733CEB19673BD21DC74471C23193F5E6B75202E064AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111565, "uuid": "b6f08e72-4673-4caa-b697-be4700ba26f5", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111565, "uuid": "51c41645-2f67-4f42-b14c-82a6a561911c", "value": "98304:EZnmsrMV1MFTrLonU/IKaWStlCG4NiCRukm0rPYjh2NKFe/9ALzj:Ewsgb2rCD8SbCuCRnPAt2plAL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111565, "uuid": "238722c8-85ee-4acb-91f1-bf04d381fdc3", "value": 4675526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111565, "uuid": "9eed521f-b2e2-4b92-94e0-3ec9742cfd0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111565, "uuid": "e524f318-0664-4a90-9b77-53491f5253a0", "value": "cf291da490b721fbd70d266de30edac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aaeae0-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632160206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160206, "uuid": "f61f4149-b84b-4ada-87e4-202b8d8434ed", "comment": "Malware payload (STRRAT)", "value": "241e30c7ddf8bf781bd1984b4e32df23", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160206, "uuid": "ac9c036f-3d53-4fee-8710-c22700b24800", "comment": "Malware payload (STRRAT)", "value": "a6eabc822b99e39b0e3c504160422d537329bee03b0c6694468ea6b08532abad", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160206, "uuid": "2dddb9c8-22d5-44bf-bbe2-c9bdce08fe64", "comment": "Malware payload (STRRAT)", "value": "5da33cf5909ef4182a8d58e1e1c639beb6e2e0ea", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160206, "uuid": "9f27d234-b7dc-4eb4-95b0-d40f39a0a759", "comment": "Malware payload (STRRAT)", "value": "d05b4e1187881a95e514ef755ed402a40c2256fcbbe796a77653595d0ee10265ea90d3d8a8ceb6997765615c66e23ddd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160206, "uuid": "18cfcfc6-d486-4d6f-aeef-81fc69f7cb16", "value": "T1C8C3124A0E44E83FFE361631D5BD11C90124C8C1A7763BB79A1AA29894EEF07D0AD5DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160206, "uuid": "28bd3816-bb66-4cc3-bd2a-55dfdf2d6755", "value": "3072:V3iFbE2EklYIR7SNFM+IvrfCFBEry//zP7viHMDdCYSI09BDyPhqbR:YSkP0HM1LCF6yHz2UcYSI07cqbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160206, "uuid": "99747304-1ffe-4316-af28-b1a679ee9c16", "value": 123315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160206, "uuid": "b9440e75-03de-49d8-9f3d-45ea9951b87f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160206, "uuid": "d36e7a55-1eb7-406b-85e2-3d6f7671acb9", "value": "Invoice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fea857-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632160487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160487, "uuid": "b31f3bca-ebb8-4b79-b722-2eb4f9c87ddd", "comment": "Malware payload (Smoke Loader)", "value": "426f4ee516bca7d859ef9af7f9e5445f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160487, "uuid": "5d1263de-a49b-4d72-b9ad-763d06b9d1ec", "comment": "Malware payload (Smoke Loader)", "value": "a738d45fe5f3df597c5bcd1ba8a973d8cbe1521504421510b456ce37f56a56ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160487, "uuid": "1926326c-177c-4478-82f5-e192a99a87d2", "comment": "Malware payload (Smoke Loader)", "value": "62ebb87a50860156570e1f1857ae9a33524e28c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160487, "uuid": "200b341a-5284-4204-a68f-add6a7e0847d", "comment": "Malware payload (Smoke Loader)", "value": "4a14fc6e981b0968a59dcd3cf7248bdbc2acd82f96f044ea9f25b6714393144c6073bc1bafced848297381529ff0964e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160487, "uuid": "9404403a-675b-4bf6-9c7d-c523e785c3c6", "value": "T160456D33F2924837C173263DDD1BA7989829BE512E38588A6BF42CCC4FF964179252D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160487, "uuid": "853a654e-c8d8-4721-a115-377cacb1ab0a", "value": "f5c5c72fb042ec984115980efc918d33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160487, "uuid": "2cef87e9-ce76-4106-ae01-70ddeb7c3dde", "value": "24576:Jg7wUTb4QMqcQiFP3wJ5tYT4pHOfutWYy:JbF+5GP3wEpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160487, "uuid": "0029ee25-2ed1-42e7-98d6-f529e9a852ec", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160487, "uuid": "ac14d9e1-8012-41f4-85d4-e389722199e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160487, "uuid": "551466f8-f597-4dd7-898e-ad59a40659b0", "value": "426f4ee516bca7d859ef9af7f9e5445f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adfa526-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143607, "uuid": "e278baf6-4ad3-4a3f-b87a-1606228e936e", "comment": "Malware payload", "value": "3d5a5c3502c7bd9c5b917f8be5271148", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143607, "uuid": "8a85b4e5-00df-4fbc-b502-e307ad7ce396", "comment": "Malware payload", "value": "a7b56a32eed0b517d147b0f06f9c86d02408fdd088b4b375dbba823a639a128d", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143607, "uuid": "c7a8ff6b-62a6-4f17-98b1-3b3d9df82fda", "comment": "Malware payload", "value": "c47349fe8454dd8f6d34b3fc778326845be3d126", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143607, "uuid": "a1e97428-f556-4186-8f54-10e6237b2fcf", "comment": "Malware payload", "value": "9584fbb9ed6e747b072ffe9270ff665b24aefd88790a1820a09bbb3cdb2a7c28bafd9f19c8f9dcf11b5749e3d6a6b829", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143607, "uuid": "84c6c067-0435-4bb7-89dd-8d585ad05aca", "value": "T10A52F96BB45A75837152E4BF41BC27F4521A38F28004E128EFF8278E86E854F269CF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143607, "uuid": "95b4d84b-a38e-435f-a906-16d7607df264", "value": "384:+SU7zM77IDMa02cRJ/o5Etv9yXy5tp8MjI:+SEMPIAa0BJAWVrcMjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143607, "uuid": "730899bb-adaa-463e-9402-900375762ad0", "value": 13718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143607, "uuid": "c060cc44-c93f-4dcd-851e-1960134612e9", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143607, "uuid": "dba501ad-d6e6-402b-a0d7-85846feda2b7", "value": "fgfnbnc.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db041fd-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632160281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160281, "uuid": "967551cb-0f79-4d01-b6bc-cd26a9e295e1", "comment": "Malware payload (NanoCore)", "value": "4ed06645e6c275be2d12d34c843dc7c8", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160281, "uuid": "5e137fcf-70d0-45f2-a975-2ed869046f02", "comment": "Malware payload (NanoCore)", "value": "a7cd80c79f01214f60e92add62ac2c7ea1d54b0fa9f9527da9d25ece34af44cd", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160281, "uuid": "b2a666b0-1e94-4032-a4b4-a3d95ff578aa", "comment": "Malware payload (NanoCore)", "value": "c6a9241f0bec807af8b705d3ba6cb91cbdda19cb", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160281, "uuid": "30dbf8ba-55d5-4cbf-874d-b7211c7763e0", "comment": "Malware payload (NanoCore)", "value": "192d0c89ca43fdc6c71146be774086256a621216a37e8f175c805b793ce7e69123f03994b9e15e937a6e5a8fcb973aef", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160281, "uuid": "ff843b60-8b55-4458-b27d-2cbd1b544a07", "value": "T17DF11C2EE0A3D5514769C312CF98BE2C5C1D0889CA35B95CA5F36680AF30FA46A54F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160281, "uuid": "93414aca-8d2a-4b7e-afbf-d410ab36ebcd", "value": "192:KxEFXNIFX0zREJXCIjX+ReEIX2IhXodN2cxVpN2cC:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160281, "uuid": "0f767bc5-526a-4eb8-a6e8-7eaa6ab4dabf", "value": 7717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160281, "uuid": "4493bfbd-d7b0-485c-9823-c5b7d7ff042c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160281, "uuid": "dc653fef-7513-4a87-b21d-a58335721fca", "value": "PO 11029.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381dc79f-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632138744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138744, "uuid": "e72f3a55-adb7-4e95-b593-145c2543fe66", "comment": "Malware payload (Loki)", "value": "17892c8b76f19bb4fe6ba931f0191ffb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138744, "uuid": "934fc587-d3e4-4cde-b42e-89edcbae006c", "comment": "Malware payload (Loki)", "value": "a7d35a999c46c937c4eb73aeda2afc7c64644b1f44c8aea08fc4c468c7d8e941", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138744, "uuid": "26911d53-2cca-4880-8b3c-ab61089c94ac", "comment": "Malware payload (Loki)", "value": "70d6b4521d2ad379effb0912aad7d4043dda784e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138744, "uuid": "ffc6ceb1-7d71-4dc8-ba7d-aa3ff2e7cd82", "comment": "Malware payload (Loki)", "value": "d534c38fec4b812d7e9102f3da9b4d2e89f5ee69df5ebdc282bbdc1391d484aa8a1a930a8c9925d0904c0dc2bd78996f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138744, "uuid": "23293341-de04-4d49-a593-de4c42ca66b2", "value": "T159D4F2C176B2871DCBC71EF1AE09044F6E5ECE2162AA96AD6049F3093530DB78695F3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138744, "uuid": "f9ed41b8-cc1d-4847-8169-e847c4fdd36f", "value": "12288:gxhQZIfrFCa/Lx0YTSNmnj3Yl7l+zCL4KtkXU10zj2yeA1EioLajdVBp1Nv:fZYrAajvSmnjIl7l+zkBSnfUejd91B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138744, "uuid": "85dda1a6-38f7-48f4-b079-669d58661b08", "value": 602008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138744, "uuid": "17b9fd78-ea61-4846-8703-fc5b2f078af6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138744, "uuid": "5a7a9f07-aecd-4fc9-a312-31546f57f208", "value": "KVRQ-7436819.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfdd7f3-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632146590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146590, "uuid": "cd574274-2dc8-42d5-baf6-48a376862227", "comment": "Malware payload (Loki)", "value": "01bd9c33ec13fc1d6f1e4dd90ff01c2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146590, "uuid": "c71cbee8-b3af-463d-8870-0b11de81880d", "comment": "Malware payload (Loki)", "value": "a91e4336af850950b1bcaec94d14e9b824ed58554c3f24256b867eae22bb2d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146590, "uuid": "c8374bbc-e2a1-4854-994a-03d43ca3f439", "comment": "Malware payload (Loki)", "value": "539fff3b7439d7e4afe6bd1c6cfbc609022fd117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146590, "uuid": "febe9e9f-cd0d-4f14-af9a-d96ec16ca697", "comment": "Malware payload (Loki)", "value": "d78548e959fc3143507db82a07f0ab6b669ea91a5664fff4b4defaf475063d03cd3128361d32503bb4d1438c99a5fd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146590, "uuid": "fe374915-15f9-4179-84f5-a3d90819e261", "value": "T13C4412A75BD2CDF7D0E827F2143A6B3DF7BD0645122717830F114E3AA51E0A68E9A351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146590, "uuid": "6ec419d2-c154-43ce-a700-01a94fe89cb9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146590, "uuid": "98e2867b-94e5-4c73-9a55-d0f43e35ca8d", "value": "6144:R8LxBhBQQkYyjgBebyMB0Bhlx4Aq1vIVLkL1AEOrupezrO6LTyeGntpndRqC:2YgBebyMMx4DvtOrupeW6LGlntNdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146590, "uuid": "85d204af-904a-4ce5-962f-c89608e95a8d", "value": 258909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146590, "uuid": "6970e0c2-7081-450c-aed3-4980eb5251b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146590, "uuid": "d14cab9a-be64-410e-a8ba-5ee03501a781", "value": "01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32f7019-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632121421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121421, "uuid": "3d26d96d-7428-4aae-b6a1-424ece3f2883", "comment": "Malware payload (Stop)", "value": "fb7e682140807bd1a7d910eeb6616736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121421, "uuid": "abadc28f-9fc3-4e66-b891-4932d619a05d", "comment": "Malware payload (Stop)", "value": "a941e90ff8f1750aadb4763c366b930ae9e6af28036e7ccd790c6c83c7163bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121421, "uuid": "0a9a2330-d364-42b2-a287-6b81cbe9831d", "comment": "Malware payload (Stop)", "value": "8a9e0d6c817993b1ee3ee010e86811d6ca535da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121421, "uuid": "d4c8198b-a089-45f1-90ed-78afa84a0652", "comment": "Malware payload (Stop)", "value": "5baf42e24d371f3eba8b2cbc0236d585a5ef7872081bf251e08d4cfc1bd784775d0515d7ecd7f4c40c37226620da0d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121421, "uuid": "35b88141-b803-4f40-beb0-931ea0e8a4dc", "value": "T145F40120BAE0C035F4B712F9597993A8A93D39726B3481CF52D266EE66386F4DC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121421, "uuid": "f3103e54-297b-44cf-acd2-7880e3b90e17", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121421, "uuid": "650975d7-1e34-4a83-a429-4efcafb6ad07", "value": "12288:9ZCDY880qWY89DXrK0OkgtH/XbIfL4GaJ1/8HksT7QkwEGCI8gv2CcVv2vlprb1N:9kDY8xqSghbA4GaAJ3jwlCg1vHP1Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121421, "uuid": "6b770ccd-8bb3-48e6-b027-f759006b6df7", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121421, "uuid": "aeb35648-0071-41a8-be57-435849b51f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121421, "uuid": "162b8918-1dba-46ce-bacf-3cd47d34e8b7", "value": "fb7e682140807bd1a7d910eeb6616736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f54b236-1a40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632162512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162512, "uuid": "ff22b52c-85be-43b7-819e-f8586374dddc", "comment": "Malware payload (Formbook)", "value": "1caacec9442e87e867993c5dd722410e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162512, "uuid": "0fcf5383-4130-425a-b1e6-2f34e5fd69a0", "comment": "Malware payload (Formbook)", "value": "a99b696e8ac16303843b26c95c982d5be9b9fd657d843937cc586c9a8dc29b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162512, "uuid": "c76cd867-e756-47bf-a031-b6530057ac66", "comment": "Malware payload (Formbook)", "value": "a23d20eba03efd6f428b0c6f1afbe47dccfe8c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162512, "uuid": "43aab956-f550-4ac6-9d8f-d9c243d31d97", "comment": "Malware payload (Formbook)", "value": "fe77e869402e51867546996633774d3df5884ea755ab4090ab8736364816ef2e509520f51aea7219cec0d2d6ccd77f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162512, "uuid": "79106360-fd43-44cd-b149-ca22ee4aaf41", "value": "T1A605D0202364C26AE1FBE778D432D471CB7EE986A036D95A6DC3D9DA0D25341C11BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162512, "uuid": "31cecd1c-ee92-419e-9133-bdabd89a0db7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162512, "uuid": "b5414e55-a418-4cfb-a812-f04fc19b6435", "value": "12288:eBGiY6H+Fu7NcoGvW5yXMqfgpLYmKjwmbu9Q30+tmtiK5oMzrUQ:eA6eFuegxqfILvK8G0C+FoMzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162512, "uuid": "9d82d824-1e94-499e-9c0f-f58d42e2e393", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162512, "uuid": "bdb3938a-96c9-47fa-8a03-a22ef6a344b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162512, "uuid": "5f4b0372-c8e4-4062-aa98-a07c5274e7c4", "value": "new product order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db969170-1a47-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632165647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165647, "uuid": "eec5ef06-d499-4d43-b784-552e27101c33", "comment": "Malware payload", "value": "e704102d39f49293e78b4f5649791601", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165647, "uuid": "1b0b7bbe-b42c-416e-aade-02e673be60e8", "comment": "Malware payload", "value": "aa4d46f85cca706129c6eb89486724b1cd8170816be232e9e2d4229b2a9e4ac2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165647, "uuid": "7aa70fe4-93d1-400a-b4da-8620f836a9af", "comment": "Malware payload", "value": "70150d81dd83dbfaeac795e7ec66846a893fd2cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165647, "uuid": "f20ac5d6-757a-475d-9ba4-b8f95cafcb51", "comment": "Malware payload", "value": "d122ff00fe2c2064b2328b99fc16cf16dc7dc5194b3cfa369d201f21850a0005a36b34911abefa9ec4ade9c7b8af48f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165647, "uuid": "21dbf297-be59-4957-8139-1a68a113e05e", "value": "T117C47C30179570D4E3727AB08BB3E042F5996D32AF9D92D93843F64DC2B3642E973A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165647, "uuid": "676db109-7bf0-48d4-ab38-45ed00c21dd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165647, "uuid": "ed26ef09-cbed-4893-9841-95f82d11b14e", "value": "6144:/KH4DtaMRiKuQ0scfE9ibOKlAkLvkmL0FLx2sFO+V1yowXZZOhjQ/6ntE:CYxaM8KuQyKibDlAkgmWwsFjzyXfgQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165647, "uuid": "2c94b594-09ba-43e8-959b-05a5893d2e8c", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165647, "uuid": "f07156f1-c7e8-4084-a583-653a6e444465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165647, "uuid": "aa73c67b-31db-4a16-9a40-3257510c4a2c", "value": "e704102d39f49293e78b4f5649791601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e807ff-1a41-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632162704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162704, "uuid": "c0a6030f-4806-43f1-975b-9898c73d53a7", "comment": "Malware payload", "value": "cecac2be7d9f8c6afa7cf42e4a11e206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162704, "uuid": "a3c7da4d-5a12-4bc0-ba56-748b5fd6e222", "comment": "Malware payload", "value": "aab74b8bcca09c0fecb8c23b554d2cb110710d8718de82e63f060860c5a396e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162704, "uuid": "ba32cfbc-29b0-4be4-aec4-aa1262079886", "comment": "Malware payload", "value": "e79c70d22547b645bf226e2485fc0fe50d8096d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162704, "uuid": "08a0575c-bf9a-4d60-9cc9-077adc324d5d", "comment": "Malware payload", "value": "8882b0c6a495a7cb3eeea021b55f90291fa0baa6a5c10dc30ea0a6a7db3ba070bb5b837e3800ae38955f27b5f60e3d03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162704, "uuid": "2a7d74cd-e094-4edb-a453-612eb8304d4b", "value": "T1E564AF20A7E0C035F5B712F859BA9768993E7EB06B20D1CB62D227EE56356D4DC30783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162704, "uuid": "1782dbda-c880-4794-8b6d-1fcf546059a9", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162704, "uuid": "45823483-c690-482b-87cf-dab566242d1c", "value": "6144:nk715WGyRtFIKqrpqOQS2JSTwoS3/cxmVSQZ03k6Os9ZpCRB:kZsRtFVqr1P2JI9S3UxmVSVU6PZ4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162704, "uuid": "32910967-2ed3-453d-9f85-6b0ce507db57", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162704, "uuid": "9e7710ee-e3f6-4dd5-8fd7-b290deff0ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162704, "uuid": "c0b44278-86ff-490c-894a-a9f33e341537", "value": "cecac2be7d9f8c6afa7cf42e4a11e206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3073f251-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632138731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138731, "uuid": "988990dc-27c4-419c-a648-6a06a07ff99f", "comment": "Malware payload (Formbook)", "value": "836df1ddfa921bc9f44e1178d0745da2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138731, "uuid": "5f1694a4-2173-4fbe-930c-49c1a453ec95", "comment": "Malware payload (Formbook)", "value": "abca0b10350c02ec8cb642d5cf9fd66e6f448dbf489046e38e57971d2317e3db", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138731, "uuid": "e2b87754-dea9-4d48-a20c-147b65c73262", "comment": "Malware payload (Formbook)", "value": "1a733627ac19f7aac095916b5fe3f69058e701f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138731, "uuid": "0dda3621-0e12-4cc3-83f2-48a47709bc64", "comment": "Malware payload (Formbook)", "value": "fbf71140c9402c5362c2585da1da40f041567551756a7fbb703ec5de74d6db2237d0775ef848c48ab20f27c1f52adf89", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138731, "uuid": "d25667df-d013-41eb-947e-c37cf499f5d4", "value": "T189D4F1A0ABD05536DABE2A7E0F58C5C646319E408EF6FE32F106B0D78AF85ED35D0251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138731, "uuid": "2f095153-269e-4021-a7fa-7ac29b8bd01e", "value": "12288:r0HKdV4vvJeKLtY0Qf7hNtPEWll6iEwgTRdfe5eCR5FSeKind:HEvvJVtjWHzlgTRQ5eGC5Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138731, "uuid": "a27bb912-83b8-4ac8-83c9-416e6dd7f6ff", "value": 601880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138731, "uuid": "e82be4e7-1104-4b52-902c-7a8908efd786", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138731, "uuid": "f045fb79-3bd5-4cfe-b6a2-111878720ad3", "value": "HBW PAYMENT LIST FOR 2021,20212009.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cca89bf-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632118109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118109, "uuid": "6dbe549c-0303-4570-9368-0f13fda2f6d2", "comment": "Malware payload (AgentTesla)", "value": "7f220e152d52504861a2bbdccaba19f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118109, "uuid": "6bb60798-6329-4c91-b4e2-160fc16b29b1", "comment": "Malware payload (AgentTesla)", "value": "ac65808896c34ad6613b04cec0ebc771f646c130a7b2d4ef30923370680dddc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118109, "uuid": "9db3902f-a457-4abc-8045-ca955fe7b719", "comment": "Malware payload (AgentTesla)", "value": "fcad1ca6291b113b8c4b3e5118a82f268c172eac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118109, "uuid": "485a1011-c5c7-4e1f-bea6-80544b0c757f", "comment": "Malware payload (AgentTesla)", "value": "91b8cf0aa4b99e80724148db36ae0194757d9f872fadace4b2b30e833db6bff237e17eb9ad90df651d3967c6f790a5fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118109, "uuid": "aef11f90-12b8-44b2-90c6-820a3c9e1e51", "value": "T172D4F1B05DCC1FCBE30366324CC145F4B56B6E77C6B66A410913332E86B0BB9D2729A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118109, "uuid": "1fb9e374-5599-4397-8679-3aa4cf6f1924", "value": "12288:IJIVqELCElWOc9Z02CKaTyVB6qHi3X8J/Z/GLp9/F47/DSxM:IJIXLCnOcI9Hi6q6XoZuLpr0exM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118109, "uuid": "06e4ea93-de93-4afe-b950-c381efbf6f85", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118109, "uuid": "a1e7d556-1cb3-428a-b6d7-47113223e8b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118109, "uuid": "4b004716-2a98-4831-b574-8a68d2d31f93", "value": "NEW ORDER- PROJECT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29faab26-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125405, "uuid": "2c1cb1cf-3500-4bc2-abe4-65b5655091e6", "comment": "Malware payload (Dridex)", "value": "0873789330ba82465838157236328fcc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125405, "uuid": "a2a8f88c-6a03-4abc-adcf-30fcdf0ad90c", "comment": "Malware payload (Dridex)", "value": "ad4af46d17c32e166e1e42f8438a34f8ea7f87f7c3dbd52106d82b64cbee6de6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125405, "uuid": "e08f3561-6109-4c19-8b4c-57b028d42378", "comment": "Malware payload (Dridex)", "value": "5f8cba9d9932e8bf4da0eea93e3243b585955362", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125405, "uuid": "42fd22e2-c386-4814-88c6-ca0e96c48217", "comment": "Malware payload (Dridex)", "value": "f49faeff3eed5d3a905568e552b7f4d27d784ea02dc072f5bb84199168ed1023b2e85e73a1fa2d1f2a17d765f759c1c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125405, "uuid": "79d75ef0-c2c5-40b4-8641-c897b035884c", "value": "T16495E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125405, "uuid": "1895995c-54cc-403a-88b0-dec4440896fa", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125405, "uuid": "056e0435-1c9f-46ab-befb-ba89c749c66c", "value": "12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125405, "uuid": "87d543e4-d071-41b4-b112-c0870f85e043", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125405, "uuid": "bac6214a-7681-4af6-9306-1cbd607198af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125405, "uuid": "c79da8f1-2542-4704-9c64-a45ee49d9bb7", "value": "ad4af46d17c32e166e1e42f8438a34f8ea7f87f7c3dbd52106d82b64cbee6de6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb9b47e-19cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632112154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632112154, "uuid": "a6b1a2e6-5d73-47be-b7ca-a20a51612170", "comment": "Malware payload (Formbook)", "value": "6e54bbe0fe1885c5262b5f1e72640a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632112154, "uuid": "ba4537e6-66d7-4fa8-8e6e-e8d637f0e471", "comment": "Malware payload (Formbook)", "value": "ae33000cbdc7cc10a8d86ce07727c8159d66a6707e2a453d996dc61c709de96f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632112154, "uuid": "a3e5b181-95b1-4ffc-bd76-6165247137a6", "comment": "Malware payload (Formbook)", "value": "bd26fadf4a0c34d58c5a58eafc6b53a3b4cd60e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632112154, "uuid": "768c9b72-e88d-41be-ae62-dcd861f3a2ef", "comment": "Malware payload (Formbook)", "value": "f6a8c4a7faa93d3d6588eedea8a43004f956cc8721f793c46c2e4c487533acb2ce17bd362b391ab28ec3e30ad11909ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632112154, "uuid": "12c05c31-d35d-4a43-a279-0f4471fc5564", "value": "T1EB05D0202364C66AE1FBF778C422C4718B7EE986A036D95A5DC3D8DA0E35341C51BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632112154, "uuid": "ca47a371-1cc8-43e2-879c-97cb863dc999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632112154, "uuid": "e02f8b19-4ffa-4247-b77b-95de8ce83e84", "value": "12288:yBGiY6HqFuOqGTJPc5ypHAzYr1A+/j1nhOEAk5oLOmtiK5oZfT:yA6KFu8JPc5ov/j1hAFLO+FoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632112154, "uuid": "a68616d8-39a7-47fc-9e80-02b8e6c2e2b8", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632112154, "uuid": "c45866ee-7660-4dcb-bfc9-c86eac77434f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632112154, "uuid": "15a9b097-7bfc-4c0e-a92c-fb94c865d126", "value": "Quotation_pdf______________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff2c5e-1a4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632169028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169028, "uuid": "8c4af263-152c-4d24-bc07-0c72f47248e5", "comment": "Malware payload (NanoCore)", "value": "3f201eda81d1b2f148a9e538e28b26bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169028, "uuid": "0000f94f-7979-454c-826d-afaade65a8c2", "comment": "Malware payload (NanoCore)", "value": "af69f1a7b9424eb067e4169b072b75395ff245e1f121a4333784b03e32e880d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169028, "uuid": "24fab7cb-04df-4f44-bb7b-5ddb6c5ee992", "comment": "Malware payload (NanoCore)", "value": "e406f47f1c9941aa48358d14c0175c02c77efcbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169028, "uuid": "3da52b19-c968-4dd7-9de5-500f04f7c324", "comment": "Malware payload (NanoCore)", "value": "54ca36b80bc66c1a7d592e68c5bc724f51492ce49c7afa657dba4347dcfcaa235718da4dcd8cafca2a1b74cc829b250d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169028, "uuid": "8e9b236b-9b1f-479f-8de2-cf6cb1577407", "value": "T1B715C0202264822AE1F7F73CD462D4718B3FFA96A03AD95A5DC3C9CA0D25351C51BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169028, "uuid": "2f5acad7-b249-4c13-9b50-dbfbaaa4bc49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169028, "uuid": "6addc320-4f6a-4cd6-b945-e4cbba2e020c", "value": "12288:ZBGiY6HTFu7q1zGvnYRiJ0+9SftCrX0c3DTYykUzqXUCytvJa+KSHctmtiK5oWs4:ZA6zFu7qEYukftCQ+DHvzkUCj5+Fo54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632169028, "uuid": "11c4b7fe-7339-45fa-9b98-4374da577d13", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632169028, "uuid": "4cea0814-9d22-4186-aa0a-9310e237e1f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169028, "uuid": "19a96181-a607-46b9-9f48-0be8f7fbf5c8", "value": "Revised & Final Order for September #890321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba3ef08-19ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632127556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127556, "uuid": "1a34ddd9-a56d-4bad-be9f-846ab4720cbe", "comment": "Malware payload (RaccoonStealer)", "value": "f899d990d1837102f35b873996cb3401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127556, "uuid": "0eb4fd09-d6b0-4712-a891-45f6d3074d07", "comment": "Malware payload (RaccoonStealer)", "value": "af90943b5aa1d71230b58094b949a95bf1dd776130e5740b4e9325cf17e94efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127556, "uuid": "e16078a1-b35e-4b5e-87fa-a4ac87671801", "comment": "Malware payload (RaccoonStealer)", "value": "93a1c610c6fb4fe7f5d20174debd80f714cb7f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127556, "uuid": "9eda96c8-be58-442f-8fcb-f20499ef8301", "comment": "Malware payload (RaccoonStealer)", "value": "21c035f7e32771551d7f8d87b3a26df4b9c8958aa43026939836312658773c33a9fba21dd9f9e5324e621ec27094ee1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127556, "uuid": "3ed9269e-8b7c-4529-a4e7-23e6a0a5b68a", "value": "T134B4E020AAE0C036F4F711F459B993ACB83DBAB2573452CF62D622EE16356E49C30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127556, "uuid": "3edb0c1f-23ee-41f6-9ba6-bb7605fe6751", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127556, "uuid": "ffec7ebc-daeb-4173-a161-e42024334368", "value": "12288:EZG7CLD9rz0buW1LGFKtLRy+Bnyc/q3VdBKVzi:Eg7CLdWAk7nxu3az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632127556, "uuid": "ac148505-3215-41e0-aea8-ca7f6f99acdd", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632127556, "uuid": "710dccd5-cb37-47d6-abac-b1920d5f325a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127556, "uuid": "e63ec060-13d2-44e0-81bc-43ada9a6a1c2", "value": "f899d990d1837102f35b873996cb3401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19142cd-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632153148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153148, "uuid": "7dc5375e-74e0-43dc-882a-ffb11185a7db", "comment": "Malware payload (AsyncRAT)", "value": "f60b22a73cff36aeebd896f2da95055d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153148, "uuid": "e96f2466-c4c5-442d-8f82-549fa641b435", "comment": "Malware payload (AsyncRAT)", "value": "b01e228a3a1eadae8c2a23a315ec1b758672d4847ead57402d6d760377104ee0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153148, "uuid": "001e2d18-b5d3-47f3-856e-06aa9948638d", "comment": "Malware payload (AsyncRAT)", "value": "ce3eb3443dacba2e474f0e630f624d8f6e8f39f2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153148, "uuid": "4b9318b5-482f-4f05-9c9e-44295f679cad", "comment": "Malware payload (AsyncRAT)", "value": "44673e502f272e4319bb1acaf2ed44f414893cd739cb129d3ec872fa9a94c068da65c761f34cc76e0c5fd1acd9aff52f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153148, "uuid": "424789ce-d2ff-4fb4-9900-fb5b82a3c80a", "value": "T177235D4037D88136E2BD47B9ACF3E6458675E2672903CA5D6CC814EA1F13BC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153148, "uuid": "9ca08c15-6be5-4cb2-8af8-97e06aec6a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153148, "uuid": "19fd78d0-c3b4-4a4f-b2ff-deb413b78463", "value": "768:4q+s3pUtDILNCCa+DiptelDSN+iV08Ybyge2zwSq77qgchbWvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1hwSJgKbWnkJvZVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153148, "uuid": "70f335dd-b3a0-457d-8554-b784840d7273", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153148, "uuid": "b3a105e3-7d34-4ff3-b576-efdc07c70f56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153148, "uuid": "296c20cb-6c80-4f9c-959f-b1d93d9b5b72", "value": "download.dat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a4d2f0-1a46-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632165252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165252, "uuid": "72eea2be-259a-438c-ad9e-a7f8c7d26793", "comment": "Malware payload", "value": "09a8ee2dc3f0a88adde30a3c5f058616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165252, "uuid": "fea3458f-9d6b-45fc-98c3-f56faf36c51c", "comment": "Malware payload", "value": "b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165252, "uuid": "27250e6d-7ab3-4013-a5b9-7b91d51b67f6", "comment": "Malware payload", "value": "8cc5b36af06094d62ba097a6caf4fe4fd9bedc84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165252, "uuid": "c968be52-c13e-4927-b8da-eef9146b8422", "comment": "Malware payload", "value": "a8743a748a349c699206efd4d86fc48d3b08540deb9b1f0bd012f946cbc3af3c710e166356764ed4433d531d11326e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165252, "uuid": "5b75dfc0-3b4d-42a6-bf0a-85231ff22895", "value": "T18E953373B18D1852F7DEF33A02A924CA9B4FB951CCCD2C76C955C36267C98E8B258352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165252, "uuid": "ee945461-03ef-4f27-9730-8b7fbe88aec4", "value": "49152:q+I4gabeFW/lGAspWSTnGFzrOmSP4tLUtYu6iBu/H:FbeWBNmEOg5U/6ig/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165252, "uuid": "d23a7832-4956-4a3b-9c1a-d5a97de4cbe1", "value": 1999872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165252, "uuid": "e5fc71b0-d34f-4502-80a4-05699b39e6e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165252, "uuid": "53454fa8-2d69-4bd8-a430-b73d5591dde6", "value": "09a8ee2dc3f0a88adde30a3c5f058616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b95500-1a07-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632137854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137854, "uuid": "4318a37f-8bf1-453a-95bf-20588d8f0800", "comment": "Malware payload", "value": "258424daf7c4739ccad8853fd19f33e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137854, "uuid": "47576b0c-b807-475b-bee7-7f9ac0ef177d", "comment": "Malware payload", "value": "b1c35225ed91213e891a684c768bc39ad5d05cf8a0b1857190077c66d5166102", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137854, "uuid": "f64ecc3c-e08b-4f80-aee8-92bc48b04cc0", "comment": "Malware payload", "value": "b08a842622ac35ea1687f2fc451d9e747f24d041", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137854, "uuid": "92415ea0-1048-44e3-8b7b-d6949403ed23", "comment": "Malware payload", "value": "d965e51d5dd3d01ed4b473f21dba98b7a50f673aca8cd762614cb3cf8f8515af4ae7ac54c46810368de40238c7b81d46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137854, "uuid": "88cfce5b-5e40-4a51-a67f-1389065f8453", "value": "T155B36E06F51831AEF7B0BE3B97644E244347BA461C2E970537DDE6FA0B32E4AD532914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137854, "uuid": "81b06169-714a-4855-b94f-d9b8c0cd6b85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137854, "uuid": "a00daf58-dde0-47a0-974d-7ec64965e17b", "value": "1536:nBgnOZduP2kJir/Z9ct6hG+ctJCgzhujLqChjKDjl46G:B03l0Pwthuj2CFIm6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137854, "uuid": "09a05813-619f-409e-ae32-90daa03b2d93", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137854, "uuid": "41e69a78-1421-42d0-a238-f3e54917611e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137854, "uuid": "4a9ec7cc-1263-4b9d-ade9-ed59b6039db7", "value": "258424daf7c4739ccad8853fd19f33e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b793a76e-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632143682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143682, "uuid": "e28df2cd-6bfc-4a6e-888b-f8a395171164", "comment": "Malware payload (Formbook)", "value": "0b72c636a166a3bfd713d056971eec02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143682, "uuid": "89265304-c5e5-4345-9e8d-03f560c37559", "comment": "Malware payload (Formbook)", "value": "b1e9060288c5c28d0fb5ba1c91b5c507e15011a063009da3e382ad6b90b09790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143682, "uuid": "122188d9-3385-4fff-b405-1c311c0bd168", "comment": "Malware payload (Formbook)", "value": "36ad032ed59d28564fc2d6f3840d0e74d4f9cd0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143682, "uuid": "1cd77743-599e-4c9c-8bef-b64bfc8ae154", "comment": "Malware payload (Formbook)", "value": "47f04fe4bcf5ca7c54f1edc3f1f7ef00aaee410c524395b4bcfa36cdcc02fc5e44cfa6b58a5360abe11d8d65a5bf0185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143682, "uuid": "14eb2936-c7a0-49ed-8a62-f2817322de02", "value": "T110059DC17D47D89BF4DF2AF3986FC12011656E9D9161C73D26827A2B65F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143682, "uuid": "e975e926-70d8-4bf0-9df5-f2be1ba1ce69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143682, "uuid": "d9828934-a761-4821-b54a-4194ef1e7f31", "value": "12288:K5MTdQJ8WsmtiK5oyZbXnchk9R45FgVUgmF5DrL8BDm/Gmz0eKofqSt:g6+Fo6Xnb92TqnMGmoJAft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143682, "uuid": "ed0c8802-ff55-41c0-ba97-1158b558c41f", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143682, "uuid": "9b537fc9-bf42-4f61-a669-42c3c91e3709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143682, "uuid": "cb190bb9-5fbd-4a5f-b3c2-ca5c26129e7c", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b49f29-19b0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632100596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632100596, "uuid": "1ebf3402-2366-4248-8178-3e236d8367e1", "comment": "Malware payload (SnakeKeylogger)", "value": "c4cf458e908e9c307e9dc7c6c64f3d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632100596, "uuid": "d5bd729e-eb64-4efa-9806-ba6491a41c1f", "comment": "Malware payload (SnakeKeylogger)", "value": "b204064e7c3b8739433533196342ff4d6164280efc13919946f8bbf22b433319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632100596, "uuid": "4ca0e0b2-c625-47ed-a04d-f70febbbc120", "comment": "Malware payload (SnakeKeylogger)", "value": "9fcd56cc01f3ca8c38380f984e2ffe0d0aa88f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632100596, "uuid": "64074164-2752-4b1e-a06f-a53d173e4f64", "comment": "Malware payload (SnakeKeylogger)", "value": "1df0c37a3560182abf7dce5177e131a2616a79402b2b02976ebb4ebfa1bc5587e7eb0343f313cf432ed9060d57315dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632100596, "uuid": "9e6f4c8e-9a85-4f8b-81d2-2769a7d73599", "value": "T140259B294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632100596, "uuid": "42c22a7f-4665-452b-a1d8-5183035dbb67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632100596, "uuid": "fb59e359-0ab2-4adb-b7ea-2ff585d66925", "value": "6144:spSm3ruhGz76PoJv6+MGNTdqtyXmgnlM03WRwzS9c3xXQxyT8df+9ck65IWGnPUA:spP/hWgla8lagXGzp2djC9goc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632100596, "uuid": "55dd5a14-8255-4978-8ba3-3d28dcfbf6cd", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632100596, "uuid": "34db52cc-1bba-4bc4-a054-89f9e2f4a812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632100596, "uuid": "a19edcf0-fb96-4e87-97cd-c0d8ca7279ba", "value": "STATEMENT OF ACCOUNT NO 5674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd4fe46-1a40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632162402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162402, "uuid": "016efeb2-34f9-4e8a-84b1-1259fce63f0e", "comment": "Malware payload", "value": "abc8c91c8a76482fec4dcf674e58f396", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162402, "uuid": "f833fa6d-26e2-4e28-af65-95a48db7bb27", "comment": "Malware payload", "value": "b2333a530991cf9073e126e54fc8f12e5fba1d711593f1241397d6e5bde65194", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162402, "uuid": "2472bc62-8001-42df-99ba-2271da2702fe", "comment": "Malware payload", "value": "32a5ac93f2ae1c2bee0dd3e0c2256c5e57e07317", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162402, "uuid": "1a8d7985-7a5e-40b9-97d0-40957b6cb163", "comment": "Malware payload", "value": "c65b42fd3d337398374728c0c5055bc5a0621dd6709891addbc82facc9bd4358df1c0cda0cb7fb09e68e92b88fcd0208", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162402, "uuid": "e5ad2070-ae9c-4c65-9417-3705d2bbcb23", "value": "T1F7138D425F206853DE8789B4F1EA9E365D74A741A7D084D3A260C1A8CFC4BE6797C07F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162402, "uuid": "cc8772aa-53d1-4a09-afd4-05ba383e0ebd", "value": "768:5G7cYzbmiM3FpvjwaAQchcwjQMOthcnVQcnBh:XYzbdMj5HUQVkacnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162402, "uuid": "07256695-a316-4070-8056-a90729f0ec60", "value": 41968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162402, "uuid": "c89d938c-0d73-420a-b3a3-2b3afb5cf1d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162402, "uuid": "1072c7e9-ba0a-4c07-b4d4-504c91d3087d", "value": "b2333a530991cf9073e126e54fc8f12e5fba1d711593f1241397d6e5bde65194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9e32eb-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632146321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146321, "uuid": "35a21c21-95f4-484d-b458-747cc0b685de", "comment": "Malware payload (Formbook)", "value": "dfbd95b518ecc9178415c3b24078c94f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146321, "uuid": "335b4cff-17fa-4c1a-8776-9d46552352dd", "comment": "Malware payload (Formbook)", "value": "b32448dbeec13e1eb23e55a57ffc06f9dfc8fd44687e19fc0be1c4fbabc10abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146321, "uuid": "ea4f1b8f-294d-4273-920b-272b48e2c22a", "comment": "Malware payload (Formbook)", "value": "6881c018ddf6fcbd775c92bb897967408f0f504a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146321, "uuid": "5773a053-aec5-467a-a331-aa28b0348360", "comment": "Malware payload (Formbook)", "value": "f1945b97e961a334bb712c9b11ab8674133b7030c0d6346d219bf8ae89ac5ac9df06d71c730a7ce820bfcc1ceb7eedc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146321, "uuid": "9fb617d0-a299-4a1a-8c3d-eeab5cf61cb9", "value": "T10744126635EB85F7E7030AB26E362FABF3B3071581537B434B682F762A315424E51389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146321, "uuid": "97f4f88c-940f-4c40-ac9c-80cfba3774b9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146321, "uuid": "d753c1e1-1899-4be8-a469-c3c8ff859242", "value": "6144:Z8LxBBEMIWztBkm4SV+DHb2cW/k28IxdcVcnNYU:mnTk5SVIq/B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146321, "uuid": "58549b0b-d0d5-43d6-85b4-d96f959d0732", "value": 259736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146321, "uuid": "37ea0b8c-99c6-4cae-a252-c229e2264ee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146321, "uuid": "e5be452d-f1fc-4c89-8fd1-1cdf6d01ec26", "value": "dfbd95b518ecc9178415c3b24078c94f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e400f0-19bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632105940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105940, "uuid": "aa086cb5-dfc3-4c94-abae-e9da238015ec", "comment": "Malware payload (RaccoonStealer)", "value": "a1cfa4a945b12ff461ec8bc898b40aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105940, "uuid": "de5e4a3d-f75a-43ab-abf2-41dc4a645dd8", "comment": "Malware payload (RaccoonStealer)", "value": "b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105940, "uuid": "a62b699f-4823-4e7a-828b-4a594a154f89", "comment": "Malware payload (RaccoonStealer)", "value": "1d07813751d678475c8115b4e25e5816d6d98d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105940, "uuid": "627a020d-1bdb-4dd9-a496-eadba73c286d", "comment": "Malware payload (RaccoonStealer)", "value": "c1f5b3d279a13888b33e89c3bb5f22ed15331f41c72084e24b2fb193707a301f5145bbb7438baaf73abcfdf5c6fbd127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105940, "uuid": "83ec5d29-d889-40d3-8881-19a11baf2ae8", "value": "T137863324296D2CE5FA0BAB3BF4794584DDB9A43513D9EBC107791F38FB5408AE443E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105940, "uuid": "19cbe5d1-afca-40de-97e8-cfe4560cdd52", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105940, "uuid": "0a433db2-5222-4f4b-9757-3b79a8b002f0", "value": "196608:y4YemJyHeHLhob3LvoFGEESrnm8iBvlQHhq6CrnHtkL/5eCh:yny+WzLvoIEJZiBvlYCrCLheCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632105940, "uuid": "d749be05-4fdb-41cc-a82c-df12bf8e87ad", "value": 8134130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632105940, "uuid": "94ee112c-1816-4f6d-b1a1-6fb64e18bea8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105940, "uuid": "29117db7-e4b9-45bd-aaa3-cf53c4d343a6", "value": "a1cfa4a945b12ff461ec8bc898b40aa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf320a1-19fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1632134161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134161, "uuid": "9aacb0a3-b7a9-4cba-a79d-1f93f3857772", "comment": "Malware payload (Hydra)", "value": "33930ad392c91562b0976fcb11da8573", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134161, "uuid": "99fccbad-919c-4a71-b97d-42a1c4a68041", "comment": "Malware payload (Hydra)", "value": "b461ad02bf71d2334a7c786e9de42b00515fe6093c06366f0308e5d99a26da7d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134161, "uuid": "fe6ffb5f-731e-490c-b9f3-ecb875e2cc57", "comment": "Malware payload (Hydra)", "value": "5beebbc6c1b2d1f7ea09e2b5052e0485a537ab44", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134161, "uuid": "fbea8f0a-73d3-45a8-918d-aa271db7604f", "comment": "Malware payload (Hydra)", "value": "7a56d2103d238ca08dd0738724c79696643f6b88468b8e1ded70508f0acde4fa1d4b7282798062d3079112f56e389c68", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134161, "uuid": "cdd95d48-0979-41ad-8a3d-5fc1e78530ce", "value": "T19A8633BAD3D19157FB3219B646CB2AC37B155E6B0183C03B815DEE7905BB8892E80C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134161, "uuid": "509cf045-4d0c-419e-84ff-90460467f84a", "value": "196608:2cI/vFi5XYBqOj3jzrQ3ssq0hMDWx0RiQdyjynFAL9U31:2//45XYfr+Xq2YWabyj40I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134161, "uuid": "9c41ed8d-9a5f-4696-96a2-789356fb2ce0", "value": 8213339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134161, "uuid": "9e85b692-ca2f-4d5b-857f-49e16a568a83", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134161, "uuid": "d9ce933d-e43d-4deb-bde8-fdec3cd9ac48", "value": "commerzbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e95e8c8-1a55-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632171423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171423, "uuid": "5586c99c-10b7-4faf-b3b9-fb27248a2e24", "comment": "Malware payload", "value": "76cd8b11526b38779bc27cc2893d474f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171423, "uuid": "835b1ab4-9d82-46bd-be1f-61d93d8641e3", "comment": "Malware payload", "value": "b492f13d1a18d73e5b3e753db183eb072b551e538a71d662eb87a09cc19f4ac9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171423, "uuid": "0749a73b-dad4-458e-8a26-7ae0876c6aca", "comment": "Malware payload", "value": "cd65b0ff617b9a090b382573711afd9b88b0e998", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171423, "uuid": "dedce14a-a9c4-4245-ba19-a86db7b1ef97", "comment": "Malware payload", "value": "3c61a6dc3f86d0023ad6febf225abd501f2208a9e3a847fb78b7489e0683e673816a4179d0c32db55711c4fe59d14c4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171423, "uuid": "3f81e82e-a504-474b-85df-1d29f9c859f7", "value": "T1E7A208117341D07EC22A50BA5935F7E1977A7F919B2BE7833A805BBF7D686832C93600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171423, "uuid": "7c5be5b3-3fd3-4eb3-b4b9-8d7141960245", "value": "e79bb8547e73c388a90eee7f2f4ac9f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171423, "uuid": "db4ea690-514e-492c-832f-fe9968a16ad2", "value": "384:fEN4md7V4mnY1FnF2f/oTOuEjkZX4FkvYHpkkpJdeO+r+ka7t3aXj57WrBgelIt5:HmAmniFnF2fASuYkZOkv4pkkjcaxagru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632171423, "uuid": "2b3e1d1a-9456-4018-908a-a7d6329b87a7", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632171423, "uuid": "7605a76c-e026-4f07-b1b0-1710b37a9cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171423, "uuid": "0600222d-db13-46f8-b642-c8c0965e1df8", "value": "SecuriteInfo.com.Trojan.Packed2.43410.24771.24919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7febc0b4-19f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632131133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131133, "uuid": "59965053-3e69-4358-817b-ffe1854cee4a", "comment": "Malware payload", "value": "94ba15fb6d8c8b5acf2a692bb5f75806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131133, "uuid": "6e51d953-7b10-4915-8b57-cdd82d2fc5df", "comment": "Malware payload", "value": "b4c50166f03dda4dc5191354926bc1e3114fbc7ddf7f39127f8a480bb432398e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131133, "uuid": "de2aa86a-1ef7-4da7-976b-a2872f1ee48a", "comment": "Malware payload", "value": "79e14856bd99b6888d7eb6c490934e01f5b06e9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131133, "uuid": "f1107778-81f5-4007-9bf3-bca0ce5c2b33", "comment": "Malware payload", "value": "6363c199b8077d97b896649a4e157ca6f9ce428e4ba71bf67c988891c40ff4a426fb5838da16df67473a9909ad7a4970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131133, "uuid": "7ad3c336-d608-44c5-9a0b-165fb5dd07e0", "value": "T1BB12C7028B644551FBA2C9B113B54BAC897EBE33130570EF327BA9C59734A52953033F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131133, "uuid": "202f7ae7-ea2f-4ffa-9233-ab2494348d7b", "value": "3636696cda8ae63c15290a7642f2c7a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131133, "uuid": "3a6fcac3-4d62-45f3-b88b-442731fa5510", "value": "192:KK32xzpeBnMrntbTWtmP1oynmU6TWS/xcb:KK32xzpASbT6Q17oWS/2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131133, "uuid": "87b43161-aa48-46b3-b9aa-2901bc16fdb8", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131133, "uuid": "6af0c954-0646-4201-a4b8-e9eae2e9f574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131133, "uuid": "505f73b0-afef-4d59-b6e6-444a7603d3da", "value": "94ba15fb6d8c8b5acf2a692bb5f75806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c000f7e-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632160574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160574, "uuid": "6a115680-139b-4ec6-a841-35a5c311e2a8", "comment": "Malware payload", "value": "b3ea1ab693f56134c23ddaae1eba51fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160574, "uuid": "bbd36c09-aaaf-43da-a26c-63d5366b7228", "comment": "Malware payload", "value": "b4e9a4eab739b849b3c7c0918bb8287cb6569d03d52dc2ecd38f4a8bea0b32bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160574, "uuid": "e38a2ff2-83ff-49ed-a98b-edbabdd3ddf7", "comment": "Malware payload", "value": "42c99ffb246e7dc393d45b5a41af4c3b92e2d858", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160574, "uuid": "a8213923-89dd-4a8b-81cf-c21e994af123", "comment": "Malware payload", "value": "93970374cc6b878e57c954e4ce55eb591607f16fbd0c3d78d71384b4e35d8416d4344841111a18f7f3a9f6f62b6c2b39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160574, "uuid": "df5746fe-0e66-4ae2-b30c-d1f60bc3054d", "value": "T1069119A23220D907E08109704C89E2F8EA26ED07AD0F9359303A736F48703D96DE27A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160574, "uuid": "885d5b4e-8f5c-43f1-8c3a-f1a18d0f535e", "value": "48:r6cHZmhuuv60yl0afXv6CzhTTH3RoIvi6KVbJIH0REAM+S3pI+mGMz:mc0huuC0ylhv6M5z3dK5J/REAMt3pPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160574, "uuid": "5367ea9f-163e-4024-b506-dd8d2c2e1c04", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160574, "uuid": "6a163a69-0f4a-4019-b7c0-a6c8dbc54687", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160574, "uuid": "6d782211-014e-4692-bbfa-7f6e20e756f5", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.3.702.15258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fa751c-1a44-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632164077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632164077, "uuid": "14ed57b4-59f9-4c82-925b-269ae117d066", "comment": "Malware payload", "value": "9d40d9f2bea982d4af770beee1be821a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632164077, "uuid": "121c518f-3b9b-4c06-8f40-bc6bb1ec8a91", "comment": "Malware payload", "value": "b5552492886576b448ff426818ee13eec06835ddd3b3c40f07d2f0e6026fe5aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632164077, "uuid": "bfa1f670-b098-4f0d-9239-b5a79821269e", "comment": "Malware payload", "value": "d83946e8e9b2419e30cdddd03ad7e81783a845ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632164077, "uuid": "49f5f966-73c0-4e79-a91e-774e9eab3920", "comment": "Malware payload", "value": "a23bca1f30afe01a23518eed1bdb9f9ed1af986140a8ed5ab1479086d3d3d4c29b9b3d409369d058b27e2a886dc0b1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632164077, "uuid": "634a1f65-f359-4cf9-b8ba-69b4cd5b3692", "value": "T105059DC13D47D89BF4DF1AF398AFC12011656E9D9161C73D2682BA2B55F331230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632164077, "uuid": "82b45f3f-acad-4083-b31a-b27361217604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632164077, "uuid": "54ba140f-3a68-4a63-b5c5-837935df07bc", "value": "12288:j5MTd5U4ubssmtiK5oyZnkOe9M68jopv1YZH/OFXyJu2TvjUbTqlSzd0qvN:AGbz+Fo0z6MJUpefIl2jUbTqlYd0CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632164077, "uuid": "85669c96-6899-43e7-84cd-9b198664b520", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632164077, "uuid": "3ed0904b-fd20-43cf-8078-a817281668c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632164077, "uuid": "d27731f0-aba1-41d9-b053-48c3cbee0042", "value": "Pedido de productos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9340a399-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632137608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137608, "uuid": "1c46b33b-f687-444a-9fcb-43ef79d969fb", "comment": "Malware payload (Mirai)", "value": "deb08e6521d1fe67a505b455be428687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137608, "uuid": "a4e030e8-31e3-47ec-b4b8-4bf5bf91b6af", "comment": "Malware payload (Mirai)", "value": "b5b4812c81b66a7648006606786df982829416f4fc0cbf2025f566815824bd90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137608, "uuid": "6dc95ea3-e499-4ba7-a8e2-54873b547160", "comment": "Malware payload (Mirai)", "value": "966be117778e9ff810d6fb0070d35dcc7c4e6e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137608, "uuid": "27405540-a3c1-473b-bb53-431116ceac14", "comment": "Malware payload (Mirai)", "value": "452b4a351a4d88dcfe9c369054aa04cc80469f31b3a935321a9e4aaf78cd0b6264bfa0885108d65ae963bca5a8227a0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137608, "uuid": "a0a9566e-6366-4bfa-9ebd-a7c36cf4d0fa", "value": "T10364F1CBEA01AC7AF9DA47B53A6B0B0973F0DAC5D3C3B140E264C5443CBD685AB645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137608, "uuid": "b53eb7b6-2229-4863-8cc1-bda8f1fa343a", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coLPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZnc7PqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137608, "uuid": "165a9d70-c7ba-4c45-b10d-884dbab3f006", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137608, "uuid": "713c8315-6311-4885-a63e-9fee951aa17c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137608, "uuid": "f978a4de-d8f9-4415-a005-a37d84dd7751", "value": "deb08e6521d1fe67a505b455be428687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af80a1f-19d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632114831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114831, "uuid": "bf66ada7-c4ee-49ec-aab7-e9198a676bc9", "comment": "Malware payload (GuLoader)", "value": "ad2650e3a2571134ce1735e82c82a16d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114831, "uuid": "05ba997d-c97b-4a10-b51a-68a32a9d56a5", "comment": "Malware payload (GuLoader)", "value": "b68eea865b36382c8ae64a808cb7c1e10eebd99e6049143998bd4266a6569cfc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114831, "uuid": "612805fa-8f59-4866-9a50-11c84397d5e3", "comment": "Malware payload (GuLoader)", "value": "d5a12ccf5008d9d32d1421907221056dfa67af5b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114831, "uuid": "ac54d733-8a10-4ad9-8929-d55e946b69de", "comment": "Malware payload (GuLoader)", "value": "ee0c929ef43bfdf5b5de8976a76ceda9fe224eebdc15f544bb91f7763b37f54506fb7ef587a6a8315e7d50d6d5253c95", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114831, "uuid": "76e7d40e-08c2-4b14-93a2-d4e1d0be19ba", "value": "T113E312C59B89B70F746011225771350C873198FE922AAD598A752F180BEB29B0DFFC6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114831, "uuid": "736d55cf-7e22-4f4b-8d26-3b226ab819dc", "value": "3072:EYl87w9WY4TTbmGWDTHintGm5+w6JzteMrneCSLwIteNcs4tE/j923aUmw:fuwqbr6THAtGmgw6JBrn68IteOsuE7Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632114831, "uuid": "1f6e6dbf-5bcb-499d-b4e4-9d1613597814", "value": 147747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632114831, "uuid": "cfbbb830-96c0-4c06-9f70-c975d55d6c55", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114831, "uuid": "7cc60914-9ed7-4e56-8129-e9b273f97fc9", "value": "ANMA01101_85746535648163553537635.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c039de62-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632151857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151857, "uuid": "b88b1d5e-03f6-47ba-a880-f5f0b476c8c0", "comment": "Malware payload (AgentTesla)", "value": "78481f4e750ab2b65cb1dff0beecf801", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151857, "uuid": "64fd7e93-5617-4a01-8a38-4a36e68ae00a", "comment": "Malware payload (AgentTesla)", "value": "b7079ca35e52f9d75e5b0e1e6d8c789e2d99e3930aad4e811d722a905510c669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151857, "uuid": "a9e9374d-b661-436c-86e8-83b11f5f089e", "comment": "Malware payload (AgentTesla)", "value": "c479082836e31566789d7a5d8948d3776b67af8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151857, "uuid": "d14692e5-77b1-42cb-a8a6-d65047bdbb13", "comment": "Malware payload (AgentTesla)", "value": "7029735c24ceeffd73e64035bf14c17860465ff1ae94c99fa9703c3c68d535e58d3212514915127c7c27e74a7aeca6e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151857, "uuid": "97f33e66-b5fa-4aa1-b512-39035a01a6a7", "value": "T1B6D4F10470A446ABD52B6D782D6A810A1737DED1B6B4F9A38DCD788351FF670BFD2802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151857, "uuid": "50cc20cf-dd5a-4775-8a79-8ac1e573172b", "value": "12288:f8DFva+ECtDwQGwETLIJowUMgzW+YEdtmEQW:f8Dlxztq3wMxZ6E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151857, "uuid": "1cde6cae-ffc1-41e0-b65a-311cfee767b6", "value": 601976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151857, "uuid": "14645ce8-a6f9-4ce3-a35c-366ed4b85ba9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151857, "uuid": "0b206430-c313-441f-a302-84a4542d9cec", "value": "PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ca1b93-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125368, "uuid": "85fe33f7-713f-4a0b-9b79-66f08e87ecf2", "comment": "Malware payload (Dridex)", "value": "2647439cdeca393945d4557848120a55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125368, "uuid": "ca565bdf-0045-41b3-9c20-3f273decb067", "comment": "Malware payload (Dridex)", "value": "b7fa13ebabee554f1717a03f99a746ed83de8864a16ff4c99f06d17aab5d8c99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125368, "uuid": "9e1d3103-59b2-4225-822a-c9935bfd84fd", "comment": "Malware payload (Dridex)", "value": "c9b537d73d78598c838f34d5a5cbad2884554729", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125368, "uuid": "2092cb76-ad16-48c8-bbdb-eb3936cbca1a", "comment": "Malware payload (Dridex)", "value": "df4470f3ccbb570035172f27a383fea1d8db8ca95866025d0a7453c7567802bc413219c9393bf4bec073f35ebea2d8aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125368, "uuid": "eb5cbdb7-556f-44d5-9cc6-a94315217787", "value": "T1BBA5E010EE69E1E6C6B89F3E9408352727F93D75110D608CC392708F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125368, "uuid": "b2744979-cb71-4dbd-9097-4c57dd5cfd73", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125368, "uuid": "3178f769-3af0-4d3d-951b-51e2b5aa944f", "value": "12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125368, "uuid": "3e4a6357-80ac-409a-bedf-82fa9048e3c7", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125368, "uuid": "ba869c21-c0c4-42dd-ab3e-a96a1c4918ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125368, "uuid": "1b12a88c-580a-4982-a89b-1d4a9cddd3ee", "value": "b7fa13ebabee554f1717a03f99a746ed83de8864a16ff4c99f06d17aab5d8c99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ce01b4-1a22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632149638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149638, "uuid": "6fbd6d4e-353f-4366-a39a-d33634b195d7", "comment": "Malware payload (AveMariaRAT)", "value": "3cfea06304d4f15a2a7b9cf0ba55a05f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149638, "uuid": "009c5289-d8d6-4882-9dad-19bf7f22604d", "comment": "Malware payload (AveMariaRAT)", "value": "b81034355531153f6bd80f82d825a62d0ac6768e299ab3e67ea64bff72d7f5f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149638, "uuid": "6e9dcb07-eebc-4498-b07e-d16f67c35fe5", "comment": "Malware payload (AveMariaRAT)", "value": "e17c0ca0e0a421547bb51176ab5f2b260f095aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149638, "uuid": "4267178e-06f8-4b8f-ae8c-216306e8d9a6", "comment": "Malware payload (AveMariaRAT)", "value": "ad06e573f0b5aa5bdadbf68389e1454a8adf8c899ccedff35767d2af9ddb44acaf5bd49424a7319fbb470beff0885014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149638, "uuid": "06888ed1-9abf-431f-820b-d5c91ec415b3", "value": "T13E54F182318224FEE8FA1AB2E51B945059132C2EF932D86D07C972791AF335351E7F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149638, "uuid": "ed578efc-4fb1-4627-9a8d-c747c851bdf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149638, "uuid": "bd43e464-2b71-4df3-8dce-a5e7e641e388", "value": "6144:946tiXsXDlDUNPdJTzwedUhBg31TPvaieBKulYXJBNQfPP1W5ttOA:9ksXDlcJTzTSE35PBeA1SPP1StOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149638, "uuid": "ab979bd1-a078-4a94-b95f-dec876b42624", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149638, "uuid": "b10cf235-1568-4936-9b32-f1f4e8229f99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149638, "uuid": "83e2d77e-c69f-4067-8794-8b0f6241ed04", "value": "3cfea06304d4f15a2a7b9cf0ba55a05f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a145339f-1a51-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632169844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169844, "uuid": "f444fd31-c3ef-435c-b0f5-d042b363cc4f", "comment": "Malware payload", "value": "50e1042a8c1af929b5c775168f734807", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169844, "uuid": "75df4562-7725-4967-8938-97340350475a", "comment": "Malware payload", "value": "b819dbacc7b9c6205d4caddf56069348994ca55fdcdbd0a0bcc53c644b7a8b5c", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169844, "uuid": "1feadd5c-9877-49ec-ac27-c77a344ee2d4", "comment": "Malware payload", "value": "d41d0c430c1852d7dc107a87a3d7cee1d9e91c6e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169844, "uuid": "b62d9e82-d8ef-4c91-92c3-200911b45b26", "comment": "Malware payload", "value": "96c012415dec50a54e2a008609c5e72b323abf8854d02347c00283b819cb605098901d784e41a16ab661b8c109046cf1", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169844, "uuid": "d9eab00c-f332-41b4-8ab6-05ac127d1fda", "value": "T18B61860AFD4BD15CABB9236BDC97CA22FF1B401B9D92004C71DDC2591F2080896ACB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169844, "uuid": "98f4ab00-03b2-43bc-94c8-8cbd0e9ee7c8", "value": "48:A2NBU4SiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVYdorN:vB0GhrffvIypvK0elkEYZS+se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632169844, "uuid": "784021d3-b450-4972-a702-d05f208157c4", "value": 3180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632169844, "uuid": "faee7ed2-bf9e-4eba-a349-bf14e4930776", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169844, "uuid": "369e2f59-c3b6-4ac4-92e1-ae2b8676ce6a", "value": "8UEByb9A.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dca3dc-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632160827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160827, "uuid": "7acbe792-4243-4acc-94ae-fd526cf3c840", "comment": "Malware payload (CryptBot)", "value": "1193a9373dbb86ab8d14f33d825505d4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160827, "uuid": "c381dd18-1298-4d50-94af-66368ea4105a", "comment": "Malware payload (CryptBot)", "value": "b88d53e26318ee2a958bf6d8c22513a4a7337e0dfcfa77cdbfb9e4ff2d219e43", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160827, "uuid": "e3906071-0197-463c-b0ac-b171259898db", "comment": "Malware payload (CryptBot)", "value": "863d13c50c8b484ab757775aa1a704f1b5c41ba3", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160827, "uuid": "bd77cd77-a468-4c10-9ba7-89e85f36550f", "comment": "Malware payload (CryptBot)", "value": "35216008efe94f149de6f5d0a52d91a1f3dc4184a785f8379b68869553f83294b46ebb34056c86f4598a3bcb00eabfa2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160827, "uuid": "adfe7995-43d9-4c8b-8cb2-ddbb30284b3b", "value": "T19074BE20A7A0C435E5B712F4D9B993B8EAFD7DB06B2450CB62D13BEA16342E49C31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160827, "uuid": "a3fcb6aa-c5f9-452a-88b7-433f4af47d70", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160827, "uuid": "ea3aee93-3e2b-4ff8-a094-dc6026525211", "value": "6144:aU7RbGWOpJIoGrgqnQSJfqBuIU6Al4KKzwMd/KmgZq/gHrIOs9M:bF1OpJrGrjPJfqENd4Kmdy/8/gLIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160827, "uuid": "e62145b5-49b7-45f3-be0f-d5dd3b9f7dfc", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160827, "uuid": "38794f8b-985c-4117-90b9-47d24780ce83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160827, "uuid": "b1c2920c-4eb9-4878-851b-8953c3ad73fd", "value": "1193a9373dbb86ab8d14f33d825505d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd7e48c-1a21-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632149380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149380, "uuid": "7238f03c-c580-41cf-a430-4d22e94e0b29", "comment": "Malware payload", "value": "f7427ee4c70e06953390e6bd776b0091", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149380, "uuid": "0b8e8990-25de-41a8-ac09-28cec9290d54", "comment": "Malware payload", "value": "bb8bc0a8f886d3e6f88a79230ae7f84cfcc7afb554008ea123f743d454e59dea", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149380, "uuid": "04ba1c56-311b-4d4e-bf59-d0c6c459d6e2", "comment": "Malware payload", "value": "f5a0f9f0c76a75b16fbcdfde9fe0e0668d3af329", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149380, "uuid": "e864e049-28de-4a7d-ab20-20cbb4bc244c", "comment": "Malware payload", "value": "419a400ed0f0c817738684b140820d20a3d1126e2186cbc029fa584830dc4f221614877069f7cb19fa8396809d432595", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149380, "uuid": "b8adadb8-e2e2-49de-895b-51146f5bb7f3", "value": "T11DE239272582C0BCC9BAC3F44A9AA735D673B03912B5B13D23FCE9216EDED721E19504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149380, "uuid": "789fbbe4-de37-4bf4-9b71-a274e676d845", "value": "768:f+5LibMfGYrsp2n1WbvN2/1Q4ifId6Wf58aO2m3Ik1jIIn:G5Lq7Yrs8n142/1Q3565boG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149380, "uuid": "67edc879-3e79-4c2c-bf42-b94ab28c7ad7", "value": 31240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149380, "uuid": "1ddf8095-ea4d-4056-bd18-102b2fa3cb65", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149380, "uuid": "b9cff482-ff35-499d-a70c-1bebbb29797f", "value": "f7427ee4c70e06953390e6bd776b0091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70059844-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632160742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160742, "uuid": "723b8e99-b599-4a21-91eb-e1e5675f1cc0", "comment": "Malware payload (Smoke Loader)", "value": "66d3f7058b2759a99cdd8d9f06419d1b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160742, "uuid": "ec334751-9314-4d38-9858-b183995c5381", "comment": "Malware payload (Smoke Loader)", "value": "bba1f72c1e24600a479540b395d82b466c4e02d68732cc0198312efb65335fb2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160742, "uuid": "1f8e108e-fd99-4b9c-a594-4ea30b94b5b3", "comment": "Malware payload (Smoke Loader)", "value": "6c630995cd120a4abf6f9bb806d5b5dab96a9635", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160742, "uuid": "b10cb7a2-ee2c-4110-a300-d3a877344075", "comment": "Malware payload (Smoke Loader)", "value": "0a42645c22ccea171dc67a07fb4008a40a527bdb99c9a8915c95fb3e441f27e9122130dc61fc360ec841b6e9c1459942", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160742, "uuid": "c6133760-5e36-47c1-9144-010fef6991cd", "value": "T1AA448E20A691C035E5B702F8997793B8A92D7DB05B3340DBD2E12AEE56372E49CF1347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160742, "uuid": "129b6dac-d198-488b-ba15-94dacf1f2100", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160742, "uuid": "78f437f8-24a3-4406-b370-f8d52b0be3b5", "value": "6144:v07kEEGmQ6YI++rjqZQSRBqqkVFELjkICOvXOsVd+ha:MA1Q6YF+rQPRB6EV7fPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160742, "uuid": "ed6793fa-cb37-49ce-9b71-495b1a0c919c", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160742, "uuid": "f43a42e8-90e0-482f-8f1c-5f0f326e5d3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160742, "uuid": "f3bbb777-d154-4709-ab2c-ba8f7561ab65", "value": "66d3f7058b2759a99cdd8d9f06419d1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a034e75e-1a33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632156957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156957, "uuid": "0056c923-4814-4f2a-985e-f47f1b859d64", "comment": "Malware payload", "value": "360a190310d5932d3b79552bf986bca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156957, "uuid": "b0e1af0c-8009-4cae-a31b-099564e5b3d2", "comment": "Malware payload", "value": "bbed989e6c9f5c18912ecb40b2b479af24e35c4c4f8de934285caff6cb8d4171", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156957, "uuid": "84a679d8-080c-4de6-b861-71a851bf2956", "comment": "Malware payload", "value": "98e7500963114a4bcdfee05cd9d7b601eba7ab54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156957, "uuid": "b38d57ca-22fa-493b-9422-67fb0410b076", "comment": "Malware payload", "value": "ef4dfac4a24ada365a406abecc5b02962a12fb9145cc94bd191f308ed5bd7dca51b78e33eee42c32cfe4d5ca8ba02212", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156957, "uuid": "1c21d98e-0777-4f87-a275-1efd45391ef6", "value": "T14DE2F110F0284AE0E9FAABF2DDD5F2813BF32E496D9105D68392BD010C75B2D6546BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156957, "uuid": "f7109e2e-466f-4cca-a5ab-b7f3a67a508b", "value": "768:NRRzRH1CSD6jK4RrdrDjrhrEuc5ngNMNm6Koz4uVcqgw02NWXQ:N3DMVNVE5cqm6Kg4u+qgw06WXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156957, "uuid": "2e369d78-2205-4a72-9f88-f555e2e2be19", "value": 31216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156957, "uuid": "1511360e-d329-44c9-97a1-e27aebf75b6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156957, "uuid": "243f59d0-1f44-421a-ac33-7c6e7917ee33", "value": "360a190310d5932d3b79552bf986bca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314f0333-1a47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1632165361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165361, "uuid": "4f9274fe-eecb-4a80-84c0-c1c11b54ef9f", "comment": "Malware payload (OskiStealer)", "value": "1470a7fe9442318652cf8f2b587d67fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165361, "uuid": "97c8f988-69f0-4f58-a13b-1a3e499e1345", "comment": "Malware payload (OskiStealer)", "value": "bcecf11dcb821c77cefc134ea271ebbc8a639fabd57492ca016b1acd5c9a97b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165361, "uuid": "8f094ec7-58e3-480d-99e8-7c101f25b41b", "comment": "Malware payload (OskiStealer)", "value": "12a0f44695dbd8889ea866a80cf8d121e77e0691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165361, "uuid": "a2861e98-d578-4358-81dc-e1ad89c40ead", "comment": "Malware payload (OskiStealer)", "value": "57991d99485bcf61fa1a67f9f7d7b3a23b89826efc4ca3d181986c763335a3798dc3ab89156803c9f6efc345a59ec90b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165361, "uuid": "6ff24113-63d6-4cc9-a9df-09b3e92f5d59", "value": "T17494AC2370BCD5F6F85D3EF066696724AAB06E920630E147D65FBDE2E8B3223C5042D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165361, "uuid": "05812d0a-27d2-4fb9-8249-b561599e7cbd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165361, "uuid": "e4b63aea-8d1e-456f-8a10-0059b18adc91", "value": "6144:08LxB5aiUI48UhghPxc5g7dtyfLSQEguBPjDScIrJ8WiL8:1zUI48UhghPm5aae4WPjDSP1c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165361, "uuid": "637db60d-c1a7-4c5c-a782-ef865362d401", "value": 411607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165361, "uuid": "b5ad298f-15bb-4be8-8cf4-82a78682bb13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165361, "uuid": "0142ab32-f382-49eb-b53c-708f7bbd2478", "value": "1470a7fe9442318652cf8f2b587d67fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5846adb-1a08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632138551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138551, "uuid": "7c442213-6a19-41a7-9117-3905c16f3fdc", "comment": "Malware payload (AgentTesla)", "value": "66f16bb17bfff0f6a8e6649ace27bf3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138551, "uuid": "90da3720-e2ad-430f-a060-9b5f59ca4cd4", "comment": "Malware payload (AgentTesla)", "value": "bd255ad9335340a8231daa7144d22f020d7081e233fee1c031f57c1482ef15d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138551, "uuid": "5db916ec-0508-488a-a46d-9f4c89eb8c4c", "comment": "Malware payload (AgentTesla)", "value": "10c822c1bbefd74ec2a5470df7dfabc493a29aa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138551, "uuid": "490098f1-4fb6-481e-abc0-ea938331bd44", "comment": "Malware payload (AgentTesla)", "value": "5fa7ac8a78739fe16edf11aa5282959266f844289b0db348cfe62de1ae56b32f9b065d3b5405049650b402910cd6b7b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138551, "uuid": "68790b2e-5258-40e5-b229-ab4569754a7d", "value": "T1DC82D76CD06742A8CF8567781B2B5F85028C762DF7A59633323CA77427D2E7A822753C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138551, "uuid": "e72c9e61-e4d2-409d-9cdc-8d082cdd1fa0", "value": "384:Ody6LEK9ZFpe8APh+4xEC86vTzlhA/jL1q5WRF3WRP8:H6H9BAM466vg/j5fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138551, "uuid": "e2b564ec-a946-4291-ae31-eb3d3e6db29b", "value": 19113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138551, "uuid": "655f7efe-cad9-45d9-8d48-d68b620bff7a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138551, "uuid": "8690d22c-9c36-47df-a1e8-2be26803c803", "value": "MT103-6793029471938.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6544e7d1-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632155999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155999, "uuid": "d9951249-c063-4597-80f0-d93a3f5758bb", "comment": "Malware payload (Formbook)", "value": "571fbd383fdd865a8232b66a32fcdea1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155999, "uuid": "337b7288-f25e-43c4-b160-c0bec80d3bc1", "comment": "Malware payload (Formbook)", "value": "be2ed31f85df8e65c76d1fd87ceb62a6381c0c5244eca15349bb0976052c2695", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155999, "uuid": "ad991d6d-a78f-4bc0-a4eb-4ae7ebbe017e", "comment": "Malware payload (Formbook)", "value": "b7e85da9666049eaf62adac1e6a8c58ecc35513a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632155999, "uuid": "0a658324-6ee2-4afb-bbf2-87ea43f01049", "comment": "Malware payload (Formbook)", "value": "7d41c678ebc8b1d702ce8b6732d24e92cfc31052126ed5246243241724dc7521c13e911861e4493ecb74841395d86c17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155999, "uuid": "64870453-f396-493a-9390-9d83d13e3aae", "value": "T18A059DD13D47D89BF1DF2AB3986FC0201164AE8D9161C73D26927B2B55F335230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155999, "uuid": "55b02c19-b265-43ef-ac6c-a3de5f28e085", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155999, "uuid": "41c36262-1a05-4839-9f03-f5272ff931fa", "value": "12288:90A+smtiK5oUZzzz1c9GK1z1t8CyNAUNyWIqTIGQK:+Al+Fogc9vx1edLI9ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632155999, "uuid": "de76b0d4-5809-4f47-b25d-b655ca72f179", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632155999, "uuid": "211403b9-d789-4f6b-bf38-d97327f71583", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632155999, "uuid": "2eaf1a93-6aaa-471c-9fa7-5c3f057020a2", "value": "571fbd383fdd865a8232b66a32fcdea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28427d35-1a00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632134851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134851, "uuid": "7cef50ae-165b-42cf-8c24-754f0dc72d96", "comment": "Malware payload (SnakeKeylogger)", "value": "a8f416f75bd989630fce057827f64e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134851, "uuid": "64375ad3-da94-4230-8e38-213538799f6e", "comment": "Malware payload (SnakeKeylogger)", "value": "bf0a215fcc616269d25eba2c5c14dc559be3da9e1c6a4656103f15b453a9d393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134851, "uuid": "64eef79e-e5d1-4cc1-b017-66ddae6ca90d", "comment": "Malware payload (SnakeKeylogger)", "value": "53325e03cda388f6d306f2d987c7f395d2188feb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134851, "uuid": "309e0134-6cc3-4d79-bb7d-8c35e7436fbe", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea47d8fae6ea21cffa7aceea967c1814dacfdbce91f273eed8b3a5d278c1cfdfc6707fb788574842908fb3cb5d47fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134851, "uuid": "1d800d68-a496-4b73-8f9e-92274b9a6691", "value": "T1F9F49DC17D47D89BF4DF5AF398AFC0201165AE8D9161C73D2692BA2755F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134851, "uuid": "5655bfe4-fdc2-4186-a063-6ad0261a1553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134851, "uuid": "bef16494-f13b-4f78-94d8-689b623ae9b2", "value": "12288:IcZsmtiK5oCZi31kEJ0X3tq/G2j1DD73N92NS8DVMKGQKs:w+Fot3nJ6d3DeKZKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134851, "uuid": "89292013-390d-46b0-99aa-996071014972", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134851, "uuid": "3625a087-b214-4b03-845a-61b92b96b936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134851, "uuid": "9e00853c-7591-42ac-92c0-15ed65d000ae", "value": "slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944a5cba-1a4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632168104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168104, "uuid": "bc930fd2-b59d-4733-a4e9-f9ac579710e3", "comment": "Malware payload (Formbook)", "value": "dd9dd4dc96b829fb76c94d93549077a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168104, "uuid": "ee8df60b-d6d2-4a95-9eb1-be9f06af7a90", "comment": "Malware payload (Formbook)", "value": "bf335484cc9fdfc68bda67acbe6eab1f65f0f7dd7043b3aff47b47201ca531c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168104, "uuid": "a04e17ce-11fe-4961-80e7-1fd2a3a2effc", "comment": "Malware payload (Formbook)", "value": "ab1b5e44e32b93b10f1697ef407e4e846da30226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168104, "uuid": "4bb4dd72-8abe-4caa-a702-174be194bcb8", "comment": "Malware payload (Formbook)", "value": "8d632789ae6ac6aa7e11271d67846f3f8df18270db8ba1fbdfba21d017001bf4d0c79d3e26a0177a271d0847f9387002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168104, "uuid": "e52d17dc-5032-44bb-9e35-5cdb90e5e339", "value": "T110357CAC3711F9CEC567EE3A86243EA49B5071A70317F343A52719E9E54E4CAEF140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168104, "uuid": "dce131e4-f1f5-4d4d-8ebe-655fd579b602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168104, "uuid": "3426244d-38a9-4437-9b56-e7e275bf3769", "value": "12288:Q9qpJkrMMPJ9odMSuBkfesNpx7tQUfERTEQTATUcUe9IV2xZpT+liJ8/y3x5EoTD:3khTsFWwP9T3fGKrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632168104, "uuid": "c7afe1fa-5df5-4313-8de8-20f779093ded", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632168104, "uuid": "147efdbb-6b39-425e-a669-7a6a680b4190", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168104, "uuid": "50cbaac4-42e8-4ecb-8262-af0f926d0611", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f029693c-19ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1632134757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134757, "uuid": "2fa0c081-27b2-4d16-ba8d-a8565dcb4498", "comment": "Malware payload (Amadey)", "value": "12259e5047e75174a009fc3caa73f8b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134757, "uuid": "7f5e260c-65de-47f8-b22b-d379cac6da83", "comment": "Malware payload (Amadey)", "value": "bf72cee251615ca0af6b861fd4abf781b007249d3b0bc8612bcb37bac0d427f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134757, "uuid": "d99c4d66-ee11-4888-8b69-d8c885fb51dd", "comment": "Malware payload (Amadey)", "value": "9578c616a78b788d77d52e5d56b97b89ad584a46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134757, "uuid": "1a34f07d-d5af-4ef9-9039-5d89ce51cee9", "comment": "Malware payload (Amadey)", "value": "1598a623a9b7312d0e2041e6f91c3aa8d19838b191baa2527fe2c176bbe64d8370d2e37483c5679cd7158cb3e23d6a42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134757, "uuid": "4820c0ef-4f94-4c59-a9eb-b4e300fb543c", "value": "T122E61223B389643EC46B193A8537D6649C3F7F627912CC4B6BF4694C8F391416A3B60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134757, "uuid": "ca89fe7e-562f-4505-b888-d3bb59de1bee", "value": "b1f273e55d954a3cd6ab7388915a0485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134757, "uuid": "9ca8d4a6-e8e8-41a7-98b7-fbec685d6957", "value": "393216:PbiLGer3qcrnjzX7t1zXjsgyPCrov0P9:iGer3drnjwUovo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134757, "uuid": "6984cd2f-1ffc-40c4-b6a1-a30a7ca432f4", "value": 14155763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134757, "uuid": "af5ebb17-4358-46e0-a8b5-7a9e91686700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134757, "uuid": "3a1b73cb-455f-44ce-af9f-bbf180037e83", "value": "12259e5047e75174a009fc3caa73f8b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb2d2c4-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137736, "uuid": "9ba7a5db-795e-40fd-acfe-d38b419461a1", "comment": "Malware payload (SnakeKeylogger)", "value": "2f1ae4a0248f133bb1bb5f10c635512f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137736, "uuid": "b63cbdf2-d237-4836-908f-85297f762659", "comment": "Malware payload (SnakeKeylogger)", "value": "bfa824470903998b75ef5e217b14a603582c15d4bbb97c61d5be530d1c0adaff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137736, "uuid": "b7528e45-d097-4c43-83b9-77584b173145", "comment": "Malware payload (SnakeKeylogger)", "value": "f8e4b6f48a62e4d150b5cf54096aeeee9780d3b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137736, "uuid": "35a8c27f-2039-4e88-83d9-72dc3717e9e2", "comment": "Malware payload (SnakeKeylogger)", "value": "9b9b8e3b95255b8f6079d6a599c963567368171280607d6daf151b077e76263c3a1570012287c2904f87c455efe3b9f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137736, "uuid": "7dc83872-dfaf-4609-9531-166c29dc7204", "value": "T1FCF49DC17D47D89BF4DF2AF3986FC1201165AE8D9161C73D26827A2B55F331230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137736, "uuid": "163559e1-0e7d-4ecf-b186-4ba86c5f1796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137736, "uuid": "fe765f86-9590-4d4f-bff2-948a33dcba73", "value": "12288:E5MTdwzJpPsmtiK5oyZU0CcrJ6Ogj1SgAA/Fe02QNBuAvm0hF0CuWWYBAS8:iA+Fo5iJJgckFecBdO08xYBJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137736, "uuid": "543ce32b-1323-496e-8b2b-25ac7e0b7e25", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137736, "uuid": "2f372f86-c77b-43b7-ab51-9049a2153779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137736, "uuid": "317c3766-df64-442d-b3f7-ebae77d81a1c", "value": "RFQ-847393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cfb4ec-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632118280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118280, "uuid": "15155481-7507-497c-8133-5d7c972d194b", "comment": "Malware payload", "value": "a575dc6911753f03e840afa9f2bf085b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118280, "uuid": "6841b570-0b99-4e30-a5e2-c7ede9fe7332", "comment": "Malware payload", "value": "bfc2f954a1a586ef94ee8a1a0c91a698fbc7b30d3d1d05882605fcea03482add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118280, "uuid": "04b8b567-2d42-4aae-ad74-fd0e4957baed", "comment": "Malware payload", "value": "a457143c7a90f02e4e10f26a7473009175850149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118280, "uuid": "96d8a394-c783-4894-b2e9-ef4aa309d448", "comment": "Malware payload", "value": "2fbf7295380bda1b17e4477b20163953c6a90e0125e21961e252bf7cd7ae384af192c0a0bece73c10d632e20c6e81871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118280, "uuid": "98bf2dcf-b05f-455b-803f-52b0816066cf", "value": "T1969412811ED2C87AC46523BAC43B9D5068223472CFD537AD8399F52EF836783E81765E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118280, "uuid": "d1fa42df-f0de-4f90-8403-6d704dafb903", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118280, "uuid": "adddd18c-e9c6-4255-bf1b-b7d45072459b", "value": "12288:rYV6MorX7qzuC3QHO9FQVHPF51jgctx7z2mre:IBXu9HGaVH6+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118280, "uuid": "edeea99e-4b20-4e90-a85f-480cc1a09d99", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118280, "uuid": "3103d33a-4c69-4d3a-943e-249094e86bf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118280, "uuid": "268789ee-835c-4d9f-a822-9c14dd92a0bd", "value": "dhl_tracking_shipment_document_009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc985bed-1a67-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632179446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179446, "uuid": "b4738bfc-c443-496b-9339-c5705c6a52c1", "comment": "Malware payload", "value": "bc13d63864623c9a0967d357b73f6a19", "object_relation": "md5", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179446, "uuid": "b3cd06c6-1b18-4979-918b-1b307bd1f8d6", "comment": "Malware payload", "value": "bfe34551ed4f69054bee39a9adddebf5ce6acf741061920e394e54b3aec8b3ea", "object_relation": "sha256", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179446, "uuid": "1385d633-351d-40b7-92c5-92137c81b5e7", "comment": "Malware payload", "value": "15f2e949e55a0d1bf1386ce81461e0f0dbbddf74", "object_relation": "sha1", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179446, "uuid": "77ad5e11-ef7c-4cce-83fb-e8279cbcf700", "comment": "Malware payload", "value": "7c7de900e17083b964d9bc47fd14fd98171ee43e7dfe2873924aab52f403a47b2de7bd1414f61d94663cdc12be4d20c8", "object_relation": "sha3-384", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179446, "uuid": "0606b73e-e775-44a4-9afe-20eb70a58ed8", "value": "T1AB14862472997E43E23D747D50112A0C63F38BE72E96E7557F4D89F92582AC38B2CA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179446, "uuid": "7e83af83-cf56-46aa-8a0b-fa11d455fa49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179446, "uuid": "0289cecd-b35d-4d97-9346-c01fa2ccc43f", "value": "6144:3IMcw8/fpFHVLpVpq+70pKXQl29ur4c8:Oj9Lp/q+70pKXQl29ur4c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632179446, "uuid": "c8f53351-a7d4-4450-bf72-09f5cfd6e1a9", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632179446, "uuid": "e2dced64-504d-4d4d-a9ae-009d176babbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179446, "uuid": "e7db5414-b4bf-4702-84b4-47c6adf53d3b", "value": "taskmgr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beb3e47-1a50-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632169325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169325, "uuid": "86b1f916-40a1-49ba-a429-f9ab32e6f988", "comment": "Malware payload (AgentTesla)", "value": "b72a74eaa8ff44c56a003f08a7c6651c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169325, "uuid": "9d0a598d-7b68-4137-b602-2967f371f10b", "comment": "Malware payload (AgentTesla)", "value": "c03006ce889096c3287e0b33790e10b45b26a376e46bcfb89843f4cc577ca6b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169325, "uuid": "a67a45e2-880f-43b4-8925-738db670d547", "comment": "Malware payload (AgentTesla)", "value": "d002b6301a0fee42fc3410166296b16aa1733a75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169325, "uuid": "cf467e5d-0179-4346-ade1-214f77be5495", "comment": "Malware payload (AgentTesla)", "value": "b25272373169cf341ed1d967c53231e5192b6210a3ccd87b7f3ef10684f95045fd7f334c914d39f9fbee31b74a209b06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169325, "uuid": "4cc801a1-3cb7-4610-9df7-1881eb28cb3e", "value": "T13C458DAC3710F9CEC567DE3686243E549B60B1AB0207F343A56718E9E94E4CAEF540F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169325, "uuid": "49fb9d86-780b-4574-b2e3-760e5152e08b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169325, "uuid": "9718f6ff-0a7e-4c83-8687-e28b613adcf8", "value": "12288:6Bm0DiXWnTCGeNOXg+Oewy9493JqfcoQAJXvmUhjqD6PsJSTuQMmeKAwaEqLrqKa:6Y8IWk8GU4/ybvmELPsJvQCrqbTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632169325, "uuid": "988be4d4-1f26-4ccc-9707-0c1bbd2824b6", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632169325, "uuid": "48d04bb6-b830-4bf2-99ed-52cd4e226150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169325, "uuid": "80bca9bd-6639-4683-86e6-7cdb24b6eb69", "value": "UPDATED e-STATEMENT..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5fe73d-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632153008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153008, "uuid": "c69cd9db-d87d-4e1b-a0ae-122265720e8d", "comment": "Malware payload", "value": "bd3e58a94c731ccc28b5a05b976ffff4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153008, "uuid": "090529eb-932b-4a58-b4d9-0bf8f951975d", "comment": "Malware payload", "value": "c090679a740548c78a066a92bb6e442b969627df8da89fbee10bd28895015d7f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153008, "uuid": "876df292-c960-4991-9554-f534c406a06d", "comment": "Malware payload", "value": "d859c64f688c39f01f980a987909e429d8892353", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153008, "uuid": "0e526917-4ccf-4095-b0ca-2b4cc8d72382", "comment": "Malware payload", "value": "6b32f12d06e74de786e42c69a37dac1b59c5afb56219dbf1cde3496c94192c4316a8a500d246cc4cc707b115964f0a87", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153008, "uuid": "2e76823b-afe2-47a7-ba99-33638ee08dca", "value": "T10FE2D021EB0369F3F2E10CB73AA6C504639272B8ED47B5B7AD190368E4D30425B758CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153008, "uuid": "e62507af-f898-4b21-8803-ecfe1227e16e", "value": "768:5QCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPZ8e3UY:5QCGEE5EsbD9LfInoZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153008, "uuid": "eeac48d7-3f7a-4e23-bd79-54cf1605e5b1", "value": 31752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153008, "uuid": "d667a9c4-6444-4b54-9ec7-668274f02fcf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153008, "uuid": "6bd3eb9a-b83e-45a2-a428-55e175285dcb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb926eb1-19be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632106832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106832, "uuid": "58352f1b-141c-4418-bfeb-5511af89f82b", "comment": "Malware payload (RaccoonStealer)", "value": "2723f3941d8342b04d5af94079c3bdb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106832, "uuid": "011a0996-201c-4b02-a3df-5b1d8de9dcb5", "comment": "Malware payload (RaccoonStealer)", "value": "c1545e4cff8b74630cf80b0631d197dacedbd3b65725153913c9ebc83e8b9420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106832, "uuid": "9987e2f4-9bdb-4be3-be7e-7c771a45f0ab", "comment": "Malware payload (RaccoonStealer)", "value": "2aacb90f59204876509d290f5af6a34f6532c71b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632106832, "uuid": "a8f56867-26c2-418c-a044-c3fa45bf004f", "comment": "Malware payload (RaccoonStealer)", "value": "2219630265921d5487b1a894be3872931eaeb8dcf1e80e23a2e65106d0582645581c283fedb9da1b84fdd91491e4c9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106832, "uuid": "61e62eb5-14cc-4d39-b473-930e2b6a924c", "value": "T142B4E0207BA0C035F1F702F95AB593A8B83E7EB26B3450CB62D516EE16346E49D30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106832, "uuid": "3acc7167-4278-44be-8ed5-b4a8f98d47b2", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106832, "uuid": "2e26661c-ede7-4459-a74c-d3f7cfaab1da", "value": "12288:hZrvkVKLsH3vP9rkQF/gRtLeoPvTl83cfWqKGvSUGo/7bXP0:hRvkVZNfF/iKAbl8CgG6LojbXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632106832, "uuid": "91040339-3d50-46a2-bb5b-bdca3a4dae03", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632106832, "uuid": "2bdfb0b8-3667-4bc0-ad02-5a8ac32bf48b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632106832, "uuid": "b9634173-8efe-48f4-935b-8f94613384b2", "value": "2723f3941d8342b04d5af94079c3bdb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7461fe09-19f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131973, "uuid": "794aaa93-6213-4af9-8ac1-fc3b21f2c147", "comment": "Malware payload (RedLineStealer)", "value": "4688225e63fefcf0b95378bd013589f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131973, "uuid": "e97f8a4a-6ddc-427c-874e-aa3fbc072f1f", "comment": "Malware payload (RedLineStealer)", "value": "c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131973, "uuid": "f6538947-5a81-499b-81a5-421e7064e758", "comment": "Malware payload (RedLineStealer)", "value": "e7b62657fb7f707beaf38f1d1063691ed2c57d8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131973, "uuid": "28512831-5e5f-4116-9751-6655d5a442ab", "comment": "Malware payload (RedLineStealer)", "value": "44443d0968af30c9d9bc56abfa83d2188980d59673496d0c0cd68d605840c716632c9bdf7d7d1dcc1a9e6a9c7180acb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131973, "uuid": "5c4e2d50-2c3c-43dc-856b-654519f8fc22", "value": "T16AA33A2913BCAB35F6BE6B792460051583F4E08BA812EF5F9DC054DA3F22F41A6546F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131973, "uuid": "56cf917f-64a8-4837-a51a-8cafdde69a33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131973, "uuid": "45509386-2508-4618-b185-ec0a6598022e", "value": "3072:mXq0GF3ioT5LoAOjyA+fbmgJ80ymd/AVpYB:h01cbmgJtyMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131973, "uuid": "922e96eb-73b9-4545-ac2d-6ff55c1c1fcb", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131973, "uuid": "a87358e7-b7ee-4f52-8b42-7eda7ef8327f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131973, "uuid": "9398b678-e569-4868-a799-64d1d879db40", "value": "4688225e63fefcf0b95378bd013589f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b943cd02-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137672, "uuid": "b54cb125-ef64-4d4b-b6b5-ebf4142fbd1c", "comment": "Malware payload (SnakeKeylogger)", "value": "1b74c3b743ad0d1ebe8ec784674376b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137672, "uuid": "16c9cfa1-7f42-4527-bc20-4e97003704c4", "comment": "Malware payload (SnakeKeylogger)", "value": "c1af93073fc2a1354950f2d745782986d860da36bc1d4a3fb2b61c9354b339d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137672, "uuid": "4262705e-791a-49d6-a349-e2d4ce0306fe", "comment": "Malware payload (SnakeKeylogger)", "value": "397a1f093bb19c9a1c0651575f7d0fb75056e3b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137672, "uuid": "98fa099c-d484-447f-8f0a-92f2267be78a", "comment": "Malware payload (SnakeKeylogger)", "value": "86199549cda9962ae9c7b1696682e0846de7cb6448f6acc7fe880d4053af9d86e955e29e88fbf026b867174bbdad8e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137672, "uuid": "c99a5b58-b853-423f-a503-058121dac361", "value": "T117F49CC17D47D89BF4DF2AB3986FC12011656E9D9160C73D2692BA2B55F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137672, "uuid": "365c0d30-b437-43dd-996e-c1294818dad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137672, "uuid": "0cd59942-1cdb-4288-babe-b234e78acaab", "value": "12288:M5MTdfWSTsmtiK5oyZtTTKn1LVH/re2+G36D4O2Uqb2QKd89AS8:Rk+FoiP61BfiMK8VbkuJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137672, "uuid": "e9c26c0c-35bc-4fa9-b5e0-04b81bb91614", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137672, "uuid": "bf686df7-999b-4985-8a49-4ca54ba49d62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137672, "uuid": "f10b5cdb-0cf3-4448-87d3-f71ca3a301f4", "value": "MAWB 057 01237622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beccc6c-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632153004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153004, "uuid": "5ae244ca-b2b7-4015-b4d6-79b7dce7b29a", "comment": "Malware payload (Mirai)", "value": "104b7e36d90e92695ff2f074eed9b434", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153004, "uuid": "90ce7323-d0a6-40b7-af4b-e71cf576b304", "comment": "Malware payload (Mirai)", "value": "c2f74bb428863593ac3944d9c80ef1ae93f98657c998f0ac66340b32bc558772", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153004, "uuid": "8ccafbc0-cafd-4a78-8677-7c556fcd9d34", "comment": "Malware payload (Mirai)", "value": "b62e2a92ba87433bacb695f22e3fbf0c37f2c319", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153004, "uuid": "4c50655c-de7f-4e96-a19d-081f55d1c39f", "comment": "Malware payload (Mirai)", "value": "1c892d1a0eea595ab6163905a50c05f30b8ca08f35cc6ee53f8d34911ab1dfb15b73775fd8725382034ba710e63579c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153004, "uuid": "1e9d1042-4a80-4766-b45a-e368192736c3", "value": "T138D2E122F09B9BD7E16A0CB70CDE349A0410A70F6841B9E7AEA533364D43F54636DA67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153004, "uuid": "a9f35c23-5e66-48a9-9481-a476b4aea5da", "value": "768:0d78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMAhgIxynbcuyD7UryqR:K7RLHY+5tVbKH16KMAeIwnouy8mqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153004, "uuid": "ddbeef7a-eade-4377-b62b-4bc35f3f5723", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153004, "uuid": "e4eea578-430e-4941-b38c-e907b1159dff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153004, "uuid": "b92a7c19-481a-4db0-9cf9-b781f50fbf6f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ce31b8-1a28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632152289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152289, "uuid": "f8f148cb-5cd3-44ef-a83c-06ba3de1a951", "comment": "Malware payload (GuLoader)", "value": "0379cf12ef3850e1d9232774a3d469c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152289, "uuid": "e5e31ea5-ccf5-46ce-9257-dc6554893a92", "comment": "Malware payload (GuLoader)", "value": "c3eb1c9dae9be362c95a02f393f3da600615533c0def47835003a8a3dadcd484", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152289, "uuid": "cb69a23f-2a84-4b5f-8668-f645d26ab8f6", "comment": "Malware payload (GuLoader)", "value": "273823b9a1c758a5549d838f3024172f72f5e65e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632152289, "uuid": "43f35011-0ed7-49cf-a5fb-5af1cbfafa90", "comment": "Malware payload (GuLoader)", "value": "cf558dc865b47a4712ef7eb57ff2a77d78fd76a2542a2ce1fa7695c486d0dac174e59f1198615e882104f3d7a9a8230c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152289, "uuid": "bff9c8fc-848a-450e-afca-336164d70b8a", "value": "T149839E92D6F40CFFE996877D08727A740146FC565B24EE0B28887F0D3BB1786A7A0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152289, "uuid": "8281db31-9536-4eb7-a3e0-84b24bf914e4", "value": "40768f14753bfb2d577d092577251956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152289, "uuid": "c05a05ab-fefe-475a-9881-7d7054fcd8de", "value": "768:ZWpUGQd8h4JV7CH2pLiijD2EZskFEH1Czt5jHzGkj1KOX+2W3Rt/+M1p7ywMwD:AwgWHpR0HczTzG4r8t/Xry/wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632152289, "uuid": "8b249096-611f-4784-b63c-f919c45a3dfb", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632152289, "uuid": "21ccdf95-da34-4e7b-bb70-099911efe24d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632152289, "uuid": "54461612-b816-48ed-a1f6-5e899a556ec7", "value": "0379cf12ef3850e1d9232774a3d469c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecc1e49-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Metamorfo)", "timestamp": 1632116072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632116072, "uuid": "fa20017e-6ddb-4541-bc46-01c0c074a5c1", "comment": "Malware payload (Metamorfo)", "value": "4088d3a7233dceb398316a235c42282d", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632116072, "uuid": "981c08a8-0835-4403-9420-fd24cb07efab", "comment": "Malware payload (Metamorfo)", "value": "c46837174f6b770db91fb663d9670376cdfd54894daa19694537d1d6100013b1", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632116072, "uuid": "4a729174-7f22-4a09-ba60-df6cfa2d2075", "comment": "Malware payload (Metamorfo)", "value": "ae944bddd30fed4591f99c58675178aa383a8cbe", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632116072, "uuid": "51b3ba5f-45d2-4345-a2a0-464a54d45662", "comment": "Malware payload (Metamorfo)", "value": "2bd832319b79a039d8d0f50107415c758d7f2a302905cc123ea18393bc2da914ddd082077c2e9d331f12fa5e1032e4fa", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632116072, "uuid": "c28723d7-59d4-4d78-bcf5-949ad16fe041", "value": "T197447E06B3D5437AE4DB03721B8F93628A72EC788673812B1649750E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632116072, "uuid": "62b25eb7-fed6-40a5-b613-146ab5a7bee3", "value": "3072:Qm46fFq9m3DcYoAQwgz88ereWn/7w05g0ZXMcB3RUN46ILJ9+ZB5yOan8M:Qm4y33DcYoAh8er1nzTArXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632116072, "uuid": "ba44bf96-62a3-4d46-8be7-d8f4cf039a88", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632116072, "uuid": "6cf445eb-34b7-41f7-8013-7683410dc90d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632116072, "uuid": "6f1c6250-42f6-42ec-af8a-0c0c2ccd95d6", "value": "FACTURAS EMITIDAS.46.564.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881a2070-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125563, "uuid": "d2223ba3-8623-4af1-a264-5b8e2b028da2", "comment": "Malware payload (Dridex)", "value": "cd8844e27b386a372649c3cfd8859403", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125563, "uuid": "78e11f32-9814-4a0a-a7d3-0b0fc4b5e2e4", "comment": "Malware payload (Dridex)", "value": "c47e4ce48b8ba7c4244f8991d0fdff790016c02c1d14d01fc48a3af23b89e36a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125563, "uuid": "f63470fd-f417-4215-8d01-2daa7a823ed3", "comment": "Malware payload (Dridex)", "value": "43c4eaa9ff48c542d6bf5a8f2208abadb9772e36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125563, "uuid": "9fe953cb-707d-4027-83fd-61eb1b9d64e8", "comment": "Malware payload (Dridex)", "value": "424823dc6d7f88a05c79c6616c4b2ab127aedd7457893ebd0206909563235419c4fb79ca2ec0784ff9b07b7a6250f8a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125563, "uuid": "0cef6e8f-9509-42d9-8899-dfba1ca88992", "value": "T11295E020EE69E1E6C6B89F3E9408352717F93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125563, "uuid": "68ce0ee5-80ad-4908-9227-4723856cd498", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125563, "uuid": "15949761-ff93-48a7-9137-2aff26f1dad0", "value": "12288:UVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:RfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125563, "uuid": "bed1e090-9da9-41bf-8d42-fa4ee37a7c7f", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125563, "uuid": "86393ca6-aef5-4d32-8e87-6576a349de20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125563, "uuid": "c66af486-d767-4425-9aa3-59dddf644a86", "value": "c47e4ce48b8ba7c4244f8991d0fdff790016c02c1d14d01fc48a3af23b89e36a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e1dd87-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632118126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118126, "uuid": "17438ce4-9992-4cfd-a332-05c13949c6e2", "comment": "Malware payload (Formbook)", "value": "74fa450d0d5c2635b91a63fec6a6014e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118126, "uuid": "fa3cd773-bb8b-446e-bc74-9f070331f599", "comment": "Malware payload (Formbook)", "value": "c4cf66d4270ed0cd9203da8136221f9615b65b2e99154c349ca70edbb0b73218", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118126, "uuid": "553810a9-57b1-4718-81d2-835acb80d0d1", "comment": "Malware payload (Formbook)", "value": "b9c4dde16c1882145f0cdf26400365f878c8608b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118126, "uuid": "cf32646f-5e36-4715-85ae-dc5ee0d7b550", "comment": "Malware payload (Formbook)", "value": "22de348e6b96c1cecd22d3c3296e8d38ad11d089051f50b0546ebce26570099b24c8f46e85bfc529739c051cb346cafa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118126, "uuid": "a2f57e68-9361-4e7d-9224-673d0a13ff9f", "value": "T1A4D4F0443FB8DBE5E51F93F8180A4334068FDC588B2FE5A2D9E1BF4161FE6A19825079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118126, "uuid": "7b6172a7-f6ec-4446-b612-c7d4f4d0f7d8", "value": "12288:TAtshWlQz2OGouJYkg364XKLuSW8aP/p3NVSPTFWMXQe18S4b:UtlQKO7u6knoFB59MQZe6SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118126, "uuid": "9f1d1b17-b804-4b5c-b9d2-dea4a2859c39", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118126, "uuid": "f1d4a5c4-6547-45e9-9773-39e2c2502396", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118126, "uuid": "37f259c9-ac99-440d-b133-70dcd6229655", "value": "Hua Joo Success Industry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f0002a-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125429, "uuid": "7ba7630e-ceb6-4acd-a773-695f35655bc4", "comment": "Malware payload (Dridex)", "value": "08fbd58c7d58f3cedd450f086da6385e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125429, "uuid": "9986668f-5d9c-4fe7-b8dc-34a6f040f152", "comment": "Malware payload (Dridex)", "value": "c4e20370b726b8110bf782ba59d48189a7a4ea432bea3bed4828fea5a7d37058", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125429, "uuid": "052b10c5-860f-42ce-ad0d-856cecb4ea4b", "comment": "Malware payload (Dridex)", "value": "df987fbf264e979262f761b11394f23b33a3bee8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125429, "uuid": "297bef6f-61d2-4114-b5ae-f492362fa4bc", "comment": "Malware payload (Dridex)", "value": "b1b448acd5e46dd0f129d7cf32919482142f8d31f949060d9435f7f5e9f6343530fb60496c08a638b17a997f97f02b13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125429, "uuid": "ae1ce204-cb39-4cdf-8d83-d6766de4aaef", "value": "T16095D020EE69E1E6C6B89F3E9408352317F93D75110D618CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125429, "uuid": "62524659-5d7e-4c77-8121-72f8b3e33b05", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125429, "uuid": "3fa05a76-140d-4f24-8341-3bd6c7997b23", "value": "12288:+VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1g:jfP7fWsK5z9A+WGAW+V5SB6Ct4bnbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125429, "uuid": "dbfe1219-19e1-432f-b0f7-62f791606e66", "value": 2027520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125429, "uuid": "8e5dc39a-edd1-43fb-8cfa-9cf230769295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125429, "uuid": "456eec0e-4fdc-440d-ac05-f6325e284f74", "value": "c4e20370b726b8110bf782ba59d48189a7a4ea432bea3bed4828fea5a7d37058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856e596b-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125559, "uuid": "826d3ea0-7889-4cea-b609-20ccab38d5f6", "comment": "Malware payload (Dridex)", "value": "e593c1e8c5cc4a890feeb87ef4bc2aa7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125559, "uuid": "915373f3-e0e6-4431-8038-74b42b678642", "comment": "Malware payload (Dridex)", "value": "c4f71f74c786458c6cf58fff7085fc7da56586d9a9d6a7c54944585e7af35de4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125559, "uuid": "24f6aae6-26ab-4998-a420-23e6d06b506e", "comment": "Malware payload (Dridex)", "value": "3f766522f2a8315764f0c5e9d0602290aa67eab5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125559, "uuid": "555f7ded-fcda-43ea-a26a-23a4abe7ab4e", "comment": "Malware payload (Dridex)", "value": "ccfbcb1485dd657f077db2acf9b11ad326148391879ede39a9a76b2220c506f4c142bd5239b89e53d0fc8b189637d609", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125559, "uuid": "0d6c316d-c747-473f-ae97-d8f7b661752c", "value": "T1F195D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125559, "uuid": "ad60cf9e-190e-4b35-a8bf-a4df4bca0ae9", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125559, "uuid": "c3198886-b9c7-49b5-8874-955503764e41", "value": "12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125559, "uuid": "68b6241d-1df7-4de5-9e70-d4c6fe744936", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125559, "uuid": "ababe0cf-5616-4c29-8136-2eca14cfa10f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125559, "uuid": "edebe9c9-01f6-478d-bcd6-f09394776c81", "value": "c4f71f74c786458c6cf58fff7085fc7da56586d9a9d6a7c54944585e7af35de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec3cf42-1a57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632172229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172229, "uuid": "c6fed20e-ece4-43d6-b9ca-778f83a2a776", "comment": "Malware payload (RaccoonStealer)", "value": "53c12421ff1c34129c7fe4fc19abbd39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172229, "uuid": "f28d1e0f-efe3-4a3e-853c-bbaaa146447e", "comment": "Malware payload (RaccoonStealer)", "value": "c660d57bd98c4b7cecedeaa8405adba7ba4057e6f1ce62636a5d1003fea36e61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172229, "uuid": "b396906f-3a5c-4bcb-82a2-00501f688b5e", "comment": "Malware payload (RaccoonStealer)", "value": "9ed84377a3442b82d421c27b771ccc9035fe8607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632172229, "uuid": "2bd14d5d-6120-45b1-9481-83850a0754f9", "comment": "Malware payload (RaccoonStealer)", "value": "53b902dbe75eb33f97a1f6c1abc112f55dffa7029ec54c9ac6cac9caf2ad9a5bd8da8934802c29db9773ced5a5ec25a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172229, "uuid": "0a0312ae-5fb5-42c2-a228-1cfc8dc315ec", "value": "T151B4F120A6A0C038F4B712F9597A537CB83C7A715B7461CB62D626ED27382E8DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172229, "uuid": "080ce913-96b8-4cf9-9235-ce4bba99e644", "value": "8771048b1c01475c23bc95fc636ac433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172229, "uuid": "8ce3173f-b48b-4a2c-babe-a22742881fc3", "value": "12288:rsBGefhh8F6UNU7p+zTJLWElM4rPiGgejNX:wBGyHUAp+zIES5ZaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632172229, "uuid": "21b2024d-8a1d-495c-8434-27e70530a458", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632172229, "uuid": "f7fa523b-a2b5-42d0-82af-35ab4c5c08b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632172229, "uuid": "5f745439-7706-4ef0-a0b0-704662d9951a", "value": "9ed84377a3442b82d421c27b771ccc9035fe8607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d38988a-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632153006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153006, "uuid": "13cbfe9f-e68d-485b-9820-93ea0a18ce9e", "comment": "Malware payload", "value": "b11fe9948be40f74263563433988b44c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153006, "uuid": "d4702783-79aa-49e7-818f-30f76e8cd39d", "comment": "Malware payload", "value": "c6a20b89b1045bcc7f003dd47c4aaaf9fc382bee288a7ade6ff6371afaed2e0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153006, "uuid": "ea384d02-5408-4e9d-8509-5c4117536b0f", "comment": "Malware payload", "value": "6951b67b1bf1e02e9f750597b5814d7b94b49a27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153006, "uuid": "1c270b57-a284-4b43-a6c6-c9c41897d6f5", "comment": "Malware payload", "value": "dd213da7279c62a290cf8a4509cf2df6f79300b1e9968203f3a6913d9868e16e55ce61881aab85db848627cf6d98c173", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153006, "uuid": "e46176cc-c6fd-4c06-ac54-9dd42915b2b9", "value": "T1BB430210E315BFA9FA7790B4B02790D2336E0AD1F56F63C4D7390B3159E840721EE692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153006, "uuid": "2a7e0f29-a45c-43f7-9694-6308cf214667", "value": "1536:3in4/vjvlGhKHhbLf1WN8WyIQ9vZErRJVd:w4zloKBeNyIUvy9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153006, "uuid": "14de2789-1d2d-4b5a-a7c1-40e7bd3653d4", "value": 58704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153006, "uuid": "f0376676-f759-4b8a-86f4-da8cf6c60ed4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153006, "uuid": "b6dd55ca-1e71-424f-a5d3-ec215e57fae2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc114e8e-1a10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632142079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142079, "uuid": "c84ef127-4b45-43e1-b971-c6d7a76df20d", "comment": "Malware payload (AgentTesla)", "value": "7bbd97d7b4acd4b0a3cf3bb19883c348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142079, "uuid": "ab28f063-fe25-4609-9289-248aff9447f8", "comment": "Malware payload (AgentTesla)", "value": "c6aa70c0e4c9f52577db4ddfe71c74ec8c3e2ee73d58e603d6ad0afc26f33fd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142079, "uuid": "bb5cb0fc-bade-42e3-9beb-408a756cfbb9", "comment": "Malware payload (AgentTesla)", "value": "41825dc8fc0b1111c2c6519438208826427610fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142079, "uuid": "ef9bc54f-ac3b-42bd-ac8b-013d0572d002", "comment": "Malware payload (AgentTesla)", "value": "f12271e25f21beb1c3317a301ed32bb196c59cbb7d645d10665c04a981e8b5d40b221c4f9b187b67d622d8f182f7689a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142079, "uuid": "feb57fbf-2903-4624-8e6f-33c369411cb3", "value": "T1D505AEC13D47D8ABF4DF1AF3986FC42011656E9D9161C73D2682BA2B65F3312309BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142079, "uuid": "07666b6c-f7c2-45c1-83d6-203fe4e3a379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142079, "uuid": "675114f1-cfa4-456a-a9cb-8297f06cab59", "value": "12288:/5MTdfWBmsmtiK5oyZJ3+056iKCJtBzv1iHqB/KwVfofQ/Sqv9ftR50a5w4Uquu:24+FoGb2qtBz/BCwVfo4BBtXQLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142079, "uuid": "b99d7c0c-0330-494b-9f24-112cd2655619", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142079, "uuid": "22d9fe0a-ead8-4a0b-926e-6bcba5fc92ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142079, "uuid": "7978257d-178f-4078-9031-7214ca8460ca", "value": "winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4454340f-1a34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632157232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157232, "uuid": "4bd7a56a-895e-4293-8ba3-483f220813eb", "comment": "Malware payload (DanaBot)", "value": "c6bd3fce10e7e9a7350b83cf2926bb2d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157232, "uuid": "098dce88-85f3-46f4-9671-a76e1f3555a8", "comment": "Malware payload (DanaBot)", "value": "c70d30eabc072c72aa4c934ec92ea25b0e75c53a006b510e35ad1aefe0892912", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157232, "uuid": "53473e8a-60a4-4aa0-bc09-b513e2ade4a8", "comment": "Malware payload (DanaBot)", "value": "a7d5aaf8e3fadd28ba35a69b96100c77279f6218", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157232, "uuid": "b8aa12fe-4b62-4bed-b4ff-72fb936a3241", "comment": "Malware payload (DanaBot)", "value": "981cf35e1817ed614be46cb3b6f0a00b43d1b54559166127998ab1172d5edb06cd24b5f1853dbf33d5833522895c6107", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157232, "uuid": "9e7118c7-4b01-4349-941b-e57b1704f377", "value": "T117451224A6A1C035EDEB01FC59BAD36C6A397EB06B7044CB639626ED25346D3DC7034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157232, "uuid": "7c917747-d608-447c-822b-b54848c8dd86", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157232, "uuid": "dd73e7c3-9aa0-4adf-b6bd-d51005c37281", "value": "24576:W9TUrtxH0xUfuWmDgIWPb48nj6EkmGMm7g46x4lEgN:z0SuYLPs8j6EIMqg9xKHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632157232, "uuid": "cbd32ad7-1a46-48f7-988b-8ceffcb66637", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632157232, "uuid": "60866fc1-a92c-4d08-90e5-6300cf577f99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157232, "uuid": "d8ee9d86-8f28-4bc8-98a5-6610c6437246", "value": "SecuriteInfo.com.Variant.Fragtor.23360.18776.21974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f40944-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632160669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160669, "uuid": "db928499-ff1e-45ab-96a4-148efaa535d1", "comment": "Malware payload (ArkeiStealer)", "value": "1abeecf2dce719b13bdf709b1793d693", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160669, "uuid": "58aab609-f761-47c7-8ba1-76029212135c", "comment": "Malware payload (ArkeiStealer)", "value": "c7cb069579f314625b34b5fb6ccbba3d84871b5e928b0dab96c96d028a11faaa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160669, "uuid": "93d69ee9-9153-4235-a43f-b23556cf00ac", "comment": "Malware payload (ArkeiStealer)", "value": "c6a189f2d663e59f03dbe4987ccb14a53053ef21", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160669, "uuid": "8f9f25f3-8cc2-4b68-acdd-467a9240be52", "comment": "Malware payload (ArkeiStealer)", "value": "bcb347676d82adabdca267d268c48fb544244e3fab6032ff7d20d20f3f5ff6118663592a6b32ae798bd898031e8ec2e8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160669, "uuid": "3c742cde-7be5-47ec-8a36-53386ec5d408", "value": "T14965E121E292F437D1A3F638DD969B7F9B3CBE103914140B6EE82D685B39380B519367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160669, "uuid": "93ff7850-1a49-4b40-b994-5dabc8976207", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160669, "uuid": "c151652b-1c6f-4e89-adcf-74a35a011696", "value": "24576:HBuzcdGnDD28WHA4NKRi9yvbEx2Tw1zRHEH0OhgcoAs03kzGl/rHw9I1u1dA9mvo:H2DMHAl8gDExIE006gcRf3Vl/zw9I1uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160669, "uuid": "961b1898-15f4-47b6-90a3-d379017b8ffc", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160669, "uuid": "dba2459c-0877-42c9-a7a2-4d415788d1d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160669, "uuid": "ad1d2b19-75a8-489d-82c4-f89060315f7a", "value": "1abeecf2dce719b13bdf709b1793d693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448bf5fb-1a17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632144777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632144777, "uuid": "d0ea07c8-6ecc-4430-af9e-ba7d7fec7786", "comment": "Malware payload (GuLoader)", "value": "f7ea936730442a51e84537725cc66c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632144777, "uuid": "e6fb5add-b224-48ec-8b2b-4bc62dab2005", "comment": "Malware payload (GuLoader)", "value": "c991732087beaa671dad2bf477c9fd5993a6992dea5d5240e6bfd022a179e211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632144777, "uuid": "9c0ade2c-0a70-402b-aded-856eec0bf9b5", "comment": "Malware payload (GuLoader)", "value": "86608b2f6cd412f78222859fe680bcc5d628b25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632144777, "uuid": "8a894455-1475-4397-aefe-34313695ee89", "comment": "Malware payload (GuLoader)", "value": "c4d310dc0daf5550b624a0d162ec145f69fc26a02e27e21cd7f08aeaed439e7e5836301f27886906d0e3a5dbba2efd8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632144777, "uuid": "fb18288a-52c6-4dc7-870f-1112558c8578", "value": "T1F7A33941A6F4E465E4D6DABCC0AE47BC0021FC06DA67465F2E403D1EFE34D5A8A5E22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632144777, "uuid": "f976ac1b-5c12-4f3e-8ef1-2801a0f9b89b", "value": "46a3f7ddb0f0c8119624bc2c421c65ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632144777, "uuid": "e759415f-93c4-481f-9a35-9cddb61482b8", "value": "3072:DqlfZJ0vYdR0Dwx6TxLXMjKW1RDfVvxLF:DqxZJkYzywMTxLcjKCfVp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632144777, "uuid": "e36dcdcc-2e3f-4737-a9f2-f3d7790d6454", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632144777, "uuid": "11511e79-ffdc-490a-b190-48a1ea4b4b77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632144777, "uuid": "477ec0e8-4ae5-4e97-ae20-1250bb9276e0", "value": "METALES COSTA DEL SOL S.L. Offer 20211445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54255c39-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632160695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160695, "uuid": "920b22d9-692f-4e42-90ae-8b2f988b4304", "comment": "Malware payload (RaccoonStealer)", "value": "5444bd774e78aee994e50777886d9595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160695, "uuid": "045d318c-1617-49f0-b298-4a5543b9fc52", "comment": "Malware payload (RaccoonStealer)", "value": "c9d25421600d74720606bb7dcdf48c94885f69a0c0228344a3af8652fb74f00d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160695, "uuid": "7598cccc-c355-41b3-aa70-e2a1efa658be", "comment": "Malware payload (RaccoonStealer)", "value": "ca047b0f4c2df0e28f5d5a945d1236c25e2c50d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160695, "uuid": "91bdf180-d2c0-44b0-b23f-2339c7ac6cb1", "comment": "Malware payload (RaccoonStealer)", "value": "697f0fa7c812fd72960107e501dccaba745b600391678605ac991ea08bf8c9846941b4e35f61f6fa5946eef7d4f508d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160695, "uuid": "e5907947-8538-4578-90b3-b5f44a2a114c", "value": "T16AB4E020B690C035E5F711F859BA93B8A93E7D71AB2490CF63E137EA26346E49D30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160695, "uuid": "afc4fc7d-eb2f-4840-8a65-f2a29b0a4363", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160695, "uuid": "ccd6b177-9e88-46ff-b1f3-c2c1d9967e56", "value": "12288:ESAVPNY+rLPNG1RLT+VY5sTsFfihMjzhspNzF4hRe9L:EHPJrJYRX+VsszMjNspHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160695, "uuid": "eefc8179-b074-480b-9e35-43503f57d2f7", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160695, "uuid": "b3e12684-b36d-4fc6-934d-bb0d651d8a63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160695, "uuid": "d090b937-f62b-4c70-9da9-2de155934d25", "value": "5444bd774e78aee994e50777886d9595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a2bea4-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125586, "uuid": "a3e052d1-aeb3-4067-a3d5-c768528f3491", "comment": "Malware payload (Dridex)", "value": "27078cc7f5891f150a7a1c1d2c156e3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125586, "uuid": "bf9ff228-2db6-4138-b8c1-6e09019b9453", "comment": "Malware payload (Dridex)", "value": "ca46aa385cb6df881bc2f0d88a1bc868b55d49b98b8b58a0ddbe721f4ae0c122", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125586, "uuid": "7ef109b9-613c-4038-adb4-9c1ae8c3e99d", "comment": "Malware payload (Dridex)", "value": "0ab7d293ae472b23f94ac7d663a9860b3336d870", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125586, "uuid": "5bb8c06d-107d-44e1-887f-98e3ccb2eafa", "comment": "Malware payload (Dridex)", "value": "aa7276f824ce58ff7b71e8eeb3e2ca6552c2529c6c79c49049bb2d0fb90aad8c5273d3ddc31407c9c1bf75575349aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125586, "uuid": "21f4eabf-fb09-4eec-8a8e-c9d310ef4331", "value": "T12A95E010FE69EDE6C6B99F3E9408352317B93D74130DA18CC391604F5EF82546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125586, "uuid": "dbae4898-a1ce-41ed-b5f3-3639a2b81652", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125586, "uuid": "c8f09be8-9ef9-4ca0-81e1-32cf20f5a6b6", "value": "12288:BVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ11k:wfP7fWsK5z9A+WGAW+V5SB6Ct4bnbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125586, "uuid": "2c100a80-8f3b-4494-8c67-afc6a5302baa", "value": 1892352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125586, "uuid": "b1daca32-b159-4934-ac77-0b5ed103d64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125586, "uuid": "d37de37c-f63c-4de1-bbd6-128600c7fe6e", "value": "ca46aa385cb6df881bc2f0d88a1bc868b55d49b98b8b58a0ddbe721f4ae0c122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f24a1d9-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632118274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118274, "uuid": "4ac2c415-307c-45c2-a7c4-6b34d091eff1", "comment": "Malware payload (AgentTesla)", "value": "a7e12eb43406fb543046ebbd9b480517", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118274, "uuid": "72c271b4-2438-4678-8235-407d210ea442", "comment": "Malware payload (AgentTesla)", "value": "caee5cd41b3a916702d8cd65189cb32ece59f9846f8d55018b7e057907a871ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118274, "uuid": "392fe935-17d0-4d96-842d-d537d4f580bc", "comment": "Malware payload (AgentTesla)", "value": "3e5b8ca0e05c31129bc4711b919050105fe36b31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118274, "uuid": "5a5cf4d3-c3f8-43c8-9ea9-1724caffde7e", "comment": "Malware payload (AgentTesla)", "value": "1c0c8e7666f22f2a7ab5f97174f9ac42ccdb9eaed15835b093edf67ac9e259a1d6287938c41b803c0aaf2bc196bd2195", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118274, "uuid": "8e27efbf-7c78-4577-a41a-4f0ab4539989", "value": "T1AF94D006E2C854B3F4730632459EE9FA172B3E2D04445913F2E47E67B3BE74764A24DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118274, "uuid": "5a341c78-7f32-4e29-9d44-627c4dff8822", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118274, "uuid": "33dd911c-dce5-46a0-93dd-866c76f9eca9", "value": "6144:w8LxBHYwfwSdIQFeFsYKr77X9BJbFiDFKIO3eY9cBtZesrZH5kfdPyDItEnYPhoT:fYwz5n7FA4IOOY9gtZPrZWfByDdYeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118274, "uuid": "6ad66ef2-dab2-43c0-ab80-ea1503efa191", "value": 408350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118274, "uuid": "0613be03-bfab-4231-a9b5-3befdcef151b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118274, "uuid": "d2dd8818-703c-46ec-9554-11f5bee2935a", "value": "DHL Receipt_2045829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b6f744-1a22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632149645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149645, "uuid": "8ea7ca15-f7aa-4b09-9176-0f7f8f5c035b", "comment": "Malware payload (DanaBot)", "value": "4e1518963b4f17681b88992be8f017fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149645, "uuid": "716c66e8-da1e-4c78-b76e-39e3f71d6444", "comment": "Malware payload (DanaBot)", "value": "cb2244f51a480169293e39a16b104aa14e98543b17b76b3ab5a16640d48d29cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149645, "uuid": "05a0eb93-a4ce-46a1-be2f-b1815e80813b", "comment": "Malware payload (DanaBot)", "value": "82094d073371284be4ddbcef54b6d8b33b248fe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149645, "uuid": "5c714227-c4ae-4a0b-a28c-2c6b927b87f5", "comment": "Malware payload (DanaBot)", "value": "65c5dc37316edfb2ce483edce9c9d3defe003363f5a87450e36008106d86d44271c12c09b458d5bf10e3c69d4d5049d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149645, "uuid": "e90eb58e-1d3c-4c1f-a87a-ce38c243e013", "value": "T124451220B690F034E0F711F559769378693E7AB36F2441CB66D32BAA16347E49C32B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149645, "uuid": "c553eb85-7138-4a87-b977-a149a876ebac", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149645, "uuid": "a7779486-9fcc-45ee-ad65-42cdeada3381", "value": "24576:+2SgTr8Vl0vgJgAaja3THBFC8C5dk+Jjv7KGJik76TESnnP:4XWAa+3TFCPZDK897yHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149645, "uuid": "59f05b92-4de6-4972-9875-a84cf3284c2e", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149645, "uuid": "b1db2b90-e950-4588-807f-bc2d2fa67274", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149645, "uuid": "280f5646-0648-469a-b2b7-03575ed670ab", "value": "4e1518963b4f17681b88992be8f017fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1768f485-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131387, "uuid": "0b174f18-e585-47f5-84e8-924042956783", "comment": "Malware payload (RedLineStealer)", "value": "0ca28e497fc16849f8a1bc9f8f53a8ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131387, "uuid": "4f5c067d-4326-4d17-a8f6-8d32c8f81104", "comment": "Malware payload (RedLineStealer)", "value": "cb28fed6c60c5e3d6dfc93e5d48164348e75efacffd7d06b9a96c6996fdd9846", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131387, "uuid": "a0f4f006-40b3-474b-911c-c9a0e19e7218", "comment": "Malware payload (RedLineStealer)", "value": "0fbc3674b186eeaf699687ab79c9cf12bf433ecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131387, "uuid": "cef7ab19-a882-4865-a4cc-2559e77ab239", "comment": "Malware payload (RedLineStealer)", "value": "75c9a8642416f7a33a83a83de4853f00078e4abb389f1ac4b0162ca4f6c44d65528a57ca90fa7dbbf1879b09e39025db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131387, "uuid": "b31debb9-f3c9-48fa-952d-4d62eaded8de", "value": "T1B0B30726535961DFC3B2AEF5E011DE203F4E6CF7B92D978C6A09E03AC067105952EF89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131387, "uuid": "4316d63c-165d-472b-a670-723eb3f4e636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131387, "uuid": "4c61212f-5866-4f89-ad5a-95b770603613", "value": "1536:K02CMHgBnNNkuh3XphpGn3F6BXCWrZCIPQscplFQ6++HQzNO:K02CMH+zJhQW0L66KNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131387, "uuid": "ef2335e0-c6e3-4ca3-a2f9-8441520bf704", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131387, "uuid": "b65f68d1-27f1-48c0-b254-3b33d5277efe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131387, "uuid": "896a17fd-7cba-4f5c-aeea-6d067f371039", "value": "0ca28e497fc16849f8a1bc9f8f53a8ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b0f3e4-1a00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632135010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135010, "uuid": "77492781-4673-443b-86b4-be6555e6d924", "comment": "Malware payload (RaccoonStealer)", "value": "31ce4f326c616ad189f2b03bdee1e20d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135010, "uuid": "7d40251c-0f81-4a7d-a98a-a33159c489c2", "comment": "Malware payload (RaccoonStealer)", "value": "cb2aff101fb0bdb70d2a113910feee36d63fb65fd9bcee5016b2338d318df67e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135010, "uuid": "f4291217-b44e-4137-bfc0-963621979255", "comment": "Malware payload (RaccoonStealer)", "value": "0ead8e270caa1fbb1642e8e59753ffa1ef842c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632135010, "uuid": "6965db95-8b38-4553-9df6-a2b786c75a04", "comment": "Malware payload (RaccoonStealer)", "value": "a5c86372104a327119a212a45ccf41ca58cd930298e7873504cdb5d8f449524352406387c3dd669d46f99ce255c324f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135010, "uuid": "3dfff14f-98a6-4fd5-94d3-75605b759c86", "value": "T1B1A523646BF2131AF6B3CA7185F5432AEE66FC10EB71E35E0A8C134D5C54A908E19F78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135010, "uuid": "b4dceb1f-bf42-496b-a5d1-5603371013b6", "value": "4f0265512a1363fc11fe0c410b950baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135010, "uuid": "0b2ba572-2ebf-4e4f-bc02-9bd4ee7060e8", "value": "49152:zKP4T/U5f0IkgIedz0oZ34jhlOKCP5yhQmJNNAiXUn5TKPK6OvhMvC:84DUR53z4j7ODP5yDJ7Aikn5Tp6pvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632135010, "uuid": "ed4d65a7-1323-4e8d-8d01-af3ba87b03a9", "value": 2192296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632135010, "uuid": "2625b363-6617-4929-b8ad-e01d3a5b17d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632135010, "uuid": "6e098070-1c98-4346-a349-2f543e1fc8a3", "value": "31ce4f326c616ad189f2b03bdee1e20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2438aea1-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632125396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125396, "uuid": "193d76de-e23d-4d89-a972-3380a661137c", "comment": "Malware payload (njrat)", "value": "061aad12c2c7c31933d818c4e120908d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125396, "uuid": "2564024d-14fe-4c7e-90c4-c37c548025cc", "comment": "Malware payload (njrat)", "value": "cc193cf3d64208e86f40627fdecc7a32d4275924ae648740ffa3924ba1239d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125396, "uuid": "b005f34c-6336-4db9-86e9-15e511580aba", "comment": "Malware payload (njrat)", "value": "045ce53c1de8f148343f36c9cf1cf9e4859926d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125396, "uuid": "cd26e08a-d0cf-416b-ba65-8dd78a72ede2", "comment": "Malware payload (njrat)", "value": "7a79dc230b6736bb2c01ed05daf625e9d18d900b7aca4214302c31f7ff3989eae5549a838dba62254209f2ead7feab16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125396, "uuid": "48a4f284-9af3-4154-b186-62837ddc36ad", "value": "T1F5A5C60AFAB27A21CB1C0937D323997C4293614D2F02D1DAE69937852F5A7EDCEC7449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125396, "uuid": "a634016a-1d9b-44e1-9c96-4f379b149c4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125396, "uuid": "42203f41-fbea-420c-9195-91f679349dcb", "value": "24576:3XQf2g7AWR7Yg3NhM+YsdZn8p/A2SKYU90uV:3AD7AHg3DM+YsdZ8p/AbKYI0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125396, "uuid": "49b80dc1-372e-4ed7-846a-8a2a96e94b9e", "value": 2062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125396, "uuid": "85466dc2-d449-4d12-8da3-4ac1b0203181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125396, "uuid": "095e9859-c698-4e0a-a9a0-e19a8ea41b60", "value": "cc193cf3d64208e86f40627fdecc7a32d4275924ae648740ffa3924ba1239d7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69ce6b3-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125239, "uuid": "23076ef2-915d-4676-b547-c5b2c7d12f66", "comment": "Malware payload (Dridex)", "value": "043cf1d362eeed8899b8013f6a301f39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125239, "uuid": "3bc58e35-eb18-41a0-9f7e-369c47063ea1", "comment": "Malware payload (Dridex)", "value": "ccbe53828934848af19d80c91463753b6b9c42826ac2db929eb9551184d192af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125239, "uuid": "8dbf774c-d795-4689-b900-005893828604", "comment": "Malware payload (Dridex)", "value": "a1415b968384a33d5fc11ce4568b0045b3d766ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125239, "uuid": "dcf5a045-db5a-4a97-9310-0321a1850aa4", "comment": "Malware payload (Dridex)", "value": "f650d5b7206507a45fc5369ae7db2e8bce728d482d773ece2fa2e7cce0113bf9bb9e2f676073a70d82b76e0db21bbcf9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125239, "uuid": "90ca1c7d-c42c-4a44-b516-4bf5d2653c19", "value": "T161A5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125239, "uuid": "ce564551-a185-4aaa-90df-2aa37254da65", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125239, "uuid": "27bf8fad-7df6-496e-86e1-84a135c67162", "value": "12288:RVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:gfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125239, "uuid": "2a65594c-8a69-43e2-ad0d-e1feaaadb09a", "value": 2117632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125239, "uuid": "e1d7f731-0a04-43c8-9b3d-4215dcf4c376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125239, "uuid": "4cf60ff2-5b3d-4a05-9595-68d40f49f9c7", "value": "ccbe53828934848af19d80c91463753b6b9c42826ac2db929eb9551184d192af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4a23a3-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632118138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118138, "uuid": "dcc8a7fb-6aec-4e6f-ba9c-a533599ded0b", "comment": "Malware payload (STRRAT)", "value": "0c8757eaa721249568bf8c5ed4a05127", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118138, "uuid": "147894bd-66ed-4a45-807f-e6b5828a1787", "comment": "Malware payload (STRRAT)", "value": "cd30ef3bc4a9e96d8784843ae75d244778373285711459cd6bd2f8178dede194", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118138, "uuid": "8cd82030-a211-466f-a0ab-ba696213af0a", "comment": "Malware payload (STRRAT)", "value": "542fa35626178f91e38d0c9e6055edc234de0260", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118138, "uuid": "79546c08-3e12-4fa6-81e8-afaf58bbc181", "comment": "Malware payload (STRRAT)", "value": "2133debeb373771ffe1b2082249aa332a90fd85afbeeea80fce42f9d503848da865d9bb53fb3f9a4f613639e7976cced", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118138, "uuid": "debf6dba-f15e-46dc-af21-fd619791150f", "value": "T1D5147C3A0980EE14D7A99D1C339DD224D66C174AE8783D07B5EEAC8D9BB94483C3537B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118138, "uuid": "13f3688d-657a-4285-af44-9ec7fcac868c", "value": "3072:86VY1KXvJfV7fUQJXI8174MRZ6rFFeh3zFjvwLTnp87/zv1n79kz:EKXpVb7XC6ArFFKDhvwPczNBkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118138, "uuid": "7de44512-5782-42fa-ac0c-a62f07bc37ff", "value": 192464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118138, "uuid": "1c894c40-3322-4c19-a2b5-e3eef85c4c5c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118138, "uuid": "3b948ad8-d35a-4530-aa47-ec37cc7f660b", "value": "Required po ref 023 company details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ca600-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1632121267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121267, "uuid": "421bdc4f-2a93-4316-a13b-2662c5f9bb6f", "comment": "Malware payload (Socelars)", "value": "360bae03f5f7c79e4545e4593f832a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121267, "uuid": "3229549b-f63e-4566-aa74-34a3a6a7fd9c", "comment": "Malware payload (Socelars)", "value": "cdc14f336d01acf3008e46420dc28fe389ec66099e6f1cf47bd52de5482f31d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121267, "uuid": "3857938e-fda6-4b3c-9e57-54b57660373e", "comment": "Malware payload (Socelars)", "value": "98dd8313b0d894cff6cd5ae1f51c286b52c9ce67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121267, "uuid": "63636bc8-7ac9-4f18-a641-292208c8b4aa", "comment": "Malware payload (Socelars)", "value": "c6b6721c363b3402dbc2a66db000eae5660bd7d76f0099f224f432e6de73819a138fdabbf3536cd2ac6923e84e063d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121267, "uuid": "0bc4b802-1336-4a8a-9068-e71985dd1e9b", "value": "T185659F21F642D036F8E300B385FE477E9D68B625031894D7E3C41D699E61AE27A3B71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121267, "uuid": "53e8fa5d-dc50-438f-b4f8-5a1c1338cbb3", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121267, "uuid": "5797712b-eace-469b-b8da-8b1358282935", "value": "24576:HIVFA1pqtg/TnMbX0lwyh0FVmEBy/1kwFYyOscM5cPtSixJeQpYf2v:mFA1pvTMbOwa0TmzSMYElePtSiWQpYOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121267, "uuid": "2c0075e9-9b56-4d56-ae88-d37a80f5b5fa", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121267, "uuid": "690550ca-24e4-4a29-b1d6-faaff1f359f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121267, "uuid": "4154ebc0-a1b9-4132-8100-9c07d2665f8a", "value": "360bae03f5f7c79e4545e4593f832a09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f76239d-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632160714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160714, "uuid": "2b221278-000c-4d75-9df8-3a4bd986d5c1", "comment": "Malware payload (AgentTesla)", "value": "69a4737ab33facc809457a6bfa0aa2f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160714, "uuid": "667b98cc-7744-446f-bbc5-6f3d4584afa5", "comment": "Malware payload (AgentTesla)", "value": "cde036f2afa7aab3e775edf993ec455176f25bba3dd9440d0853945e425131a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160714, "uuid": "dd32e65c-fbc1-4bb9-8b44-0bd9162ec735", "comment": "Malware payload (AgentTesla)", "value": "2dcedfdbcf527eb6680b4c4bce6f791b2681cae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160714, "uuid": "942d063d-e292-4c0b-9781-59db55c6fd4f", "comment": "Malware payload (AgentTesla)", "value": "abe959621c0f26df60b661c1b9989f08e4ea273e4b5cf464e4eb4f30ac36aac941c03b4c217891d95e9f98be117673c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160714, "uuid": "9de334f0-494f-4254-b464-3177f9c2986f", "value": "T17FE4D130179570E5E3327AB08BB3E041F5996D32AF9D96D83843F64DC2B3642E973A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160714, "uuid": "1cde6490-680e-4f28-a2a6-3a0b8326df6b", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160714, "uuid": "2f51e5cc-2182-4233-bd0a-e6585515a5fc", "value": "12288:bYxaM8KuQlAvTkmsIJds1oigfXnqq/Sqd5:7jQINsIJdW+l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160714, "uuid": "c7e2254b-f24e-4ccd-82ba-26aac81432ab", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160714, "uuid": "511524a9-1370-4f21-b819-61fdbf29dfde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160714, "uuid": "02f1575d-1e4b-48d4-ac86-62e1927a4fdf", "value": "69a4737ab33facc809457a6bfa0aa2f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896f8c93-19c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632109245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632109245, "uuid": "6db4b4e9-c745-4359-a96c-995a6cb22126", "comment": "Malware payload (RaccoonStealer)", "value": "fa0c0371d55299af00823947702e8e14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632109245, "uuid": "54cd0950-a0cd-48ec-b643-5de33fef5411", "comment": "Malware payload (RaccoonStealer)", "value": "ce7fb6b222f840a7af7d162d6726316e882d57fc1a46f35a53b90e030b0b208b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632109245, "uuid": "a9ae118f-6952-4b79-8943-0ed05343428d", "comment": "Malware payload (RaccoonStealer)", "value": "5c1beee78662fc950bf03fe499650f659e9a5165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632109245, "uuid": "797efd8e-cecb-47e9-9146-ddf344a95d1b", "comment": "Malware payload (RaccoonStealer)", "value": "427b4b53b8269970c4d5b67b863027cb013c409d7ff9001f4741ecd020240c35364270d4e753898149293064a2a2fb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632109245, "uuid": "025bae09-ebba-4b44-b362-d05235aff6cb", "value": "T1CDB4E12067E0C039F4F316F85ABA4369A93D7EB16B7051CB52D623ED2634AE49C30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632109245, "uuid": "34eb85d3-9797-466c-90df-7b9eb6fa1428", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632109245, "uuid": "562b9d1d-5032-4a2b-8846-11c806a258f5", "value": "12288:kZDngVrLgn3YQHp4Eqi618wRdp9UXg3nt0ye0G7bp:kZngVy7Hp4EqYKbI1cM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632109245, "uuid": "ddeb30c2-8e24-45e4-abb2-f305a19cbcf5", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632109245, "uuid": "b599eff6-b23a-41d8-b124-ab7f3d208a6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632109245, "uuid": "a5fe4dac-7d61-4e1c-8ed1-88ef059eff10", "value": "ce7fb6b222f840a7af7d162d6726316e882d57fc1a46f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daae668-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632137599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137599, "uuid": "6333615a-0002-4468-b89f-d298f25e57dc", "comment": "Malware payload (AveMariaRAT)", "value": "72d6f88d59d0cf825a6937b3a083927d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137599, "uuid": "36ccc46b-9272-4d64-ac4c-98f4c2b1efaf", "comment": "Malware payload (AveMariaRAT)", "value": "ce8cccf1825b1e38e4aaf7eb64df69bec0f527da44221a2a801d41b5fb0812e5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137599, "uuid": "93cb62d5-a2aa-4b34-8679-8b02bf226c27", "comment": "Malware payload (AveMariaRAT)", "value": "2c0fcbbe67c279a44c60609b5823f91d88f57065", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137599, "uuid": "3f41d84e-cbcb-446e-b430-7e6ecbcaf1d5", "comment": "Malware payload (AveMariaRAT)", "value": "44e8cf7d2a330a9fe779fd0c4730727f16ac9b65b00cb03ce7d7977102699e43155ec11c1b7defeb9cb299785616ba87", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137599, "uuid": "d013f7b2-bc25-4d01-a2f2-293f7cc107c7", "value": "T1982538F11234CE19FDA6ABFCC0D590214B3B6D31D461854D7BB1AB8E2D73F82614BA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137599, "uuid": "24b43638-c7cb-4cbb-a010-1a781a38e86b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137599, "uuid": "12b2f5d8-5241-46d7-bae2-852589db264b", "value": "12288:zBGiY6H0FuEKbinAqncwrEfVodi4AmbAYmxG3mtiK5ojeoMtntGGzGtGGGlGtGGt:zA6UFuSa+uSdi4AUmQ+Foh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137599, "uuid": "20d1494f-5a27-4d0e-9eee-ef11cf494998", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137599, "uuid": "37153696-3af3-44c8-a170-4a634b5ded3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137599, "uuid": "406942aa-2788-48e6-814f-da27eb8d9f8a", "value": "21RM02749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac63b8b1-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125195, "uuid": "c8b9e9da-49a3-4d76-81e9-253ac272b637", "comment": "Malware payload (Dridex)", "value": "02a1e3314d79c38bc054ba38668ee4d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125195, "uuid": "9401335a-1670-4c6f-b652-9656197e7b75", "comment": "Malware payload (Dridex)", "value": "cf41fd18c4786fb4993a99596b71ec31122166d27f8b43ab3f5c79d51bbfb6fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125195, "uuid": "4e50f659-75f9-4ca5-8a6d-6b80709690ee", "comment": "Malware payload (Dridex)", "value": "18f3cfed705eacb613fc131e0e80505f382b2c24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125195, "uuid": "74d21d8d-ff72-483d-b28a-bf0493deae0f", "comment": "Malware payload (Dridex)", "value": "006a05c8044f682b915919eccece573895510ee8b6f311f4186b828ea7a7db2905d5cd12c62df566b8acdbd112625590", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125195, "uuid": "ae0c336d-d493-4bf1-b715-25348e42b701", "value": "T1C4A5E010EF69E1E6C6B89F3E9408352327F93D75110D608CD392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125195, "uuid": "44fa847d-a531-4eaf-bf8e-c99cd433e271", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125195, "uuid": "2dfc66dd-aa94-4d7d-bd5e-c65be96acde2", "value": "12288:3VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:+fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125195, "uuid": "17f6b900-a6cc-44c8-aa30-ddcdecb9427f", "value": 2150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125195, "uuid": "3f7b7dbe-7680-4d1d-b531-68433d28aa7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125195, "uuid": "97ce8820-5a6f-4b84-82dc-0157d1ac603d", "value": "cf41fd18c4786fb4993a99596b71ec31122166d27f8b43ab3f5c79d51bbfb6fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7a75e3-19fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632134241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134241, "uuid": "812e40ad-fd60-46fa-a9dd-e5e698c23d2e", "comment": "Malware payload (RedLineStealer)", "value": "e3cbb2e3f1de0e9161429b42fcb12e59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134241, "uuid": "ac22daec-737b-418d-9ff5-89df9c8e122e", "comment": "Malware payload (RedLineStealer)", "value": "cfa609ebc5780ab5ea678154e60e6e483076f82c74ec1129a3653b1c35173736", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134241, "uuid": "e798ebc3-d799-4523-a24e-83b0669f923c", "comment": "Malware payload (RedLineStealer)", "value": "102467123ad91d94b0d8001db1391d37e3899332", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134241, "uuid": "569559ce-ec7c-4a81-9019-2498b74e069e", "comment": "Malware payload (RedLineStealer)", "value": "611b1c172ef5efaee044f510b244ac4f40f3a2c1bf1de43086bd629c9534a0038988aafb062e7f8e0f4aacc169550bf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134241, "uuid": "2a44c39e-420e-4f9b-bcaa-6cf6cf030136", "value": "T12AF5C8F3F50707EBD000AD744482A213E36D226DFC45A6DBE5D8A9B76067A904FE4ADC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134241, "uuid": "220d4f2d-24d0-4d01-a8f1-3d6e11b10dbc", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134241, "uuid": "581a93ae-3c8c-41fc-9245-d81312595ac9", "value": "24576:9G/egb2aEdWL/1G4F46L5pGifQYD333BigOrj7oglW0vPuXZigYy0+8OloQI/0i1:9G/egb2sz1xNoY+sVso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134241, "uuid": "62b32b50-3c99-4352-a2ee-28d448edfa55", "value": 3324928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134241, "uuid": "9a9a80ce-1ccf-4882-b93f-d48188e7d496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134241, "uuid": "1a2301de-2bab-4b31-acc3-620811e11ead", "value": "e3cbb2e3f1de0e9161429b42fcb12e59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e154459-1a18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632145277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145277, "uuid": "221031ee-f913-4bcb-901f-7ef97d1f889d", "comment": "Malware payload (AveMariaRAT)", "value": "9f808fffcc7a5d5ab32bb8434dd8a21f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145277, "uuid": "7a8ff812-e91d-471f-ad2f-8056448c475b", "comment": "Malware payload (AveMariaRAT)", "value": "cfc82cb1e236a5a7d72c34f974bd0292c9b1ef6181f7f1a4e591aa3b17024158", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145277, "uuid": "417c0601-170d-40cc-a427-1fffbf1989e0", "comment": "Malware payload (AveMariaRAT)", "value": "b6b233c722e662e40528e2a5f0e767df170a19b0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145277, "uuid": "caa2706d-8c93-459d-9733-b9b4ce7b5d86", "comment": "Malware payload (AveMariaRAT)", "value": "07124dfbc035510ef8f8a61cfe8084d0eb3ded4325a6e44db76eef9c8d921a0df159cdf50c258c3499f55c6d8ad1b47c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145277, "uuid": "ad93130e-c38a-4cc0-a270-8df40ca76ac2", "value": "T1E434FDE4688F44B2E6498C5DA494B148AD74FEE334CA887153AFD435DF59BF2AEC4083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145277, "uuid": "5b46ff87-0fc9-48f2-86b4-8be58357366d", "value": "1536:ibG/LUEJUprQHuEZQU8mIBUuY4RENRPNe3oooiwdzFz76mAg5eeVhMDw5wfL7:iblDsvooTdzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145277, "uuid": "10403f33-ac68-4621-b3bb-8fe351966460", "value": 247308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145277, "uuid": "0b963e2b-eb97-4c9f-a75e-a1912049e19f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145277, "uuid": "a2c24fc7-8329-4efc-a488-cda00356a680", "value": "SKMBT_C36021092056670.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3877c30-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125234, "uuid": "2c88e5f3-1b4e-4c9f-b8d1-997025fcf60e", "comment": "Malware payload (Dridex)", "value": "10813d1727921c1752d93d64319b5a46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125234, "uuid": "69688e44-793c-4485-b3b4-80dd5d98769b", "comment": "Malware payload (Dridex)", "value": "cfd3ac9a2174ffa497a25362f04e1c1e7b83a2ff50e7ab0ab8f9e6e94a05a2c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125234, "uuid": "6f224fc6-751c-41a2-830b-7b5592d246a1", "comment": "Malware payload (Dridex)", "value": "bbf0c6cfdff1ad442cff8222d68e9b64c59cb61a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125234, "uuid": "9329c118-280c-4de4-a063-7d61f00b87b0", "comment": "Malware payload (Dridex)", "value": "0acf35eaac0f7f5093897e85223b878acd3fd5e2f0be7a9d6b039898b026046d34eb5b028d7381d4deecd094996e729b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125234, "uuid": "e2f39872-a3d0-4616-a329-ec4f0d5d6599", "value": "T155A5E010EF69E1E6C6B89F3E9408352317F93DB5110D608CD392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125234, "uuid": "7652c2f7-5186-4c04-97fc-49d935851d0c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125234, "uuid": "166400c9-cc98-4f8f-910d-dfd53e23460b", "value": "12288:5VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:4fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125234, "uuid": "795ee657-0c9b-4c5b-bf26-13781b46f1e2", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125234, "uuid": "79fc16ef-b6a5-4e00-8a4f-5a147e07f14a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125234, "uuid": "ec719312-2d0c-450e-bfb5-9d96373590d8", "value": "cfd3ac9a2174ffa497a25362f04e1c1e7b83a2ff50e7ab0ab8f9e6e94a05a2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61645351-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125498, "uuid": "421c0922-e29d-4ac0-8f77-ce421c32977a", "comment": "Malware payload (Dridex)", "value": "0e118aa28c9a3de69c8199a95c86e677", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125498, "uuid": "a27edcf6-04b9-4a5c-a630-27fdfcba7297", "comment": "Malware payload (Dridex)", "value": "cfeaa20f370f9f9e7b91fb18dea9ec6015d96ae5cf13a9de3df9711a00a3a5da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125498, "uuid": "e5231549-20eb-4461-a1ed-df3725ab717c", "comment": "Malware payload (Dridex)", "value": "ad3be2a31451be32fa258703440dc3eb52737ee3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125498, "uuid": "20facbf7-244d-4db6-971d-8b30cae1578d", "comment": "Malware payload (Dridex)", "value": "96493288eca389b13ff073a8a0cfa609d7c20f655ee7b95f129cdfc23b32fbaae4ee8159e034d4ae9cda201c341f8634", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125498, "uuid": "8cf12cff-0adb-4a4e-b1bc-8048146b81ef", "value": "T15795E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125498, "uuid": "1e235e6c-3f2b-4df2-8640-69a6868f4efe", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125498, "uuid": "156022e4-f8f0-4627-9f44-ffaa66de2392", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125498, "uuid": "a44836fe-90c1-46e1-860a-388ae65725c3", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125498, "uuid": "9e31574b-32cc-4a2b-ad08-23a14f5c7e05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125498, "uuid": "2a6eb3a6-41f8-4ba2-85be-2116e85fc718", "value": "cfeaa20f370f9f9e7b91fb18dea9ec6015d96ae5cf13a9de3df9711a00a3a5da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9e858b-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143580, "uuid": "5064a40b-5c50-4090-bd53-57d13b2aea36", "comment": "Malware payload", "value": "b3c667edf686da78a8a3125abefffe99", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143580, "uuid": "98af43a8-214c-415f-8782-cf30a7debd20", "comment": "Malware payload", "value": "d02213bf13dd990973017071e7a4a2078d577c5f4937d499fba94b0efdc1affa", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143580, "uuid": "b73ee717-781f-465d-a108-543a61c65ad5", "comment": "Malware payload", "value": "6e76d41e40e644cf30df8717bf8e3254d7b71365", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143580, "uuid": "99c4f1b9-593b-43d9-8178-8690264c1e4c", "comment": "Malware payload", "value": "0bb8be5a6f7fc4e60d482c0bb08c64a6f4908b041487743c7dc1f7b40edd55f9b0c79f8917b69df12965def806758191", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143580, "uuid": "d5b40402-d2aa-4ad6-b610-2c3c08a0de4c", "value": "T1B821CE6BF419484FF011F1BE449503386334F0B58535E5A06FE95C0E86F81938C9A3E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143580, "uuid": "3ed8befd-1dfc-42bd-83f1-ad40e5bf32b7", "value": "24:QYK5Sx48U6L4k1y1H9Wukek14nT4Nvvz5DuuqkIKaHx9aM2lQp0G/S7P:aKZH1i9k74TUvvz5DpKHx9WD2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143580, "uuid": "357e8b07-de63-4e87-ae9f-5f15e04ae119", "value": 1432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143580, "uuid": "d03eb3c0-7817-42a3-a2cf-ce28a8917d66", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143580, "uuid": "e999688f-c549-4917-b717-d92794b279d3", "value": "dfghrth.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213becf3-1a56-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632171776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171776, "uuid": "ecb4697a-0f17-4d34-a719-d7dc1c2d0e11", "comment": "Malware payload", "value": "a97a18cefedbeb3f035f6620ac32c0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171776, "uuid": "180a1e8b-41c1-4d41-93bf-ea742f76f613", "comment": "Malware payload", "value": "d050da2567659d18bb0de8eead05661d19ef46e3442b997b087ea4fb1ea92bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171776, "uuid": "84f61855-be44-4ee7-9cd8-0db6a9bfafb4", "comment": "Malware payload", "value": "3ba9bdc06e1fe00a277d2030ff0fdc6c447f9eff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632171776, "uuid": "d7f4c67e-00a9-4e01-93cd-c89a94efd63c", "comment": "Malware payload", "value": "38a3104a4d7cbb7b9f64bb80154e87472410f8e473b661ce444c16050ead9675a671ec33c5a9ea65e2d94fbec6036cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171776, "uuid": "0f71a723-57ef-457c-ae48-a5450c84c30b", "value": "T184F4DFE1BD17D827F5ED1F3785AA841413EEAF71A5A1C739288932671A3239E340347B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171776, "uuid": "79b123e0-ecd6-431a-9b00-f3a90c323804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171776, "uuid": "c03abd8e-46e2-41c2-b632-d51ef0f4262e", "value": "12288:bmlprSmtiK5o6jljg/H9KrcGmeY22xh21tOOAg49vOp89K:q6+FoSjg/dKrc5mL49K89K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632171776, "uuid": "7a914b60-cf76-4835-a5d7-9c8c168ce92a", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632171776, "uuid": "5edb5b1f-f5e3-4892-893b-ed25db5ecf18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632171776, "uuid": "6bc7f87f-f8a4-4d75-8cfc-2ff6b432b0ae", "value": "2021_9_20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee53ef54-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632121869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121869, "uuid": "447ca97c-a37a-44d2-b339-25d624f884bb", "comment": "Malware payload (AgentTesla)", "value": "409b46ac4b96aafaaf65ca27ed3a8610", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121869, "uuid": "3410d32b-be2d-4a56-bef3-17e2530c3205", "comment": "Malware payload (AgentTesla)", "value": "d0e52d49dac173d7e660fe4c404de85fdc3098cf323d3969959a4faf71b9b7e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121869, "uuid": "f34fe678-cdcf-4af7-82bb-a96807dfd104", "comment": "Malware payload (AgentTesla)", "value": "ddf275b3165ede629a280a28e935de52f60efd31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121869, "uuid": "ccc48fbf-d341-4e34-b45e-bcbda50ffd66", "comment": "Malware payload (AgentTesla)", "value": "ec8914c743e83a892e9eb31ef91e61114a59861c18b37c0dc2e583233db89bd1f41166fd9c44b882ff47348c5b2c1a08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121869, "uuid": "df9de451-58d3-45d3-aa03-1de27667626e", "value": "T11A15D0202254C26AE1FBF77CD4229071CB7EF986A066DA5E5DC3C5DA0E26341C51BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121869, "uuid": "bc1b76b0-ac1d-440b-9eeb-40ca3ed61e50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121869, "uuid": "2f01bb2a-a192-40db-9214-94c8f8fc89af", "value": "12288:0BGiY6HeFuHAtGs6MGUrdambjGpjIO7GNOCoq+xlR+aQ7MS2OCCtmtiK5orWq2U6:0A6+Fu6ztz4KNOC+7waeMQ+FoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121869, "uuid": "e60d3d08-291e-4112-a6c0-1b6969e8adbb", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121869, "uuid": "dea531ab-03b4-4539-84fc-f826bf6f0e05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121869, "uuid": "0f544bb0-ef73-4deb-8a3c-20d5319d84e2", "value": "Demand List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15986dc7-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632115922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115922, "uuid": "b228a020-0934-4aca-b33f-1202b3118c3d", "comment": "Malware payload (SnakeKeylogger)", "value": "6a1281b5e15b897bd20681340cfe3793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115922, "uuid": "446ef264-1b8e-4894-b618-79d4a13b5772", "comment": "Malware payload (SnakeKeylogger)", "value": "d0fef103952fc6153a48b9d529d96d2f76cf989855877a16cc5aae393e1e3e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115922, "uuid": "ecabaaac-8d0c-4777-8823-b819a84cf286", "comment": "Malware payload (SnakeKeylogger)", "value": "a243e634b14c5a3f9815f14a65bd22eb47f9325c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115922, "uuid": "6212d4e7-9392-4eb0-8e61-b30ef66be725", "comment": "Malware payload (SnakeKeylogger)", "value": "0da4f43d626191ce60f50089f01532ac67a37b05951a41c3bcc0e8dc4cbeeaf1c7f14f64e5946e6bc23e4d12fc87d86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115922, "uuid": "9451f170-3ff8-4d60-b8b9-7ed404ef195f", "value": "T123C41223B7C984B1E0675A3001B4AAE1426BFD325A6F9DD33398024E1A347D45FB9F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115922, "uuid": "20a56acd-8116-431a-9492-9e86fc5d4227", "value": "c2e2fa89aec204ac5f3945ce98025d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115922, "uuid": "c3b165dc-d90c-48e0-82a9-00aa6991fa2f", "value": "12288:5Gam+ehJE5SxwQjyEkWvBIETXH7aJMODeOLv5MpE:FmJE51QjVpiIXHKe0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115922, "uuid": "36858afe-bbb4-4604-b459-00473d9f62de", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115922, "uuid": "7c305852-8cfe-432a-82b8-321784191260", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115922, "uuid": "6a2ceec1-b632-408e-9379-94f4d256a899", "value": "6a1281b5e15b897bd20681340cfe3793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268758b9-1a23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632149881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149881, "uuid": "cba8ea87-3c74-4f4d-be36-36bbc59501ac", "comment": "Malware payload (Mirai)", "value": "27109c628c0ccd7c2d6223be9f61b6f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149881, "uuid": "18b70944-81ba-4859-a37c-6f6fa189aea3", "comment": "Malware payload (Mirai)", "value": "d12b273b1bb25b48de7bebab6d5bbedc3799f7cad0aa36a3f2c02215a5a1aec0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149881, "uuid": "38388ca0-2887-4499-bae0-a55ff8e40d08", "comment": "Malware payload (Mirai)", "value": "df28612f6c12d99ed7eaa3645845934b718ae560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149881, "uuid": "a6070c41-3311-4fed-a87b-ffa1349ead31", "comment": "Malware payload (Mirai)", "value": "48458003b2acb2d78941de558d41928414236b7427e50421d76b4836abdb5909515f390b72e1e01ff89fb6f6482293b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149881, "uuid": "7a4c91f2-4bb8-4c34-85a2-9ebae1fcd636", "value": "T185C27C82EB82C4B6FD930477593B6726D730E46A0025DB06E32CAA35ED67518D73B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149881, "uuid": "a7c8f006-b5a5-4229-ba0d-ed4f1a5bb4a7", "value": "768:udtE6hmi5EN4WaT4hm8bQGQd50qyOHnsawAYLQ2cIFJ:VOmiyKWvmEQBP0TOHnYLQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149881, "uuid": "2aee4ce6-b472-4753-8417-a5a1811b102b", "value": 26708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149881, "uuid": "c9283d24-6551-45a1-abf2-48f87b26848d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149881, "uuid": "59c19730-bdef-42fc-ab9b-5183ac0961a1", "value": "27109c628c0ccd7c2d6223be9f61b6f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa794c43-19da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632118749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118749, "uuid": "6904b7e1-8434-4c10-9ca7-bfd61c3355be", "comment": "Malware payload (Formbook)", "value": "c611faa69a1070e52f53defe4d67e8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118749, "uuid": "4e9d52e3-75b6-418a-9ce1-7b27af35505e", "comment": "Malware payload (Formbook)", "value": "d21cbbc50e85c872732a119f1c0d567a54cd6a75c512c3bf84baba8a8fbfc97d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118749, "uuid": "5a5b525c-8a77-4533-a76a-7282ae8b6e4d", "comment": "Malware payload (Formbook)", "value": "21fcf75a374ea7764100b46505085246746a7616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118749, "uuid": "b48c2c47-9215-496e-936e-17db14b3c7f3", "comment": "Malware payload (Formbook)", "value": "97a1f007f235ac0e165999f4922143bfde083f5ebab03cd6eecbe0e8587c989c481fe2a555c98e3750b40b2bb1598883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118749, "uuid": "024f8792-deb8-4303-a08b-c9ebf7c545f8", "value": "T18CE46CAA72918837C1FA17769C5E6598FC0279093C09BC4BE9EC7C7C6970E516D2A0F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118749, "uuid": "6be3a96e-2c49-4101-a4bd-835ed7521e0c", "value": "84d5173d5d26cfc4667a04380d7e0b47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118749, "uuid": "73dc6fa5-11f8-4c42-8085-7751a0151bc9", "value": "12288:TSwAOcXhqsThT3P5HxB48dDyfP26emkWgDeC:TSJfLThT/VpyX26eIgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118749, "uuid": "ad6c8852-fbc8-48b6-a40c-05173e8f210f", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118749, "uuid": "477c41ba-264a-4aec-a88b-812032c96174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118749, "uuid": "b3d58123-79e5-490a-9967-da3eb524b8f3", "value": "Noua comanda atasata.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72f2739-1a46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632165263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165263, "uuid": "53ccb2c1-f24d-4583-9919-a491ace36c80", "comment": "Malware payload (AsyncRAT)", "value": "1a9e0e7fbb9f1fcace60656468db0826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165263, "uuid": "4c99d32f-ce78-4ee7-8168-9336d613c6c9", "comment": "Malware payload (AsyncRAT)", "value": "d29579a6a0f18f97a81fe6f0e5d3d3c169898563433d79c62fde8059fab8d85b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165263, "uuid": "6fbdd555-6fa1-482c-b67c-5cdfbed04a45", "comment": "Malware payload (AsyncRAT)", "value": "a9b9d95832923043762a188da271de24dd9e0a22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632165263, "uuid": "49cbdd1b-1a42-47d6-ac62-e1017ec25a5f", "comment": "Malware payload (AsyncRAT)", "value": "bd6c4fc44054020d0b987245d187d5d7d4b2ad88d394843f4d13840c8291a3d015f6bc4b64bfd8dcef4298cd5aa7436c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165263, "uuid": "569edb87-a269-4858-a332-9606af0052ef", "value": "T136344B622538AF75FA39A77CC4D1452443F9E202F312DAA67DF944CA44A1ECC1393E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165263, "uuid": "659c5b31-81be-497e-b264-a644f228fcb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165263, "uuid": "46cd1761-1f6f-4807-b314-6f198a9bfc4f", "value": "6144:qjLQZbQaeWg/cw5btJieaB7jiR7YXJ9lNNg7F:qSOc+hQih0J9lNNg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632165263, "uuid": "6ee00386-2bcc-4872-91c9-d855fdc72c8b", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632165263, "uuid": "27b6089e-259d-4e1e-8bfb-6a4be51e4794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632165263, "uuid": "b3427aea-a8ed-465f-805e-0e807413e1ad", "value": "1a9e0e7fbb9f1fcace60656468db0826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d8454f-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632160803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160803, "uuid": "a8f78287-7ebe-47e4-aa16-ed5047c53c74", "comment": "Malware payload (Formbook)", "value": "baffd35ab2f86aa9a397a286ac5df964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160803, "uuid": "0dad00b3-a09e-4eef-ae99-3694f39a22cd", "comment": "Malware payload (Formbook)", "value": "d2d6a8c31acdd92eb9a005e2fac8838a382ab0425fc01bc88616bda185ab7b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160803, "uuid": "fee3828a-345a-430b-8a52-e0bacce2100b", "comment": "Malware payload (Formbook)", "value": "090d1a4a2fa053e92d5cc0c8df6491600769ff03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160803, "uuid": "d4b3a188-e40f-4e88-bc45-2ba16578fb20", "comment": "Malware payload (Formbook)", "value": "52ff09698de29976eb9b354af74a2a0b51bce507951b75341a69472f2906991a3d0b7c5218a33eb88f6bf03eea815a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160803, "uuid": "12c116a3-5e97-49cb-9fb1-073fcebbb203", "value": "T107059DC17D47D8ABF4DF2AF3586FC52011656E8D9161C73D2682BA2B55F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160803, "uuid": "63537156-c573-4a94-9f9b-eeac912f96dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160803, "uuid": "185a56a9-99ff-4231-b78e-f689e88f49e9", "value": "12288:p5MTdoH9qKsmtiK5oyZ744S/An3IfFkfzNJAxMPWXDyqvt:vcB+FoP4W0sFWNKiPVCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160803, "uuid": "8bf53b84-da71-42e5-be64-3b224de2aa69", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160803, "uuid": "f3263146-b464-4197-b389-579c979a68f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160803, "uuid": "a6f16677-bde3-42be-bb93-48801932a1bc", "value": "baffd35ab2f86aa9a397a286ac5df964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55225b2a-19ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632134497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134497, "uuid": "c2d33c21-0822-46b3-a945-01d5ff56a2d3", "comment": "Malware payload", "value": "cb9a037aaff7548550a2923c73d6b612", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134497, "uuid": "b57e82cf-a26d-4279-b6e5-a0961af5859a", "comment": "Malware payload", "value": "d2dfee39028d2344853119ef7834b34f6138c822adf1ab05d5adc1634f141528", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134497, "uuid": "0082b821-32d9-42a3-8526-d311310800a7", "comment": "Malware payload", "value": "4ed34ac6e7758a883453ccd89e82a513eb33ef4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134497, "uuid": "68ba2dce-45fb-4da7-acf1-041176006fc3", "comment": "Malware payload", "value": "d71be0aefe76bd83414d5006a86f1934317720fcac9d6165fee28fe4f6e489fe99c283121db64975213cdb3368cf58cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134497, "uuid": "c6efe030-fa11-4531-babe-5cad1f4cf5ad", "value": "T12A349D20BBE0C036F1F712F849BA9368A83E7AB15B3451CB52D616EE66346E4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134497, "uuid": "7febca6b-93a4-43b7-a632-6cce34a51673", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134497, "uuid": "df8a6294-fb04-4696-8dc2-13436aa64995", "value": "6144:2oZQcg6TmNY9huW5qF4vSuAGtUL/Dgm6oWo9FcD8:xZ1TmNY9hz/vSuh4z6Jie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134497, "uuid": "8172ae35-e3c5-4e69-8338-211c0787a886", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134497, "uuid": "270f4cbe-a662-4d02-aaea-70efff894dd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134497, "uuid": "fb9afa21-a79c-4106-a41e-8891ab01ee07", "value": "cb9a037aaff7548550a2923c73d6b612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ef6cf5-1a08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632138226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138226, "uuid": "244e7c65-07be-4547-8f0b-4f204f8a54de", "comment": "Malware payload (Dridex)", "value": "a8fee149ef35b4ef6f905b8966802a66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138226, "uuid": "fe042566-50c1-4803-baa3-bd71ba23d4b4", "comment": "Malware payload (Dridex)", "value": "d3272e0e7a5ea32d4276901bcf10767f4293dd067d70393b305966e17f9e4ac9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138226, "uuid": "03f569c6-b893-4f19-bbab-b2b51b61af6b", "comment": "Malware payload (Dridex)", "value": "16dfd72d0acf534a0c402d4a6fd4a0c68117fc5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138226, "uuid": "6f96060d-b502-41aa-8836-97292bfcf952", "comment": "Malware payload (Dridex)", "value": "b64d051a74cb8d7f10f1e24419cc59f39e29e77ec5095ef6d086055b31ef966145a43ac01b1af608efbf84ec7c7983a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138226, "uuid": "15899ee7-585e-4b9f-b524-1f31134bf2f1", "value": "T15815F00776FC9E66D2AE07351837AB718A72BC222A34E20F57D17E4E3D717E24912721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138226, "uuid": "63697593-59af-43a5-bb1f-b054e0ae7cee", "value": "e19687a825dd60507df2609a0c86c4ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138226, "uuid": "d0fe9bc4-2ac5-46c5-9df4-a361dfbb2404", "value": "6144:FK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTSm64sl3ReS3KyMBC0+eekTdFyDPL:FM+ZdkmHubeaCo6JVlheSfkvODPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138226, "uuid": "47e4b5e6-b0ca-43fd-aeee-2502a984cf09", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138226, "uuid": "45475701-4aa8-4aa5-8501-374b9e8862d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138226, "uuid": "ceaf23cc-884f-4f03-95ef-2e6fbed10a8d", "value": "a8fee149ef35b4ef6f905b8966802a66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f9782f-1a2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632153024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153024, "uuid": "6a61fd14-50f5-4a91-87ea-33a844446135", "comment": "Malware payload (DanaBot)", "value": "30c2951bf0c6cb62902fbde7a06782ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153024, "uuid": "f2d97296-56c5-4a06-a83f-64381a0b8577", "comment": "Malware payload (DanaBot)", "value": "d37a741c4abb937ef11a2b0536a641db1b50859be5310eb8781bf18bbdd9b9bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153024, "uuid": "192996c0-3f8b-4edf-b9e8-67199aa2e340", "comment": "Malware payload (DanaBot)", "value": "efea0c2954ade138f3a41e3923bb28b7c55baed3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153024, "uuid": "4b54b533-d71d-41ad-a0a2-7fef347412dc", "comment": "Malware payload (DanaBot)", "value": "04d1868e818a74c49d80f469c4e627c27f0ac7db9519b74bcb60eea729322f3a4a4c784f9ae1ea0dd1dc4a286a0046c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153024, "uuid": "df4d91d5-3385-4121-bf2b-5687424f6615", "value": "T17B451230A6A1C039E0B745F8947AD3A898397E709B3590CB63DA67FE26347D49D31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153024, "uuid": "e7e76324-cd90-47c4-86e3-58b4b0022530", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153024, "uuid": "41a12dac-2c1a-407c-82c8-b050a6a7065d", "value": "24576:p6SOrCTFxVrf+gGCAV+/CjrqhYt3anTC3kDjQ5ZyorcHIqtSMWRXUvyv7UzYb6N:RBbbGCAV4m53kD0YIqtCRwM7YYb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153024, "uuid": "664231c7-83a3-45fe-ae58-f4b3ed89fdac", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153024, "uuid": "b21583c0-19b5-4fc2-abbf-c9256a414468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153024, "uuid": "e272bf55-bcd2-4755-b05a-9934f03f3347", "value": "30c2951bf0c6cb62902fbde7a06782ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fde5f4f-19f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632131831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131831, "uuid": "d6a35f93-0c52-4723-852b-f56df174d507", "comment": "Malware payload (Formbook)", "value": "8306a90a10e3fc42341768b333d3a957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131831, "uuid": "60397f67-536f-43fa-afef-54376d055b37", "comment": "Malware payload (Formbook)", "value": "d39ec2fb7fa07bb6886173571262d2324d96b6e879ccc4f2cea46ece183e576a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131831, "uuid": "2d1f9ff0-4f7b-4180-85a1-b3dc56efa7aa", "comment": "Malware payload (Formbook)", "value": "05bb69bb01e6aeb6b92bf09ad6ce194b4f2e748c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131831, "uuid": "919bebfe-ae57-4189-a617-f2d0bc454012", "comment": "Malware payload (Formbook)", "value": "b000cf7a2708dc942ee4e04dec00c5656fdf0452e04ccb13a179d05b9929bf4fec9e73b48e43f4ab89981218b33d1190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131831, "uuid": "63da218a-7711-404b-b8ac-c2e5557d2d59", "value": "T14C05ADC17D47D89BF4DF2AB3986FC12011656E9D9161C73D2682BA2B59F3302309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131831, "uuid": "a4443654-f752-47ba-935f-0300a7b4f161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131831, "uuid": "416287b3-c61e-4950-9c98-5e17fcfc5757", "value": "12288:65MTdFUoSsmtiK5oyZ3+cGwkUp/0fciw99blihfJGJVR53squN:F1+FovcKLgbl2G1aLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131831, "uuid": "aa5c8c0f-0a8e-4478-9e1b-643568ee33a3", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131831, "uuid": "656c47ca-d2c5-4028-b72b-ab08ebf95aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131831, "uuid": "b3b0aa92-3e88-4e77-be2d-054ae5d2d93b", "value": "KOC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d7264e-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632118104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118104, "uuid": "96f0cde7-3377-429b-be75-48226f038e46", "comment": "Malware payload (Loki)", "value": "321c50eaacd30f75a6f8ea9ba14e9897", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118104, "uuid": "a548b20b-acf1-42b4-bc32-735653953b04", "comment": "Malware payload (Loki)", "value": "d3a068fbdf61ebd0daa149e42c9463467cb7ec16abacd14b90264b0b7bd724e8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118104, "uuid": "dcc62416-96ae-41a3-8864-34de20d2bbe3", "comment": "Malware payload (Loki)", "value": "b79e77b77e09030a2d600fb6c55638020f7c8f28", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118104, "uuid": "0f3b11cd-ef67-4b0a-ad01-022125022bfb", "comment": "Malware payload (Loki)", "value": "b499c974d9c99134d6dddf31d66e052c12799214bb5f4b07a562411d5f6c7a2f3c354db56fa43f853aac4408a5f3bbbe", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118104, "uuid": "e03807a0-ebf1-410c-9457-ec1eee8e11fd", "value": "T13BD4F1AC2065A707D2E3A5BE1C04484D5E6EBD08E6F454FF91E772270338D98B736BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118104, "uuid": "a4037961-c885-4e74-89c8-7ad065694481", "value": "12288:MKQ4rhp3zyulfU/uVDrxh5QiweT1LMdGhsU3OJ/6KXUJB:O4PWu5AuR1h5DUG3Op6fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118104, "uuid": "3883ec18-a200-4ace-a1b8-2403090f0d27", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118104, "uuid": "6e7b1283-8cb7-451a-b9fc-b1c4476fc569", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118104, "uuid": "6cbfae01-150f-4792-a694-69b59bc270a2", "value": "RFQ_final version.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c7b55d-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632160568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160568, "uuid": "3eecc952-bfb2-4545-8099-f2f7511b3270", "comment": "Malware payload", "value": "7f9e1b22e5e1b2d5025984aa27fd054b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160568, "uuid": "8a2802d7-0251-4672-bb51-7f2014b25c5e", "comment": "Malware payload", "value": "d3a7697ff1d17f66a8f03363371339e39cc32068589085b4b67b377f52786aac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160568, "uuid": "cc80d40c-083a-4430-a1c7-aeeeaf830a85", "comment": "Malware payload", "value": "e8e93803e0809de38f830532eeae4ce74308e25d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160568, "uuid": "df27e7c1-2fff-49dd-b195-93eb1d8e3966", "comment": "Malware payload", "value": "2e6dbe3c5daa0912a884503c3ff38639006fd5c59db8c5b77f5f0da05dba578d32551e7789b36f7335153ea1a6142e44", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160568, "uuid": "5be72857-693a-405f-8cd4-a4000a8415cd", "value": "T183244B1076E5FE51ECC2A5330B05CDFD92387EC05E1253B7BAAC736D2BBA910666016B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160568, "uuid": "a8d75c12-3286-4d42-9e00-1abd7c4a0213", "value": "3072:q1Ew9u9qLF0EYouFCoOVaDV9D+1z1xNHW/myKLEt9u9qLl0EYouFCoOVaTz:q1EJoEourbiWuywEmokourz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160568, "uuid": "74da8f5a-c183-4bcc-8d44-3624f0d996b8", "value": 228873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160568, "uuid": "d4da891c-539f-4212-93dd-e1b542546727", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160568, "uuid": "7fd1961d-31d9-410e-ab35-e2f9ad28f438", "value": "7f9e1b22e5e1b2d5025984aa27fd054b.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55df17f-19ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632126525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126525, "uuid": "bbf5144a-e818-4d27-aec8-7d15c3db5806", "comment": "Malware payload (CobaltStrike)", "value": "62b3f2c6e198d43403ca9ef0b63565f1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5efa\u7701\u4e94\u661f\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#4CCD0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126525, "uuid": "178682a1-9367-4beb-81a8-3ab1d2219188", "comment": "Malware payload (CobaltStrike)", "value": "d4b64e363b4b26f82ca61f3890329c9f0978820f4107eb3d95309bc9adbfd280", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5efa\u7701\u4e94\u661f\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#4CCD0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126525, "uuid": "21e3555a-7094-46f9-9e21-f0c83a85d675", "comment": "Malware payload (CobaltStrike)", "value": "fc8105698955688c59697fa2fc5ec35fefcc15e2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5efa\u7701\u4e94\u661f\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#4CCD0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126525, "uuid": "d2b502bb-0814-471a-9538-7f8c8082df19", "comment": "Malware payload (CobaltStrike)", "value": "46f1b6dea7f66a1ceadcd79686c527234a443a2f339f196c16c61fab31de07f06dc342cc9e9a498ceffa235995417f69", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5efa\u7701\u4e94\u661f\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#4CCD0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126525, "uuid": "3b4e599a-56d5-4b90-be9e-fabdd6a98c61", "value": "T1FCC57E8DCEA6ACF0C9DF6871195C4ED0C1E22D5B08868F73CFAC2A999DD21F91ED8115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126525, "uuid": "9ec48d11-dfdf-40fb-bf56-f45370703706", "value": "c07fddd21d123ea9b3a08eef44aaac45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126525, "uuid": "54536857-b6b0-4bf9-b9f3-4ce2f509f739", "value": "24576:R+HZ4FzfgUw2AflWNRpuKjJ4Td3kJnbsPhnzqgqnOwyq3W8K:R+5UvJ4Td3mbsPhneLu8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632126525, "uuid": "f88561a9-deff-4cf9-962c-6dcdc3deea27", "value": 2568344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632126525, "uuid": "8ae1b93d-ec4a-459c-8895-212170e48c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126525, "uuid": "f9fb4178-d457-43f2-8aeb-316949648b93", "value": "d4b64e363b4b26f82ca61f3890329c9f0978820f4107eb3d95309bc9adbfd280.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbec23f-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125462, "uuid": "01b1d268-5fec-47f8-abaf-ec7a691ebf0c", "comment": "Malware payload (Dridex)", "value": "255333e1d623f04c22bb48f86635466c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125462, "uuid": "40178e70-ec86-4e6f-9ec7-9f14a544158b", "comment": "Malware payload (Dridex)", "value": "d4f939ffe4632e7cb232b865d6bdbaff471db049c6675cc7db659905eb7f6b9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125462, "uuid": "84633656-f201-4152-be7e-a868781a5452", "comment": "Malware payload (Dridex)", "value": "e43d9c096bc50b1bf1ba9671d1e7e71ac07773ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125462, "uuid": "d6c46aa3-b61d-409b-9a04-15775a7ea5dd", "comment": "Malware payload (Dridex)", "value": "d8bad9ef72058c162fae13205e7d7295a60a00307ba56d24d6d327ec13d006ae046181e8a371b2459ecd2b936c687067", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125462, "uuid": "524d1c4e-0774-41ea-aa37-3e5101f175ca", "value": "T18195D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125462, "uuid": "8fbf26f7-b7ce-496d-a175-66b4065e35e1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125462, "uuid": "5185e247-7c0c-40b0-92c9-b28b624d3606", "value": "12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125462, "uuid": "4e782a20-82a2-4bd7-bff7-3665dbefdebe", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125462, "uuid": "d2df9592-a151-433b-b8d9-c92a4fa0e4af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125462, "uuid": "1c845e87-e96d-4276-a402-efa12a64d63a", "value": "d4f939ffe4632e7cb232b865d6bdbaff471db049c6675cc7db659905eb7f6b9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5826490-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125317, "uuid": "874c66e2-44fc-4581-b4c4-fba81e4054de", "comment": "Malware payload (Dridex)", "value": "102113fc17033fa6e480e00792e1f740", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125317, "uuid": "dee7588a-4c04-4d6d-96eb-42765675866a", "comment": "Malware payload (Dridex)", "value": "d52cda5e2490233527a71935b1e4722bdc074af16a288596d21343cc67f3b888", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125317, "uuid": "acc1c8ef-626d-434e-8352-2e0b3e18a144", "comment": "Malware payload (Dridex)", "value": "4f67464df2492358e3a3a84bb98c3a0a263fb163", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125317, "uuid": "363472d8-bbb1-469d-81ba-9e9d5d16f6f8", "comment": "Malware payload (Dridex)", "value": "2e2ec06da1056d54ec4938a1e3a52ce54822035f7ce2d7ce9dbe1edf2650c4e59eb8b73fdff4261fa1ce8621adb3454f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125317, "uuid": "79c8c7ed-f9ff-4035-93a8-f74281490927", "value": "T1CCA5D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125317, "uuid": "cc77df74-a763-4644-a289-8e8de38ccb0d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125317, "uuid": "41161bc1-d710-4992-a381-cf5e134f8dee", "value": "12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125317, "uuid": "28e4436d-f7cb-4aa6-be64-dfa61ab943e3", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125317, "uuid": "891e7860-52d2-4937-8b80-c19ef2da4a45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125317, "uuid": "ebcaba5c-8277-48e8-bfdb-daaea15e8638", "value": "d52cda5e2490233527a71935b1e4722bdc074af16a288596d21343cc67f3b888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d2b098-19ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632127865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127865, "uuid": "24e6b122-7831-451e-af98-782281abd17a", "comment": "Malware payload (NetWire)", "value": "b32bd1feccaec53b1bd1f1be43c6836e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127865, "uuid": "18abf105-e84c-4536-afd2-fa57cf2cead8", "comment": "Malware payload (NetWire)", "value": "d55aa6bea84dd9982c908b020d9529679c6219f9da29a794af64894eb9f092dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127865, "uuid": "8794d4e4-c114-4cc1-91bd-9f9982661f3a", "comment": "Malware payload (NetWire)", "value": "429e24de4d9858d2991469ec233b87d7c16e5f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632127865, "uuid": "70eba0f7-ead5-4b0a-9d53-d63fb380fbc1", "comment": "Malware payload (NetWire)", "value": "6b49b4fcac521eeca668b462f89ec7e411f5cd847c3d0cefde020ae4f8de5b148ce91d82c9e5df714987a1fc28772a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127865, "uuid": "64a3e039-3abd-42ed-9ecf-55d1997f915b", "value": "T17FF49DC17D47D89BF4DF2AB3986FC0201165AE9D8165C73D2682BA2B55F3312306BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127865, "uuid": "02133624-cc40-497f-aa9c-18d5e7045892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127865, "uuid": "8a0cc153-87b6-4657-b6b5-480ec3fc0a60", "value": "12288:uovvQSmtiK5o8jHIOs4dUXMTOvZAGJoxJhRyEXpl47I9rX1f1rjknkAft:pvt+FoQl85axJqYy7IJF1vknkot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632127865, "uuid": "e67cf50f-f461-4bad-8419-71d376c0ec31", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632127865, "uuid": "e7b33b9e-bcde-4595-8999-1d1665fd1c71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632127865, "uuid": "3a5b7c9f-985b-4885-9ea0-bce872d1141d", "value": "TT653GH?xcod..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133c1808-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632115918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115918, "uuid": "751eb7c6-7e9d-478c-8b8a-1d9a53d621af", "comment": "Malware payload (SnakeKeylogger)", "value": "93e3e1587cee7e818e2c9b5033381575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115918, "uuid": "1dc1cc83-99bf-4822-913e-6338a58abf38", "comment": "Malware payload (SnakeKeylogger)", "value": "d59af3fc697ad0eb499249befe43b5fa31164b1fb21a65ff4ebdddb48cf88a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115918, "uuid": "d1cd2a22-3aec-4aef-8d07-bb2d21c4f4b1", "comment": "Malware payload (SnakeKeylogger)", "value": "1dd774702fd31b2eedabb9a01e95a8d92ed18903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115918, "uuid": "52465c7e-b998-4836-95c3-1676c0e5704f", "comment": "Malware payload (SnakeKeylogger)", "value": "244390401bf8a3f5be1f571f3eb628b56820fa1e445391e0c34c35e3b7bba1a2547ca045703f17fb62f8c23fabcc1ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115918, "uuid": "e526f6a5-6aed-408c-8209-12d8568d6db2", "value": "T175D439103D9682B5E43A5F7ECAB863D4E63E7D232F31A13D1B70328606B364C899D576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115918, "uuid": "e9ba19d2-0b4e-4092-b6d0-710e3d45ab5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115918, "uuid": "d042a08f-b6b4-452e-9d32-334b30add55b", "value": "12288:D+f2jbson43S+PqmOPbOF+k4DbF53e0IUFLdd6xQG8:DpbskWS+Cbjswe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115918, "uuid": "04d5bb76-30ff-43a7-98e2-233b0e3bb036", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115918, "uuid": "11eaa399-d419-4315-bb68-02d448e07902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115918, "uuid": "065ca943-2c08-40f5-be7a-cd1e120f26a3", "value": "93e3e1587cee7e818e2c9b5033381575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d86d31a-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632146537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146537, "uuid": "e4e76ecb-6e2a-4572-a882-ea4d269a88a6", "comment": "Malware payload (AgentTesla)", "value": "d41dc428d436fbddcc8aaeb3f24af6f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146537, "uuid": "04a01c00-e4ed-4cd4-9dd7-20cb08a86dd5", "comment": "Malware payload (AgentTesla)", "value": "d6590c3add709d2a0c46d229c56e274455d0d63bb4a38a3847ec9ea3187efb65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146537, "uuid": "84e0076c-78bb-4ce0-b4a2-56138730c65e", "comment": "Malware payload (AgentTesla)", "value": "a0f731377ea5d23c66c0a4a341ad34d814210683", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146537, "uuid": "c3ff6449-5196-472b-a778-7496c463346d", "comment": "Malware payload (AgentTesla)", "value": "902be489bfe488e1feb4395d5c9fb4a35bf6efc2badf869a2702ea35ffd22375136d55be607b1bf9fa6dccb0e3de8eee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146537, "uuid": "adb439ba-c3f6-4b99-b14c-1b09e8f1e4b8", "value": "T1A055FF294D2682F7C7EEC23CD05C4F9EEB62AC837A618F0E98C1B6D6167760BD18445D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146537, "uuid": "3b9a74c1-d737-44e1-880f-e7510cd5a105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146537, "uuid": "6595192d-42a3-4bf7-8816-42a1420102ef", "value": "12288:qpYu9nEPb36JplQwZ6cUmE0rUTYolxTWvlG3iG02rI+ppppppppppppppppppppJ:qpYuJEDw99G0+/xBiNPjUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146537, "uuid": "fd19c4e4-beee-41e0-9b2c-cab4eeba2ad6", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146537, "uuid": "16dabd5c-575d-450a-a84a-83fb090cf130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146537, "uuid": "5f8d6266-8839-4610-bfbd-09a975c7a1af", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98384c2-19f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632130022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130022, "uuid": "3b5312ac-06df-498d-b5f5-4002c0eaca52", "comment": "Malware payload (AgentTesla)", "value": "71d0d1a83c370dd9bb609f3cc29d5085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130022, "uuid": "992163ee-8684-4068-8cd6-77e2a1627ef0", "comment": "Malware payload (AgentTesla)", "value": "d6661468464941a091591013e4799e331540e5199229a48db4dfb73fbcb9902f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130022, "uuid": "f36db012-92d5-45cb-9eb6-3cf3975e89b3", "comment": "Malware payload (AgentTesla)", "value": "9e63aad765e1467382c3b53be07a1b481d5a4f7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130022, "uuid": "fc409028-3d0e-40e0-9514-7fece001daab", "comment": "Malware payload (AgentTesla)", "value": "6efdfa985c6377eddba39f078b2239559790e46314ebc721966811ab5649d93c1aca321a34fa438af66a5b05cd885729", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130022, "uuid": "be7918c0-130d-4aa9-9b66-5adff19eaf52", "value": "T17773BF10770BA920D4342FB348A9A3D503B7D38DA5278B5F345E193AEF6278E0B60BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130022, "uuid": "ef565e16-a921-463b-983c-b62e397d3d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130022, "uuid": "4aebd066-4556-4f08-967a-e847c474ca6d", "value": "1536:qnlqhS0Cy74CT3TrYz6vDpMQ43+41xPNfads:EleS0h0CTXYmvFMQ4b1Lf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130022, "uuid": "d3e98850-dc32-4378-8380-41824d508a1d", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130022, "uuid": "a363b2e2-bf47-4019-bfa4-94a7c9cc5c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130022, "uuid": "681124c5-0322-4658-808d-33a6d836a34a", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e9399d-1a0c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632140268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140268, "uuid": "0c58ee83-c87d-4355-bbcc-58bb2df9e6f1", "comment": "Malware payload (AgentTesla)", "value": "ad4916dee50d27eca4c54a7978233d4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140268, "uuid": "3e0a8a75-c94c-48c8-b0d8-390d77653ed0", "comment": "Malware payload (AgentTesla)", "value": "d69c941dd2ee95c80b5407a8ec4c97cb907fda4006a0f54012ce199ae4ce8ac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140268, "uuid": "47f37f40-8e60-479f-b4a3-16f414429792", "comment": "Malware payload (AgentTesla)", "value": "7de86da5aeaf54487b392079b557b2c80e76330a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632140268, "uuid": "2cfc869a-21fb-4470-a37a-3432eeda5ac9", "comment": "Malware payload (AgentTesla)", "value": "0b787f5bf81bce15049350f4b99647055cd149a4d093a21aa11a2d5a63a5cebb7287bd9eac3a9c46192c2397477beb76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140268, "uuid": "0787125b-45ed-4f91-adc7-acb299af6345", "value": "T13655DD298D2682F7C7EEC23CD05C4F9EEB626C837A618F0E98C5B696167770BD18444D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140268, "uuid": "9d0185e1-fadd-4ced-901f-ae27ec387f94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140268, "uuid": "9774fb8b-c28a-47b0-b39b-f8a211cc771c", "value": "12288:qRNHT+Hdhc1BBCG1IVZOA+ERlOl4mJmDROqYuYDP7r9r/+pppppppppppppppppD:qRNz+Hdhc1rF+UWMl4mVqYuYD1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632140268, "uuid": "aee5d039-c18f-4d47-a26e-e1600409c732", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632140268, "uuid": "f587b4ec-7962-4eb4-b9b0-5c33bb46f0b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632140268, "uuid": "44a8e3dc-571c-4bf6-930e-ae5db8f6b70e", "value": "UPDATED e-STATEMENT..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ee7369-1a4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632169043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169043, "uuid": "1e49e43b-1663-4ab3-9a7b-37596e44b663", "comment": "Malware payload", "value": "8f3b634d8c2ab2da5931e6275d3b5298", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169043, "uuid": "4a29fad5-8449-476d-a3ca-22661d1a2153", "comment": "Malware payload", "value": "d71758ce60dbe12dd7f9f0e639b2badc35edf3d56cec8f36fa8d0de874399d42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169043, "uuid": "b1b0a67c-4a4c-4453-87d3-7cc0d7842cd8", "comment": "Malware payload", "value": "e91f0358bbc3fc6120ae5a9dd6783f8654c567ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632169043, "uuid": "3ca2008a-fda8-44e9-8ad7-ce5921d2895b", "comment": "Malware payload", "value": "3f2e0be19203433e88916421ffa5ffb9af17f7327fcca1fe63b692f3791201034abcfeb02448c38e704afa380c43ff1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169043, "uuid": "55badeec-2858-4b68-86e7-385a134579ca", "value": "T1CF645B01F7918039F9FB15F866BE62AA583D3DA017A5C4CB53D02EED5631AE0AC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169043, "uuid": "5a60b2a5-f540-4ea9-b86b-9c85db3492c5", "value": "93ff035c4f0d6b2288f55518b4004eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169043, "uuid": "8aaa3105-0d72-415b-b3db-4d033455e9e9", "value": "6144:upZQRpn8tkYwMoEtJJjr/d110yI2n2Gn2uxRFY7GRAalCGsIV:WQRR8t7jbv6q2w2GRu7VuV5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632169043, "uuid": "42d29d6c-3909-490a-857a-ef52f4c323f4", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632169043, "uuid": "e8deefca-0b20-4820-8e85-ad9245a5d604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632169043, "uuid": "db9143a3-30b7-4d1f-898f-c08d2cfe23f7", "value": "TV.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de106d3-1a12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632142780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142780, "uuid": "dd6131a0-d97d-4746-a0df-6f6616e5a421", "comment": "Malware payload (GuLoader)", "value": "415ec37f083919417aefd51bdfaa3831", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142780, "uuid": "b18d7085-5a40-4de0-b1eb-2a54cca94436", "comment": "Malware payload (GuLoader)", "value": "d8a0961f251666689e124d09421565696a8a6710216b0a46be1e47805229e849", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142780, "uuid": "e3d14431-e5c0-471f-81ff-2542a7391ad1", "comment": "Malware payload (GuLoader)", "value": "3fd77bec41ea7532f5817c648e1cdcb97898c1bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142780, "uuid": "5dbbb9fb-139d-477c-8e71-f336f223cea2", "comment": "Malware payload (GuLoader)", "value": "b57f121e36b57be21d0706947efcc5c6e99187c7fff99a948384e8aed6668dd8c07ce7327d2156cd5e6d79f4f11dffd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142780, "uuid": "fabbcaa8-449e-4802-8478-a507cb0c7149", "value": "T1AB838CD255E4CCF3DA579A3C0462BF705406AC179A22BE4328856F1E3EB7B17CB52A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142780, "uuid": "a2f6b284-fae3-4c93-8e0b-1d4dcd6ed994", "value": "40768f14753bfb2d577d092577251956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142780, "uuid": "79eb89f7-33da-472c-b5aa-f3833caade5d", "value": "1536:sM+STtJlbUxcKgdESWAKw4zMj151rgeg/wD:p+STtJ2xngiSBKw4e9Ng/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142780, "uuid": "6d48b3f2-fa93-4970-aa74-dbaedf2996ca", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142780, "uuid": "aee7ef82-76ab-43b9-8054-7621e7f03451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142780, "uuid": "ea42ffe0-ab01-4c67-9a47-868ac1e7fadd", "value": "415ec37f083919417aefd51bdfaa3831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563638b0-19ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632099280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099280, "uuid": "7b4a2218-61ad-4c8a-9c7c-2c094c81b445", "comment": "Malware payload (AgentTesla)", "value": "b31f570ea24fdc96ce5b6e379c1d6cd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099280, "uuid": "40552bfa-4f72-4fde-b6e5-94fdce0ccc39", "comment": "Malware payload (AgentTesla)", "value": "d8c7a33fbfb33a86e7c0b21718e8b1402f2f1bd5886104829360e56972ca83ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099280, "uuid": "7f244340-f155-42f7-938b-cbadd3afe42d", "comment": "Malware payload (AgentTesla)", "value": "1bcaf8317a557bc9ad95af5981d3cb74060671d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632099280, "uuid": "7b366512-e664-49ba-869d-06492ac71833", "comment": "Malware payload (AgentTesla)", "value": "14e4b118776872508dbc788856742ead4e6df842a0a3ae61559ecc4228c6a2e405402718551aac2a276489d526238c1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099280, "uuid": "3eac8f06-4378-40eb-9199-df514baff543", "value": "T18135CC294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099280, "uuid": "85c95449-f65a-4ea5-97de-e2fd471389d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099280, "uuid": "b747b6cf-5eb9-4798-a252-81d35ff28045", "value": "12288:rBkFT+35UrgOmG2mwl2OzVXva/C1Lik5KiEjL:rBkFTS5zom2iSah5KiEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632099280, "uuid": "0f121cb5-cc8a-444b-b55c-8f6effe25049", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632099280, "uuid": "1f446669-abad-44fd-b9de-ef8f271a6735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632099280, "uuid": "cf4f4870-a0f9-4e05-82ff-ec8e9fe013ba", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.4672.15341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d73df4-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632146328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146328, "uuid": "ab0cdc53-ae73-4113-b0ce-8f3922a3b739", "comment": "Malware payload (RedLineStealer)", "value": "9f457e2267194ab76fc93fdbd0d0f8c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146328, "uuid": "52a2f6e9-1e8d-473c-9e8c-3e5f0d3b4fe1", "comment": "Malware payload (RedLineStealer)", "value": "d994b29cc12f54743522938126dc878076dc55075ed9b3ae39cf12ff69406044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146328, "uuid": "b79f3e89-f171-4010-8535-ac6b1b42de86", "comment": "Malware payload (RedLineStealer)", "value": "23530e85940af7f590782571ce99308981d5b747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146328, "uuid": "0a7a15b6-81b5-42d6-8a0b-58488126c0eb", "comment": "Malware payload (RedLineStealer)", "value": "d639dddd345beb41102385f3c025b8b9f0fcb2d471de2a0f05589a355308801e97b63791a561c7b6d01ec31e142c30ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146328, "uuid": "869e41af-e435-4b9f-a838-620d1ebaacfc", "value": "T176E518A13919B16FC4857DF61CC3D0034FA423A997A90B17DEED3475F68384A6BE12AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146328, "uuid": "ad517a39-0a60-4106-816a-8725bbc7e52b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146328, "uuid": "baa9fbcf-8134-49c1-ace5-faa2fff8cdf6", "value": "98304:ZFyLHjVYR7qZGGh7Z73kPQznHKJhssg1rurNeB5J/Y6wNe:ZFyLHjVYR7qZGGh7Z73kPQznHKJhssg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146328, "uuid": "1dc416df-c4a9-415d-894f-1124b79121fb", "value": 3249472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146328, "uuid": "89df0196-6a0f-4798-a844-5735a85a46b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146328, "uuid": "26cd57d5-e88d-4e17-a3ca-7d374eeed34e", "value": "9f457e2267194ab76fc93fdbd0d0f8c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecf32c8-1a04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632136688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136688, "uuid": "561f34df-35c6-4c8c-baa8-29f32e4e8e6e", "comment": "Malware payload (SnakeKeylogger)", "value": "76768af42756a1188ebe7779fe5aef31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136688, "uuid": "5004c438-4a1c-48b5-8bba-7acfaa3d9bf2", "comment": "Malware payload (SnakeKeylogger)", "value": "da3b2e2db1ba1f773985e2c147e515d86d22403ea32e2cde0ed46a918bf54813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136688, "uuid": "9c682858-9418-49d5-8036-5460a43defc4", "comment": "Malware payload (SnakeKeylogger)", "value": "680b729ef3de8dca6e36d40ab3129ffcafc5eff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632136688, "uuid": "c105bc3d-d346-4af3-a0d0-4fa0060bc6c4", "comment": "Malware payload (SnakeKeylogger)", "value": "db27a9125acfe6f3d57cc225e51215cb85d5f0f7c12a45d39ab2d108eb4fb1a34e5d412a19aa4eb895403ec30579afb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136688, "uuid": "2efc7a36-899d-451b-9634-39c376fad64a", "value": "T1D8F48CC13D47D89BF4DF1AF3986FC5201165AE9D9161C73D2682BA2B55F330230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136688, "uuid": "d6439876-e99d-4e9d-b4fd-1a98c763753a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136688, "uuid": "27d27075-5fc4-4069-a9ec-e8bc68e79a55", "value": "12288:kUqsmtiK5oCZg7Dhv9HzeGKt3DUTSrPwcEPUxGQKP:j+Fod7DrKh3DAmfxZKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632136688, "uuid": "79262ed5-dd45-43de-9d59-7dd3af8b83ef", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632136688, "uuid": "62f48699-6317-4b1f-8db4-10dfd834025a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632136688, "uuid": "f62f6664-373d-4a45-9dd6-0159e1295877", "value": "SWIFT_COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf1129e-1a35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632157567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157567, "uuid": "d703c9ba-bfd4-400d-b150-8a1421f2841d", "comment": "Malware payload (Quakbot)", "value": "c64ff860cbfe9249f699b94e041739c2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157567, "uuid": "4ae66ca0-9d2e-40d9-b9a6-3b3d189a25d7", "comment": "Malware payload (Quakbot)", "value": "dbccb7ab26dcd5488c4642bc85362571440407e5d38b392d2f3018465accc5a5", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157567, "uuid": "13c43805-82ec-47c8-8448-353bc8f35cbd", "comment": "Malware payload (Quakbot)", "value": "982052a4d484c7566888c975e34e3969321e81f0", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632157567, "uuid": "c5303b55-5064-43dd-8b34-66b22291fa4f", "comment": "Malware payload (Quakbot)", "value": "164000779cbc68b93c593b8ec329748eaaf30866b8fa1bf1ed392ef2b297e2f57c8c58ad3415eabddb364c6959c83194", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157567, "uuid": "b8d767a3-e727-432c-8e05-1100e14a2048", "value": "T12D149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157567, "uuid": "0beba281-2924-4aa8-836a-38221a4ce63d", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632157567, "uuid": "b1317eab-792f-4807-8475-36d9f8cea68a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632157567, "uuid": "8498c12f-6103-4987-afcd-c55fb0cb31dd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632157567, "uuid": "6cb11b74-fe91-4c5e-9e32-84ccde7a4bbb", "value": "Document_5153204-Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952daacd-19f0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632128162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632128162, "uuid": "920290ec-684e-4ccd-a58e-0f155671ea8e", "comment": "Malware payload (CoinMiner)", "value": "1f98b0c5a0953fd4f4ab0cf0b6f9652d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632128162, "uuid": "e7c559ba-86ff-4df6-aae2-2b150c750182", "comment": "Malware payload (CoinMiner)", "value": "dc9787f1ca396af3c6a84f52c1f4a1969b7d33999507f2093480071fc22e9d63", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632128162, "uuid": "db32eeef-c9fb-4bfd-acc4-3332fdbeb6e4", "comment": "Malware payload (CoinMiner)", "value": "fa0f9ae8a139e15a3e6e3f0b6908acc62aa3ef39", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632128162, "uuid": "910e9125-652d-416e-aa1f-1ec017b7e61f", "comment": "Malware payload (CoinMiner)", "value": "797b4f6f4ebbb97b67eed3be9675bc826dde5b9802542d9cd763f5cd69b052a327dc20d85acb11312dfefe9adc7e07d3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632128162, "uuid": "ac2bf08c-807b-472f-87c0-486183382294", "value": "T176349D20BBE0C035F1F712F859BA93A9A53D7AB1AB3051CB52D216EE16346E4DC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632128162, "uuid": "6dacb634-a51c-4d41-b1eb-6da8deb8cc8c", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632128162, "uuid": "aed05d3d-04d4-4d75-8fe7-a3929983de15", "value": "6144:OTZQZKArkvKnHuWnUFmrMuJ3kbjbsq/VKNGrGj8:2ZarkvKnHzRrMu9WT/AGrGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632128162, "uuid": "e3fc046e-1d8a-42ed-a5ae-53ad43e0df5c", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632128162, "uuid": "14e6a4e8-ecee-41fc-9ce1-577417b50e94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632128162, "uuid": "01f29e6a-bdbb-498f-ab6d-dc5fe5c8c67d", "value": "1f98b0c5a0953fd4f4ab0cf0b6f9652d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab1d994-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1632118159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118159, "uuid": "ae249fc2-d6e8-4968-abd7-6af07071ba2a", "comment": "Malware payload (Vjw0rm)", "value": "618445370d04d92f4a17f8d9d3c32f90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118159, "uuid": "57618577-4a51-4b7f-b056-b749ba94d67b", "comment": "Malware payload (Vjw0rm)", "value": "dcd947808442eb12dae80b93adf783592ebf62fc1cc095dcd9d856ed9a921f1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118159, "uuid": "f3860c24-43cb-43a7-8baa-c8124ad5da1f", "comment": "Malware payload (Vjw0rm)", "value": "585a522e099853e0213b7eccf96705975c95c8fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118159, "uuid": "6ea75210-a07f-40b6-ac04-f7a3ff1cd368", "comment": "Malware payload (Vjw0rm)", "value": "447948549ff70b03bb116005dbe0f9c6fcc634adc5df4303ae39b1d311505e4a86eef87a6907d295d5892f48f78d28a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118159, "uuid": "e81868b4-1203-406d-912d-a77962a9fcb1", "value": "T1E1A35BA8BB80A68DB6990957F03D1D4EA7F36B07D99262CC368F31431B3FE4C9219C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118159, "uuid": "4bfe3bde-87d3-4a9b-87d0-9fc156c695c7", "value": "1536:8HRCaAIv44m6h1tuL1Y2AKosWI771xgTQzh0D23WvLVCuQ9p46oBYYYQN7Ukz:kRXFm6hvi1FAkfX902mZCuEivYnQWkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118159, "uuid": "93aa816b-a215-4774-bed7-b6ab70da18ca", "value": 101471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118159, "uuid": "9c3ccd3a-67c2-4471-a0cd-d2012d542519", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118159, "uuid": "a3f8a37f-e66b-4ba0-bc41-7021c3a495bd", "value": "PO-SS23456.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba496b9-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632148574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148574, "uuid": "5d320f1c-d21d-4bc8-8c70-da24eb114692", "comment": "Malware payload (AgentTesla)", "value": "6e502c4a53328898c622628839ea924f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148574, "uuid": "b7b5577e-2bf6-4a30-975e-c56ec598e7a3", "comment": "Malware payload (AgentTesla)", "value": "dd624fff8650b855cd91b38e2693be05ed0155281309dd9373c308547eddc5ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148574, "uuid": "9a3591ee-89c1-4a51-a811-fceeb5bca88d", "comment": "Malware payload (AgentTesla)", "value": "e04353409d315933457fe00bf8107a3d88c829ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148574, "uuid": "277aab1a-bca7-4b22-bb6b-6ba246244e44", "comment": "Malware payload (AgentTesla)", "value": "5f08e6b2476ac615a9bd43ecb244b4fcb61ea44a5b8a2d526c62ed661638b8c52bf218994fa328e2234548e2d14702ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148574, "uuid": "bc2fc6ae-abca-4ea1-b262-0ca2b466b89e", "value": "T12B53F6103790C526E02A6A33CEE3C6DA7735FD61BE10872B3199331F2D765A19F26794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148574, "uuid": "9a2faccd-b767-4ff0-8cd7-c20044a0ff7e", "value": "384:UHT9zXqaYtn0Lm/4KhU4CR9Ll53R82AclFo39D:GzqVtl9lCR9PR82Acjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148574, "uuid": "2db1b746-6b95-4332-b57b-8d31b49ded37", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148574, "uuid": "662c28d6-a51a-4a87-bad9-5d32abff7b87", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148574, "uuid": "4640baaf-3048-46a9-b699-b0e23d0ac5ff", "value": "payment review.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908b6c4d-19f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632131161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131161, "uuid": "40ec9754-f0c7-427b-99e2-0a55b756b79b", "comment": "Malware payload", "value": "a1f2571455beff81fc5e163896798f8c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131161, "uuid": "952ea59d-3148-4db8-a162-30d1f329967e", "comment": "Malware payload", "value": "dde7f2007b68f96c1353fa86a8e83f9d6530e4b69a1b48f58462b08ca9784398", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131161, "uuid": "9478ac34-0d45-4ee7-84e6-af0791375f02", "comment": "Malware payload", "value": "4a30c5d5f9f3c0e360f3b95595ae5608262b0d65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131161, "uuid": "2ca447b9-1c2a-4024-805f-5cde04092b82", "comment": "Malware payload", "value": "e55bf32b27fa2800d289cd948b3a41e7849c18d30d838a3ec4aca419899ef67b8f7ab0378e12cae01e43a26c8ef28f1f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131161, "uuid": "953c1aad-3303-449e-9060-45bc91628689", "value": "T175E2E137FF27A03AD3E7B23941F98AEC9502550BFE05049FAD46B24E2A4215B17372D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131161, "uuid": "4a73df01-5a52-4668-a97f-6e3a80f7532d", "value": "768:UHPDOijY84ruLYhcSqS2nxwRTSpxqYnNepYq1omK/:wOijY8zMo/VNeZoN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131161, "uuid": "f24d2cf3-d765-4bde-a8df-0201d17ddcec", "value": 33470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131161, "uuid": "eab7098a-406c-44b5-aafd-389ad299c973", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131161, "uuid": "3a2e99f0-9172-4545-b634-1cfc1149e6f0", "value": "210919_EKZ_Blue_2-21_Artikel_Saisonale_Speicher_06.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a766fda4-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632118314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118314, "uuid": "7cca3637-dfa2-439a-800f-78bbd70daec8", "comment": "Malware payload (AgentTesla)", "value": "96132467d3a67acf72fb66dde71d6c96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118314, "uuid": "2d811b5a-3b86-495c-9115-67fe3eba2de7", "comment": "Malware payload (AgentTesla)", "value": "de80a1b1bc2f591fa7c7bb8cebbf8532543ee7dbb754dde9a2e698ead4b20b4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118314, "uuid": "01db82be-0e75-4360-a883-d9d349dfd41f", "comment": "Malware payload (AgentTesla)", "value": "eb668191cf066c4219e824b6eac03e421912376e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118314, "uuid": "faade7d1-81bd-444f-a527-bbb6818036cb", "comment": "Malware payload (AgentTesla)", "value": "626e24374a4dc22aca270e740ec0e7f62a8581c8411da47b4e6b7f78c7415ab2da5203fc55454b7fafa94fe07dbf75c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118314, "uuid": "40bacba2-e7d7-4a2f-9efe-772386db1c49", "value": "T1BB15D0202354C26AF1FBE778D4629071CB3EF986A03AD99B5DC399DA0D25341C11BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118314, "uuid": "2e628bc6-8bef-455b-9505-e0c143441b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118314, "uuid": "c9e76f2a-3298-42f4-97ac-255f8d654f55", "value": "12288:8BGiY6HwFuzKkX1Rxr8i1/X9dwg9f1t9x904NpRRvhh6vNXWpIV4mtiK5ofk:8A6QFuMi1/NTxx9pP5oWpIK+Fo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118314, "uuid": "ba68f18b-3df6-41ef-9f2b-2ffd9039f300", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118314, "uuid": "12fb74db-b72c-46b0-b346-09ebb90d0758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118314, "uuid": "71ba3a75-4b3a-4370-be2e-af9292dda1ac", "value": "DHL Original shipping document_pdf (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111ac1a5-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125364, "uuid": "f46ee7ef-e6a4-406e-a962-aeae2616a117", "comment": "Malware payload (Dridex)", "value": "6ead2f6a801a3a6757354140f5e51ec0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125364, "uuid": "2692b5d1-8360-494b-a883-52c71c65a810", "comment": "Malware payload (Dridex)", "value": "df045fbbe6e05c05034f3e061fddd7967819c25f1b307c07ef803dc34ef5a73a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125364, "uuid": "3efd2bde-dae7-4ee7-889e-40b32cf699d0", "comment": "Malware payload (Dridex)", "value": "19aa63bc86a44a674a24abae1ce3dfc7413e4e0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125364, "uuid": "32258d24-3e5c-44f5-b056-cebfbf078f1c", "comment": "Malware payload (Dridex)", "value": "2d1d72470977122579dcce8a001c3e1ccb59fab5973abe00401dbc964ca25324bae1c0d2a1a4fbbfad279b34d5d7b4ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125364, "uuid": "ef11f9eb-1e45-4122-8fb1-1ce8e142da1e", "value": "T1F9A5E010FE69EDE6C6B99F3E9408352317B93D74130DA18CC391604F5EF82546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125364, "uuid": "5e8f0926-f6ff-4960-b0b2-9957996505b3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125364, "uuid": "b78dc492-2564-4e4b-a660-7a0ed6a958ba", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125364, "uuid": "ef33c2ec-4d19-4f08-8c30-6a48afd3877f", "value": 2076672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125364, "uuid": "e79dd51f-2319-4e7d-9867-452bb86b5248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125364, "uuid": "d43d4314-39a4-4b35-8fb9-02d7461000de", "value": "df045fbbe6e05c05034f3e061fddd7967819c25f1b307c07ef803dc34ef5a73a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a988ef8b-1a11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632142370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142370, "uuid": "a81eb406-b0ea-484b-a0d8-3805559f03bb", "comment": "Malware payload (AgentTesla)", "value": "f8c6accf590feca932de4403f28cb99c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142370, "uuid": "b5a3254e-3207-45b2-8f94-d34e8f3ceb96", "comment": "Malware payload (AgentTesla)", "value": "dfcea3e1bdcc865d82ed33a9dad61ca35062404e40ab79be9f97b677e16836b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142370, "uuid": "f4ca8679-f186-4ae8-90b8-ea2bec3c2b7d", "comment": "Malware payload (AgentTesla)", "value": "18f64496ffd4270c7c077b2e6d2706cc6388b212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142370, "uuid": "ceb5b44b-c617-45b5-bb13-93702730c2e6", "comment": "Malware payload (AgentTesla)", "value": "f690536f96bcf717c92357c3df712e9b8a3c4d165561ec9cc54f6043f39754bbee06804f1cd848f0e988f98319a7903f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142370, "uuid": "238607c9-9085-4da8-827e-9fa06584a213", "value": "T1E335DD294D2682F7C7EEC62CD09C0FCEEB72A4837A918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142370, "uuid": "8f51d877-77e3-42d5-be3f-3a721df2d3ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142370, "uuid": "7e43730b-47fe-44a6-affa-15c6a47dd311", "value": "6144:upoulxEdAjbqZif1EodGNTEE72NbQ6lr03WRwzS9c3xXQxyT8df+9ck65IWGnBUj:upYu9JQECr2aJNfVsKQOeAC05K5NJJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142370, "uuid": "abbb23f1-8774-42b3-a680-d881b8b07f9b", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142370, "uuid": "a59f21af-4653-4427-a2d3-e3c3c498d30a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142370, "uuid": "b6ed0014-4856-487f-a956-5cdf7d6785e2", "value": "DHL Express Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd54cf-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632148641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148641, "uuid": "d0927890-c3ec-4c69-91f2-13e0b01917e6", "comment": "Malware payload (AgentTesla)", "value": "fceba02d0f45f0ddddc219bba00b937a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148641, "uuid": "98865094-bd22-46e2-9ec6-294cdafca3a0", "comment": "Malware payload (AgentTesla)", "value": "dfcf4f263045dbd7b94cefba683314023007967840c315dea3244dbf02d50ed6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148641, "uuid": "fe58dd82-29f0-4676-94d6-2de3767d3188", "comment": "Malware payload (AgentTesla)", "value": "dadeaa66dd130ec81acdbedaffb974dbf24c6936", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148641, "uuid": "b4f9b44e-0b8f-47b9-b855-7c5b69a35680", "comment": "Malware payload (AgentTesla)", "value": "6b0ce7b582e21d039e4f302b6bc642bc0f6ae54ffbd5fe552f9d403dbc23aa839890e476a7b5ddfef48785d4e7ce9df7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148641, "uuid": "51b064ea-7ad5-4656-b522-707333156939", "value": "T1AC33022F41C91748C0BEBF6C180D9B0448933549F1A9EBA146D3EDE3DA2C8466DE7AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148641, "uuid": "423ae57d-5acd-4f99-b14c-a1fdb0dce604", "value": "1536:mljcWhR9cUQpBd6U1V7J+lG5U2Z1rJRBL0:4jbhEUGBd6U1h8lGbZ1rzBL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148641, "uuid": "603d5af5-9b3e-4cff-b060-9a2358c975f8", "value": 54856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148641, "uuid": "2d24b3b3-4a4c-4c5b-ac2d-16728dabb3e5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148641, "uuid": "ec3d2537-0348-4098-aeb7-f743491b8245", "value": "TNT Original Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa5956-1a4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632168107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168107, "uuid": "c905f318-7998-43ff-8913-b0bc0882aa78", "comment": "Malware payload (ArkeiStealer)", "value": "15cd929fe8d7b5d887e2a1b83ba229a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168107, "uuid": "6569c89a-1cdd-4402-a5ea-399be4c401d4", "comment": "Malware payload (ArkeiStealer)", "value": "e063c47dce8d2f1121ceb4cf4b20688e975646ac831c0e5843d4536d7e1dfbce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168107, "uuid": "fac6711b-7207-410f-873b-69ad7aea32ff", "comment": "Malware payload (ArkeiStealer)", "value": "2c604671837c21e0bbd5362aa8a80eb3bfcffcd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632168107, "uuid": "40f72656-a89b-4353-bf47-008078775c85", "comment": "Malware payload (ArkeiStealer)", "value": "cbb1a21ee44a6dbadf20202c899454e803352be5e697f86c29f7db71700f05d625c47065f1c4c5ef7bd6cb438f770800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168107, "uuid": "ecf814c8-880e-4856-8ab2-6c3101d36897", "value": "T1ABE4F120BAE1C039F5B352F869BAC378A93D79715B2454CF62D61BEA16302E8DC31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168107, "uuid": "d28af6d9-261a-4726-b1ad-881043dd11ea", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168107, "uuid": "8bbb839c-799a-404b-8081-6c0f367b424b", "value": "12288:iqQ9Ej3XrKPw87zNUyYR/gzX/DH8Tpfze2MWiwS3JM76h1+lI0U57B9U:ijEzrM960PLgfekS3276h1+l7U5F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632168107, "uuid": "32095422-a268-4764-9e15-b52ff9de074a", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632168107, "uuid": "ba6dc563-0223-438e-bb6d-aab80f48557c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632168107, "uuid": "d1f87f3f-e178-4ac9-b756-b4b22a7b3ee8", "value": "15cd929fe8d7b5d887e2a1b83ba229a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bf270c-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632115916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115916, "uuid": "fc906a3f-b66c-4326-b733-9bdb4cb2e772", "comment": "Malware payload (SnakeKeylogger)", "value": "99916d659a56bcf75d3a30fb030f3b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115916, "uuid": "3d5cd482-d543-49c3-9f04-fd80ab37936b", "comment": "Malware payload (SnakeKeylogger)", "value": "e0cbb38aa852a2959432af140d417bb2440496b3b8710fe20eeccf890843bf41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115916, "uuid": "5ff76136-8c99-4e27-a0db-7c0fe72d528c", "comment": "Malware payload (SnakeKeylogger)", "value": "99c20f46e8d870d5f9439493ecf1b58a166a7ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115916, "uuid": "42de7bbc-bcc5-4dd3-aedd-e6732df39698", "comment": "Malware payload (SnakeKeylogger)", "value": "4280cad5d847be900c63ed7c19ac9ef8dbaca70d86e91a467996e649f101c667d9e11aaf2fe45fc28c4721d78cd89afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115916, "uuid": "3c77f286-38ca-4900-af24-8d68e60382ae", "value": "T1C415CF202214D516F2BAAB3BC8A69470D63FED43A475D5AF5CC2BDDE0D317A88016F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115916, "uuid": "8b008619-7539-4707-9d65-ad3cb4c50eaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115916, "uuid": "79c53ca6-8162-4e4a-a2dc-9eb47914671f", "value": "12288:VYhqr0z7Uq3GxFu9f7lkufDCGUh/BOGTwyGHdVkUse/HKdmtiK5ovEdc:Gh9/U/Fu5lffYhZOSwyG9rPHKd+FoQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115916, "uuid": "c466e83c-42d2-4c18-852e-a3a32e4bc218", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115916, "uuid": "597e18cd-7555-49d5-879c-1fcefd6b1a76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115916, "uuid": "615aa85c-4ec2-4581-95d3-f058be09e5af", "value": "CATEC QUOTE4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cf7f9b-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131406, "uuid": "592c0a23-0567-4313-b3ae-ab9f2937ea27", "comment": "Malware payload (RedLineStealer)", "value": "29f6d019b55cd3ab946ca70651a2bd8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131406, "uuid": "f058cc68-c9a9-4b8f-8757-c1da02a32696", "comment": "Malware payload (RedLineStealer)", "value": "e0d34cb619633f3fcd0071e0748962a647d5f960e07dba5851916849edd3d3ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131406, "uuid": "30895c40-6acb-4e91-957d-c2664d82258e", "comment": "Malware payload (RedLineStealer)", "value": "0c172f1df09f2bf9ec25a1ab94ca1999d3a3817f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131406, "uuid": "a4f24923-082f-401e-9c71-5e6eb5022ba4", "comment": "Malware payload (RedLineStealer)", "value": "f5ae2143ce4151473f7b0a82fe57aaf906d4525d4b8f33a0c4553af9bf2469b94be048980ea08826e2b30a44c2079c2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131406, "uuid": "15cf0f81-66c4-493b-a672-4f9118e6b8f8", "value": "T162055BA023E88E15EEFE1731D474D58412F6FC866139D3AFD98175A91DBEB428C133A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131406, "uuid": "221b15f2-b41e-41be-a010-38d36f935ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131406, "uuid": "cecbaec4-87f7-496c-b227-5bf9eba36311", "value": "12288:6R2JBKPRJRKY4RM/gecNU2zqX6lUB2AkeV2:6jJTWlDNgWUB2AkeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131406, "uuid": "25284873-dd8c-4d81-a8dc-f36b62563157", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131406, "uuid": "73b4506f-aeae-4e1b-adf2-bf4da2fc5576", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131406, "uuid": "9c83e149-e8e4-4001-baa8-f46a68a20a77", "value": "29f6d019b55cd3ab946ca70651a2bd8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717844ff-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632131538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131538, "uuid": "06cb67f7-70c6-4931-8723-2f8d41df3237", "comment": "Malware payload (RemcosRAT)", "value": "6a4f90cab77a45ea6a4ffc5685fa574f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131538, "uuid": "34085a66-34ed-469b-8e5e-b51f10c34bdc", "comment": "Malware payload (RemcosRAT)", "value": "e15e4ca40396780514e28cfed891f1b9b4884ddd305f44d35742c4ab04170f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131538, "uuid": "191b783e-693e-4bf0-9176-0e55b93581dd", "comment": "Malware payload (RemcosRAT)", "value": "e60bbc30162de443c997f929eea6caad55841f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131538, "uuid": "8490c159-f8f2-4e55-aa7f-8a80b1c7dd71", "comment": "Malware payload (RemcosRAT)", "value": "c85d9c5942799b2ed4f2a7aa45e2338fc60427e6594720db1727f6520315acf76c935651dabc3cd666d58753543a8295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131538, "uuid": "747c1c1b-0614-4845-b55b-6c409d4c7a0e", "value": "T159E47C29F6A41E3BC05322F82D273A949D3D7E003A96564F67FA7F029F3855235292C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131538, "uuid": "2dd6d932-3212-400e-a718-a831ec211bc2", "value": "830382fd5b7a73f0620211f8c0ad9dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131538, "uuid": "3375e21e-6caf-445c-926b-b9d6d0a4e3d7", "value": "12288:w9uZ2lK3ox6/ktmA1ZzgirJFarrvozH9ZgE5eDW:sMxox6/ktmA1hgMsrEH9ZgKeDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131538, "uuid": "3c50adc7-cbff-4e3b-9def-b998eb5f7dfe", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131538, "uuid": "f807df68-dd14-4ad7-8b20-ec95761f5cb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131538, "uuid": "92237b1e-7e6c-4cd8-95fc-754e3f38b49d", "value": "BARI MEDI ORDER INQUIRY 3756653,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa97da1b-19e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632121890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121890, "uuid": "b3418e2b-2be3-49b1-8f56-2a9925e46158", "comment": "Malware payload (Formbook)", "value": "fc85e0d102b221d7f71032ebe0c3cbda", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121890, "uuid": "9fae4701-5188-4d1e-a7b4-ef45652f038e", "comment": "Malware payload (Formbook)", "value": "e1c078017c2f6c989ae5971ea55e2c8d04653701153dad9fc3b9f8964e63b552", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121890, "uuid": "c83dd0d1-1a15-44bd-9f69-92da3f611d95", "comment": "Malware payload (Formbook)", "value": "d0a2cc5c442a6742b691af3d0fdc8a21ea6f5924", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121890, "uuid": "1c875925-2674-4017-b57f-de38927f491d", "comment": "Malware payload (Formbook)", "value": "703b7a861ec41fc06d6d6fb577a006aefc44c2e691a30d2bf302e7c86402696d1e1a770b1a2032dfde9aaf8f410113a3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121890, "uuid": "6d8a4d11-bd65-4881-9156-3629b61dd054", "value": "T162C423F88B0BEC3DC15E4BAB864AFFB75C47535BCB88A5F8D8851C9C60E65447868063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121890, "uuid": "cf7a200e-e080-4c8a-b7d2-3b15e7651452", "value": "12288:nTqhJU7KJZM3Q1hNvPWLywf/JMoqVLOZo0kanPXTtRCi:nuK0MwnjVLOZocnPXhRCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121890, "uuid": "32bd3a75-e925-47c2-9f77-6698a29be342", "value": 595260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121890, "uuid": "a63eaf1e-899d-471c-80dd-c2abb4655e24", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121890, "uuid": "7e338ba6-08f6-44c1-8187-873f8c88dfe3", "value": "Bank Detail.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd75e3d2-1a40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632162697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162697, "uuid": "db312ccf-0e1c-4074-8883-c392765c3ab5", "comment": "Malware payload (Mirai)", "value": "b410c34fd5564de8f9fc25eb34c8d7f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162697, "uuid": "b83e9983-3817-474f-8da3-42d7b30750d0", "comment": "Malware payload (Mirai)", "value": "e2113165eecedd613e4d48665c110524c8fc386fefe2f944d1d38a75ad6213e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162697, "uuid": "00eb7209-a047-4877-855f-c55af103c329", "comment": "Malware payload (Mirai)", "value": "bd2e3f19079df864a3a102ed560b5c054e4b6392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632162697, "uuid": "16ade6ab-4c6f-4dd0-a58f-a935aac01d3e", "comment": "Malware payload (Mirai)", "value": "8cce9eb14b0a2b0b31598747d4a7c47d69cf1262be80c411d888a5305114b4d8591a57db459634358a38b65d38b28f4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162697, "uuid": "fecc1533-e24e-4f8d-a8e4-c920092a3ba2", "value": "T1A564029BEA627C5FED4B4FF025570B4627F8D1DAD38755807368884839FE242A3606CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162697, "uuid": "7c5d28d5-b7b1-4b93-9cb9-2695ebd1686d", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coC3Q:7O/QJHZweEL/NOjCHm7FZZnc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632162697, "uuid": "2ef568e5-3c95-44d9-9a13-da493fe16f5c", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632162697, "uuid": "62ccf5e2-5298-404c-9d19-472c0c221d56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632162697, "uuid": "c38ffa9f-8fba-4221-99f2-caffb94702de", "value": "b410c34fd5564de8f9fc25eb34c8d7f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678cf08d-19e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632122502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122502, "uuid": "61d106b8-5c1c-4682-8605-5c13ea4eb429", "comment": "Malware payload (AgentTesla)", "value": "f9fcfba027415d0ae1b474fa5d43e4b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122502, "uuid": "f150599d-4042-4dc5-b57d-b368c990c910", "comment": "Malware payload (AgentTesla)", "value": "e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122502, "uuid": "22d8cd67-af41-4234-aaa2-f29f683df581", "comment": "Malware payload (AgentTesla)", "value": "347821a7e2a21cfda3acf6a64e47fe63cc578f84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122502, "uuid": "1ccfd06b-bce5-40f4-b8f7-ee661c27c27b", "comment": "Malware payload (AgentTesla)", "value": "f003fa6982f7043c9ebd95aff8c84a6b3c323ee61f727ed02736b20909be2d691df799e2d20e687b13e18f0ba3302ea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122502, "uuid": "32f28543-dea3-42da-9176-78d224964321", "value": "T1C435DD294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122502, "uuid": "45982d25-18b5-4d23-97b0-a2ed05ae2bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122502, "uuid": "c2bafa18-7ccb-4391-9a31-086b792b3535", "value": "12288:5pP/haK73BfA8aHNO0zJQjYpVtEpgKsCcvZQDZQShuP9+LjI:5pP/QKTdaHNO4OjYprKDgZWVhY+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632122502, "uuid": "b4b7a111-7978-4981-898a-803dc47b0c62", "value": 1137152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632122502, "uuid": "15be2663-1097-4ee4-9b14-7b14f19b79bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122502, "uuid": "3861b29a-6485-4fdd-a714-a5a39f05f33e", "value": "CONTRACT DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c046f020-19f6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632130812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130812, "uuid": "ea98ce03-3487-4648-9ecc-6dff1f344f79", "comment": "Malware payload (Formbook)", "value": "7b74904762e17b9fc2337043401456cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130812, "uuid": "030b34f2-3a28-449b-9970-4de9a13e993a", "comment": "Malware payload (Formbook)", "value": "e51c60f40080414b74c2eeef62780b28aa31c7875dada6dc2097323a61cc8396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130812, "uuid": "1c42e552-0b53-4791-9068-3c1c4db5dc85", "comment": "Malware payload (Formbook)", "value": "2e1c27efdac7d5536faa3adb1628f3ffff9d86e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632130812, "uuid": "c4112f01-64c0-4a5e-87f2-4e158939308f", "comment": "Malware payload (Formbook)", "value": "9cbb846381537e47c9b39971490b0e7bce861a5a1ef41b889dff387ad2a4889d80044a217f5761d16b0b47624ba56b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130812, "uuid": "f3c9f187-1b6b-457d-b7f8-d0ea1151fc8b", "value": "T12105AEC17D47D89BF4DF2AB3986FC5201164AE9D9165C33D2682BA2B55F3302306BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130812, "uuid": "4a612269-0bef-4ee9-aa5c-c9703c5b9a2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130812, "uuid": "bef3e0c7-e9d5-4875-8442-5947a2644265", "value": "12288:u5MTdIzySDsmtiK5oyZjdQ8y6ZaKVaL6/tcVCziNyL+dryWDNjEjqSt:sA+FoWq96ZX7tXis+drvuft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632130812, "uuid": "33a23584-6f9b-48d0-961a-56b71e4d9363", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632130812, "uuid": "26f6564b-537b-4844-971d-688c1175b154", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632130812, "uuid": "d0c7ed60-fd1b-404d-998a-c6ac777e9ddd", "value": "673009213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe85515-19d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632118329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118329, "uuid": "046d861b-d7e7-4820-9b60-4d35eaaaac74", "comment": "Malware payload (AveMariaRAT)", "value": "e0478760e1af4a233be2e05cebc73b85", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118329, "uuid": "a9fe4871-d917-405a-9afe-c9f7ca5a1335", "comment": "Malware payload (AveMariaRAT)", "value": "e5600822c775da813e316783e42306811993b13f49c30d1617f6878b5140b155", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118329, "uuid": "d50cd018-8b00-4fb3-a320-0dc5cfa4e33a", "comment": "Malware payload (AveMariaRAT)", "value": "c2809f0d05b78e170c31481b17a57a765d9878e7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632118329, "uuid": "99ae0aec-5095-43f1-814d-df08899daada", "comment": "Malware payload (AveMariaRAT)", "value": "8e694eae496b1c492cd72b7f6c615c9ccf6007220b207f05e80e9959aa4d93ce9db64812ee28bba7a2c1b8ceb8915900", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118329, "uuid": "4de885be-c71c-494c-bfda-964b95866411", "value": "T122D41832365D728CE37176B0A7B3D021F5986E335E9D92C938C3FA0DC273246D962A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118329, "uuid": "d18dde3b-5e41-4b00-9ef9-7e35726981bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118329, "uuid": "2380bd69-8239-466e-8527-941f61a40fff", "value": "12288:ZXhxwMFKudH398vU8TRY9fkt7WAwxm9QDat:RocJ6vU8iVkVWfqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632118329, "uuid": "3cb1b907-b6b9-463b-8508-afc9f33407f4", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632118329, "uuid": "a8a71222-0aec-4374-b51a-ece9a229b8d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632118329, "uuid": "d1e4a7f0-abd8-4b52-b22d-294c1bc30d4f", "value": "Purchase_order_eberspacher_sept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f338f5b-19eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1632126032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126032, "uuid": "9c6200ad-8fc9-4f55-b920-b77390d02e94", "comment": "Malware payload (AZORult)", "value": "1db931e457f9ba1073f9b41b3fd34011", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126032, "uuid": "df9be201-ebad-4128-be5b-35fcae21aac1", "comment": "Malware payload (AZORult)", "value": "e65d03a7c858f14ccb3ab1228f2ad8d57d65a4a17587e8dbf834adb8af82c7d3", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126032, "uuid": "92d96180-0be8-49fd-aeb2-6ec7d367e955", "comment": "Malware payload (AZORult)", "value": "dc36939e519cdcfadc68f6de8d3db94c9ced3b26", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632126032, "uuid": "84dafe97-4560-41e8-9709-48a83cf160d7", "comment": "Malware payload (AZORult)", "value": "730b93a93e52ff516d9814ea95ac4b98f084b06fdfded61e432d1a68831933dbd45d9156495cc21e29009f5f493cdd4d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126032, "uuid": "da46207e-cd79-4287-9cd0-dbbaccaf6c31", "value": "T12525CD354E2682F7C3EEC62CD55C0BCEEF62A4937B918F1EC89287D2025760BE59845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126032, "uuid": "f3e9d9d1-1c9c-4bad-9566-94375aefaf78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126032, "uuid": "2fe0acb1-01d4-4855-ac23-1d8f1ab6e4f3", "value": "12288:zwZKu40Bp0KLOXgS3z+u/PP0u8CkVRoaUaSpbZw:zwZKH0X0KKXgUFXj8CkVRmaSpbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632126032, "uuid": "d5b30499-2c3f-48a2-b77a-20ff613ba343", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632126032, "uuid": "df513f19-ae0a-4d80-9148-de3995a592c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632126032, "uuid": "a204092d-acc2-424a-8bcb-17d1595894a7", "value": "e-Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8dfae3-1a39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632159310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "540af458-6850-456d-ad89-2c2e79d2cabb", "comment": "Malware payload (Mirai)", "value": "9d9c7368d9d1cb77a67daf2eba97d971", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "4d67a125-42a7-45d9-a75d-b3989a7c4c4d", "comment": "Malware payload (Mirai)", "value": "e71e40e4d7133a4f7cb9f93b257b5a58fad672a94a454c61ef8ff0a39d85644e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "f0af47be-e0ab-4bab-9dfc-c0dd760ed095", "comment": "Malware payload (Mirai)", "value": "885723b742f78ac701d3a1e1c4537f7b75f7535f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632159310, "uuid": "9e5f2939-e924-4d0e-b363-9a5dbd8e56c0", "comment": "Malware payload (Mirai)", "value": "85e455c7b95da255cc373f2a974fdf3fd8ca01afcd9aede0e7e901623da25bdbb8d116b5c8bbcce33dd0bb3a01cd06a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "ed063414-ed93-452b-941b-ad91cddb103e", "value": "T1EFE2F131C450BC26DF3AF9F41A889A6237944D9B33A8CE87235BCF01AE05C1B1617DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "55488545-61fc-40d2-a8d6-73fcfc3377f0", "value": "768:3O0BdtQz9bMaXOaGfCjCdiqSXX/QczrNR8yifoUD4uVcqgw09J:7dtQz9trGzA/5if5D4u+qgw09J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632159310, "uuid": "3e6f3233-2920-4ff3-97eb-3fb1ba52cdbd", "value": 33784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632159310, "uuid": "e2fddfd0-933e-45a6-9e43-36b85fbf61ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632159310, "uuid": "63426a30-d1c3-41e6-b156-f4ca093fb0b9", "value": "9d9c7368d9d1cb77a67daf2eba97d971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cda78a6-1a13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632143020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143020, "uuid": "d84ad0b3-b72d-4598-b2da-dc8b5bc29716", "comment": "Malware payload (NanoCore)", "value": "b63e035d085bca463d6fed90706c916e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143020, "uuid": "9d2e706c-4fae-4629-bbad-add11026ac1f", "comment": "Malware payload (NanoCore)", "value": "e8839f74c28c0f7288eac3f8295da3c06f5399752e18e0291188276fd27d3cf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143020, "uuid": "e6c3b2d6-c89d-4fd3-a540-f1c2916cef9c", "comment": "Malware payload (NanoCore)", "value": "d6e89df5089d55fbfdafa9f5c90bb2cad606ecb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143020, "uuid": "83e48aa7-c299-4208-a00c-fde1d4fa05b4", "comment": "Malware payload (NanoCore)", "value": "97e2efd2afb43202dd261de01922193ca19b061a8d016091fff9747c1d948035cc87a697b5ecb9b320420c8bc0a0388c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143020, "uuid": "4c60897e-4acc-4376-b3a4-4f5bd79cf13f", "value": "T17B7423802775EFE6E605B7B22C6D528C8CBBE11E6511896F188D883F4CF5280B617F5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143020, "uuid": "9da6c2e5-cd84-4410-8708-84d94995ff94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143020, "uuid": "13c0a663-07d9-4461-934a-6b2889324931", "value": "6144:NrbLMdu6txCDjIBvEoaFqLATG4D7TF9m3xlo+mlFWH2bRHtBPCoFI33/vN:Nod/tEDjulaFqLIG4D7z42y2bVfPCf3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143020, "uuid": "560b5578-7cb3-41fb-b53c-05680ae32087", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143020, "uuid": "559ec71d-a3af-4715-b46f-9c6739f1bba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143020, "uuid": "db7fc919-af03-46c4-8a09-c8c6ef600ef0", "value": "b63e035d085bca463d6fed90706c916e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cda57f-19ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1632134666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134666, "uuid": "4e5638f8-62b3-4303-bd4d-343cd0b3c444", "comment": "Malware payload (DCRat)", "value": "32594d7ddc394f7a0e8fdbca8622440c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134666, "uuid": "1ee1a177-bda9-4873-8e15-1fe5085aa64b", "comment": "Malware payload (DCRat)", "value": "e94b5bfcea6689274d9bca93a3d77c03ecbf49e2ca1dff4e3fe8baec0f401b3f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134666, "uuid": "4473eb6a-76ab-429e-8ba4-0f075e473ac9", "comment": "Malware payload (DCRat)", "value": "38286d249be4e8d2b9634f261a4d21dab0e103ab", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632134666, "uuid": "c073c40a-859e-4b74-8a32-d0e89d710f22", "comment": "Malware payload (DCRat)", "value": "9a9538acbae3c2bb6c66e349fd862d3b0da046b748120fe54f5fc97b15b492cf1bd49d396b8391d498e5a8c9b9956fc5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134666, "uuid": "1d0dde52-ae5b-496a-a823-89725e5b5366", "value": "T19F41F083FBE843966CD4D4E4410C67AB54BAC0263C6960D6C7F282ABB4FDC5838F2174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134666, "uuid": "9dd5b604-9c04-488e-b990-922700a7f7da", "value": "48:6YCH1I5/cEoOeUypPK/c6vHRk3zyZefY1YKbtxG:4VYc9OeUCWc6xOQxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632134666, "uuid": "73b3da63-6938-442e-8625-4add12d496d3", "value": 2130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632134666, "uuid": "b421b2aa-f02a-422b-8403-9b2fc4b8dcdc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632134666, "uuid": "743e78fd-4000-416a-a04b-aa7200ce2f0e", "value": "Agreement_Sep_22nd_2021.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e5d43a-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125524, "uuid": "7718371c-4a7d-4959-ba41-646d0cfb3bb4", "comment": "Malware payload (Dridex)", "value": "2b479823b83fb47b7733e63952d6e8ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125524, "uuid": "3f90f305-5ed9-4408-b4a1-51ee28683af1", "comment": "Malware payload (Dridex)", "value": "e9941b87b229caa3fdbd8f14b17297db195b9e4838d397b70bb08216b1c52503", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125524, "uuid": "723419eb-751d-463e-9fc1-50bb181cf216", "comment": "Malware payload (Dridex)", "value": "0164156b6cbfe399c7a80df3148a0dffcdc1b005", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125524, "uuid": "a5e50afa-022a-4df3-8c6d-3dbabb4d5523", "comment": "Malware payload (Dridex)", "value": "e1d437a54d0379c59f11a6f2ce5687ce27d4b488fbe2edca22032545b020f095d171b61385d91decc9eabbd1307232ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125524, "uuid": "c5af68b9-041d-4de8-bd46-0dd509ee5204", "value": "T1EE95E020EF69E1E6C6B89F3E9408352727F93D75110D608CD392604F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125524, "uuid": "4f7f786e-08e1-443b-afc6-e471189a52b8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125524, "uuid": "0df287c7-811a-48ca-bf01-8301a911f799", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125524, "uuid": "0dbfb1df-777b-4844-b211-33f677cb6b44", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125524, "uuid": "fcb3a900-83a2-4896-8dfb-5b137b48c003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125524, "uuid": "4b2216e0-b537-4c59-a344-5395cc973408", "value": "e9941b87b229caa3fdbd8f14b17297db195b9e4838d397b70bb08216b1c52503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab992113-1a33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632156976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156976, "uuid": "a3d80943-f391-443b-ae31-fee52ddf7111", "comment": "Malware payload", "value": "5a3a4e496b0bfb111a75f29907a1d3b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156976, "uuid": "e4edd926-3042-4583-89d8-d1be4c2c152d", "comment": "Malware payload", "value": "ea24132311f77033b4f008cf6998970b187eeefaae34e1d3e4c2ce535dca794e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156976, "uuid": "8c6f5a6a-cefc-4795-a78b-5b5f02c56fb3", "comment": "Malware payload", "value": "c581ccedf3ea8fee00c0c4c1e4eefd0e369101be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156976, "uuid": "55a0626c-6ae9-4730-84a5-dc3eae73e3dc", "comment": "Malware payload", "value": "ef34ebb99dfe183b21d0cc53bdd53b69e61a13d76f7e8028e1f0778645d0a1c84f770141eedbcd45d5ac6768fbe17cec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156976, "uuid": "058e606e-2db5-4bec-b9e5-743b7db8752d", "value": "T115E2E09D809A6DB0C12E0EB695BF22751C60B8E47AA90BE247458D48D55FC43F5DE0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156976, "uuid": "6ce47c7a-967c-4bce-b2dc-12d03287f5cb", "value": "768:zDLiTHtK/LJxyIWPbZLzjRJgG9FwCnxvckOdmw2cWRk:zD2MVxUzZvdyG9FXnxvFOQwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156976, "uuid": "baf70657-35a1-40c3-a809-27bbf9203127", "value": 33776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156976, "uuid": "ef7666cf-b5b6-495b-8855-cfc3168d00a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156976, "uuid": "049d6a36-ef22-44c5-aa1a-e1e37be390cd", "value": "5a3a4e496b0bfb111a75f29907a1d3b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4a12ae-1a27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632151848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151848, "uuid": "1f23243c-ed9a-4969-bebf-8d4412aa22b4", "comment": "Malware payload (AgentTesla)", "value": "7093da73cf2332839ee512af0310e9a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151848, "uuid": "9c5e50da-661f-4794-ad31-378a3691169a", "comment": "Malware payload (AgentTesla)", "value": "ea69ca9937ea05806a1f9533b34ad8c266f619e4a26c5e17ecdb5b08b05fcd46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151848, "uuid": "6aa54045-0087-4514-9614-d37a554ef68e", "comment": "Malware payload (AgentTesla)", "value": "bdb217667dc41207d2832c4e0c0b6bc8e7f30a65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151848, "uuid": "e3690c2c-3142-4668-944f-6cbcfbf89dd5", "comment": "Malware payload (AgentTesla)", "value": "aed14764dd78ddbc9801e4d3c28da93b156b03323531bbe001b0dc092f30936f3fbf559dc0366a62c54d1b63af436dd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151848, "uuid": "707b2b4d-80d7-4b7d-820e-373d683cba6c", "value": "T18EC4F1BEF548094FFEE1953638B438AD09343FA601CA7C95D85E362217E31B2A1876F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151848, "uuid": "787a1a57-f343-41c8-abfe-dc8fccbea636", "value": "12288:rVSiFbm+Kkb+otTGDZZ7B6Y8JpqB1xHfwCk/LuDGkt7IBj0ljVTu:rAa1b+LB69qdfwLyft7IBj4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151848, "uuid": "cccfcdb1-820f-4106-855a-2c556e130ac7", "value": 582344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151848, "uuid": "f963def2-52f3-42e1-a493-4dabeef66365", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151848, "uuid": "29b2e9ee-2b4b-458e-a491-442faf722d4b", "value": "second 2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1374c8ca-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131381, "uuid": "48043c3f-7d6e-41c2-94b1-faea735fb9ee", "comment": "Malware payload (RedLineStealer)", "value": "bcf607018ffb4b7943f68e63fbbb3e93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131381, "uuid": "c33dbf77-dc9c-4530-99d1-74e5a32436ee", "comment": "Malware payload (RedLineStealer)", "value": "eab6488cbe3483381688092d905dcdafd89cf39ed1842a0db720e008d4828948", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131381, "uuid": "4c6f5648-0b2f-4d1a-a6bc-e15a472a6786", "comment": "Malware payload (RedLineStealer)", "value": "3905de132a94ce399bdf81e290445aeed41a694a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131381, "uuid": "0fbe8fec-bf8b-4cdf-bb34-2b53406371e4", "comment": "Malware payload (RedLineStealer)", "value": "d4c1c9f1da83033a88bfbd70a40bcaba6db3590eb3e0dc7ab4f9451b33f94baa90bed478b97e419802ab523565dc82aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131381, "uuid": "b0aa8ea4-a61e-48e1-adb7-e93b72d5971f", "value": "T1D775603A27321493F7C9FBF0956899156CA5FB351EB433ED3E12A30E9CF6524826198C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131381, "uuid": "dbdc53ff-b4c5-4f52-a3d2-ee3d89519dc3", "value": "e5e149695dc677624b3b662d73ca03b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131381, "uuid": "9fba8e09-3b84-4089-9c34-ae6030f8343a", "value": "24576:OLSWzgtA7uCzLyhxG8R6nE8aTQQVKkjFFFZ:b6/aBVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131381, "uuid": "fb3a724a-37e0-4c81-81e9-6b1785e4cbf1", "value": 1585341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131381, "uuid": "d5735fd5-3328-4101-be2f-ae213760c511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131381, "uuid": "ad1dca36-6197-4b33-8730-a1cadb9af6b5", "value": "bcf607018ffb4b7943f68e63fbbb3e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2108db79-1a21-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632149013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149013, "uuid": "0c9f1e5f-ab1b-479a-ad6c-6ac6d52c03a7", "comment": "Malware payload (AgentTesla)", "value": "43b1add6562dfc96909f3f8878c0cc80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149013, "uuid": "d58efc96-eae4-49af-b111-b2fd007bd1d5", "comment": "Malware payload (AgentTesla)", "value": "eb1ea0707bfd78f9422e578a754250eb2eeb9e149fc9a97145ecbe344a5b82d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149013, "uuid": "56edd41d-1575-4777-8360-8cc651508581", "comment": "Malware payload (AgentTesla)", "value": "3aff20a1baca80664fc25c2179b00dadd62a430b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149013, "uuid": "fcc7caaa-0689-463e-b2c9-cca73120866d", "comment": "Malware payload (AgentTesla)", "value": "401a5fbce7b283b703709db773bfef0dae143b5d73a9c093f3c86031edb064af693b89600fe4d56f58c10730527637ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149013, "uuid": "6f5c3fac-de2d-4b5c-a568-90cb413288a0", "value": "T190B4232E05C08774E61CED80A6574C28CB6276FDBB5E54263BE1E2D187FC6E7342285B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149013, "uuid": "40d0eb9d-0898-49ad-b185-641c63661cfe", "value": "12288:Z0kSIVzBFCquwA7imcir5rRM4/CXosN8GPRJq1YTzwRh/:SsVwcAdlRM9XFN8GuGc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149013, "uuid": "7126727a-aff7-48a2-9467-89ecc34202f0", "value": 501134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149013, "uuid": "ceac7e19-8ed3-48fe-8628-db294dedd600", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149013, "uuid": "5ac8b9ef-d814-456c-ae23-83d84c35bf34", "value": "Remittance Advice sku10020109202021 - single customer credit notification.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f78913-1a64-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632177876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177876, "uuid": "5fe92dcc-7ec3-48e0-8a3e-b54651a3ddb0", "comment": "Malware payload", "value": "6e72b76795624c0cd578c24342453c7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177876, "uuid": "4fadd223-6a70-4558-9f42-b113be3acb38", "comment": "Malware payload", "value": "ebb22358cc0ce4bc40c76e1c02df8d304fd0b27e9793c7cbcc02f23b4e3c1c89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177876, "uuid": "a57d2df4-205c-4299-9650-fa55754e2953", "comment": "Malware payload", "value": "7866fe84f3b53267bfe505bcec20467b05a6e074", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632177876, "uuid": "7870e9e4-8663-40e2-bc83-90d4842586ce", "comment": "Malware payload", "value": "1bced4e12382027ed46193336b84d0eb5e27c885f5b36b9d1d67ec57e18e4f3ef9fec8fa406435a57c643ef10cc8d173", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177876, "uuid": "2d95d2be-bfda-42f4-91ac-5d598e9d7a22", "value": "T1D4F4B036A2918836D1233E759C1FA26C58297F513D2568123EED3D4CBB34BC6352B2B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177876, "uuid": "9435109d-8bd4-4042-933c-528b486cef07", "value": "2c204420a934ccb2709a8aa59f02422c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177876, "uuid": "f6f1c1c6-3095-4e81-8a88-2ffe42ec2be9", "value": "12288:Uzs+9JTcoiUi3vD/aL9x/KNRODP9aXnRKYxjv55qeY1iWG2rS6HzvlH9:U3vti3vDcx8R09aXRl7555Y1X3HT99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632177876, "uuid": "d9224129-bccc-415f-937c-334e2df99e81", "value": 729924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632177876, "uuid": "be213f4f-11f2-49af-a27e-8d49710f3b09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632177876, "uuid": "035e55be-f86a-489a-b129-ccaed3ab538e", "value": "dhq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755ef84d-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632160751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160751, "uuid": "3585d53c-33da-46ea-a7b1-771a3731b10f", "comment": "Malware payload (ArkeiStealer)", "value": "c47170812c4a50c035b4201efc2c5496", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160751, "uuid": "6718e6a0-329a-4e92-8d36-13add3111b1b", "comment": "Malware payload (ArkeiStealer)", "value": "ebf487d463e3e54459f57c250c9ad14b571d1b1d08979f9ef3039bde9e491f58", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160751, "uuid": "07bc8dbd-fbab-403c-898b-f408882f3358", "comment": "Malware payload (ArkeiStealer)", "value": "f91566948a611619c6e26b88cc892544bc9714a7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160751, "uuid": "159e2db9-c14c-4ed9-95bf-1fae1c7528b5", "comment": "Malware payload (ArkeiStealer)", "value": "9db533b394f4cd65bca5a0fda39d0687ecc160fdd2e3434cb300ae0446b0dd9fb230ce05a45fd68b61aa24a3cae682d9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160751, "uuid": "0769d8e2-f8ca-4426-9db2-ccf09049e0f9", "value": "T1B2E4F120A6A0C035F4B752B459BAB3A8792DFD716B23C0CF12D226DE66386D4DC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160751, "uuid": "b9983992-23fe-4995-82ed-0965f5bc86b1", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160751, "uuid": "d653cdd3-9bd9-4f99-a8fd-4c75fb6d08d4", "value": "12288:v6Gf8ZaSrSPaITS2K/ZbG1/ntJkkwsEmrXUyjBftSyQo5xHI:vX8jrlcEZMndwszr5Qf8xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160751, "uuid": "5257617e-8390-48f7-bb96-81412c010ecd", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160751, "uuid": "54966a34-c33d-4fca-af03-7ba54eb695fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160751, "uuid": "e86c4215-5c04-4dd3-9106-ebdfa6feafdf", "value": "c47170812c4a50c035b4201efc2c5496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e06d457-1a3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1632160255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160255, "uuid": "3e2f8e73-2b68-4402-81af-a6c555f59d9e", "comment": "Malware payload (Vjw0rm)", "value": "048ffe6b625abc3eed6cbb5d6a8ac319", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160255, "uuid": "d47f28b9-e4cc-4b06-889f-13629309e52a", "comment": "Malware payload (Vjw0rm)", "value": "ec2c96e7e47adb1aa3045bc089253d334c67d5a7b51667347e822c1b9d47e57a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160255, "uuid": "8ff41094-0787-4716-a1bc-55facb59a923", "comment": "Malware payload (Vjw0rm)", "value": "0b48722a48691193dfe105e6959c95ce4af7ad8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160255, "uuid": "c040286c-20df-4b2d-be50-e8a857e9ff15", "comment": "Malware payload (Vjw0rm)", "value": "0ea8eba01ad4f79863a77040377317b055b23c1483dec7a8c05e1c99e4284e702b72779b1629a83d34bac4d8c8c41d9f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160255, "uuid": "6fab077f-19dc-4462-a391-94b50fe9538e", "value": "T1CCD1DD9971CE74BDC1A321B55BFB411B73785CD29E4D5224C2D8E48838386BC826AF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160255, "uuid": "f8d9aa20-08f7-44e7-a627-0cc4a62ccb08", "value": "192:QtExL1vv1ZRMhuuuugFLGivribgkzTnaOW4fHM:QqxxPRwuuuuMLwU0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160255, "uuid": "d073cfe0-c9f0-4341-8efb-affa4e9df2ef", "value": 6660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160255, "uuid": "2f5798c8-dcaa-4753-9004-ad87afbcd1bd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160255, "uuid": "d631ee77-353a-43c6-96f5-9c960ced38f4", "value": "TWR2880MNA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ca0963-19ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632111654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111654, "uuid": "e63cdc3c-5c02-4d61-9444-4fe00fdf2c7f", "comment": "Malware payload (RaccoonStealer)", "value": "dd0bd31c3a623a2d073b856427a163ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111654, "uuid": "e1984ab9-0587-44ba-8bf2-486b915cd406", "comment": "Malware payload (RaccoonStealer)", "value": "ec487dae69d41d508b3f771845781e7779174bc36bb393b9bcbe19ecf586d8fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111654, "uuid": "71c75c21-f2a6-4525-8ed8-08a058041b41", "comment": "Malware payload (RaccoonStealer)", "value": "44fe3cf1b6ca59845e49baf4c992fce9c849105e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632111654, "uuid": "a2066a7e-ad97-44dc-b38c-f82efb00b3fd", "comment": "Malware payload (RaccoonStealer)", "value": "909ef6ce838fdf17c6c0d174ed9f1b9f86788ba8d04941f893d233dc8679b4d745be512eb10e3fc9aa0ec2d0428f2623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111654, "uuid": "8785b10a-87e6-4509-bd89-f21554382337", "value": "T1BEB4E020B7E0C035F4F712F819B597A8A93E7A719B3441CB62D626FE1634AE49C30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111654, "uuid": "7443010f-3c36-40cf-931b-3d6d87e5089a", "value": "99e1335f3817517f11962dc50cb29aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111654, "uuid": "0a642022-925c-4fff-b319-3d8ba4f7e6ed", "value": "12288:xZpHzhyspNjM+xm+yF3iGTkFjoKloQs1ITeA7ks8GJ:xfHzht8TkFBBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632111654, "uuid": "f5641eb4-7523-4e4a-955c-2c5f64b17fa2", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632111654, "uuid": "93981ea8-1ba0-4cb9-8a6c-87dcf2d4e180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632111654, "uuid": "911c212c-5afd-4cfa-8f20-7319bc8aa06d", "value": "dd0bd31c3a623a2d073b856427a163ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06131520-1a32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632156269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156269, "uuid": "9f233720-6804-42c4-a154-f3ae5a4b80fc", "comment": "Malware payload (Quakbot)", "value": "c975257f34e981de08151d20c9ed822c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156269, "uuid": "86b15bff-53b6-4bae-9990-fce87b4766be", "comment": "Malware payload (Quakbot)", "value": "ec6e25e2e9d622d5d61abe03cda8d0cb009c846dc52a642864b78623d21b3f46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156269, "uuid": "76cb7002-deca-422b-ab68-c951f0404a93", "comment": "Malware payload (Quakbot)", "value": "8649afdadf4b454f1da628a0ec899af31962f3be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156269, "uuid": "4b38463a-622d-4ee3-9324-5c006cbae96e", "comment": "Malware payload (Quakbot)", "value": "b42b68a33b5626b1a312ef8cc7acef574ff9a2187cd7f6d117b43123ce76f12520de71e0aee1afa23ade65167fbe0557", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156269, "uuid": "3d7b3bb5-1511-44b9-8128-de84c83851d6", "value": "T129149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156269, "uuid": "ef761c9d-7a87-4622-a202-f09bbd8a4fef", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156269, "uuid": "bce1fdd5-91c8-41e9-bc0b-3667d80008c3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156269, "uuid": "cf073c90-6e57-41ba-9357-9425d5937342", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156269, "uuid": "70d66293-dd65-4e0b-8e74-81cc1d4ad5c5", "value": "Document_637422881-Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e00413-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125477, "uuid": "960127c3-9892-4fad-bef1-98a38abbad72", "comment": "Malware payload (Dridex)", "value": "9ce48028a3b64f432723bb0093c9c541", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125477, "uuid": "754b07be-ff41-48e9-96f7-09ff1ba2f819", "comment": "Malware payload (Dridex)", "value": "ec9a683aedd74e059d04e8f3a3328773c0267b270b1796e0366bd0e5af8d0216", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125477, "uuid": "14fcfeeb-6b63-457f-ab1b-9b4a9d0a0788", "comment": "Malware payload (Dridex)", "value": "d39e5c497cf790ad2f2350db64a7f3af7eac5ecd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125477, "uuid": "ab7848fd-6789-48a3-abde-6ea9df3a1d71", "comment": "Malware payload (Dridex)", "value": "db5d9b85bf986b3c70eb3e885f51ac461faf92a172f9027c1105623839a1de5a6b40dfba3857a3b75dff47d9a27a9fed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125477, "uuid": "7dcce388-ad53-49f2-a7f7-a79a67ee0bc9", "value": "T1D595D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125477, "uuid": "f1dd2cd8-6dd5-4b9d-a7b9-4f47c726a603", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125477, "uuid": "46fe7694-6dc9-48d6-b0bd-a3fc0906bdeb", "value": "12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125477, "uuid": "c002daaf-4ddd-4c27-9cfc-677ef6426988", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125477, "uuid": "eb912d97-f7b2-4459-81ca-90fd2d38b55b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125477, "uuid": "2a7d5717-daa1-4882-94f1-33293201c4d8", "value": "ec9a683aedd74e059d04e8f3a3328773c0267b270b1796e0366bd0e5af8d0216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baa6bf3-1a31-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632156010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156010, "uuid": "e87a6a0d-ac38-4a8f-ae8b-c1ac107427db", "comment": "Malware payload", "value": "e0bdeddf7ffd2f769986697e06b5bdae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156010, "uuid": "d7658236-73c9-4dee-b342-405736a7ee8a", "comment": "Malware payload", "value": "ed915d396c827eb412b20cb5243023ef465eead6dfba29597a3c4d2b196a859d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156010, "uuid": "44a66497-737f-4be1-b337-f9f02726d1ef", "comment": "Malware payload", "value": "fcc475d4558c991fa398ec6d38f8e6e4e2268103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632156010, "uuid": "881d675d-10dc-440c-837f-55e939397272", "comment": "Malware payload", "value": "c53cb1a60f2bb02adf01104a06e5cf283e2852e8cec87a16a4e91f03a1d3d0c344ae1e62ef9cb30454acb5bc89cc581f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156010, "uuid": "91fd5b2b-50f8-4d16-ad03-647f74285a9d", "value": "T166F2F17069473D32D4F32CB0AD7F8502A35D4AF0D6DD77F025856BAE3B4E80CAA92942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156010, "uuid": "a0430a89-4d75-47c7-b852-4e81e9f7511f", "value": "768:a2EeVg38ifFZN4kSO3wEmGZLSp3QP3c7gOVWq3U7rq:agUN4kSOABMgQPc8ISO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632156010, "uuid": "1ea2cd6c-83cf-4201-b168-a71fad357426", "value": 37064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632156010, "uuid": "de787043-a4cf-4f57-9e1f-56b862787360", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632156010, "uuid": "2e0a4c69-41ed-4595-be7b-5e0281fea98b", "value": "e0bdeddf7ffd2f769986697e06b5bdae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6c393e-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632125710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125710, "uuid": "6930dd0a-0421-46a6-ba68-b1dfe8d04142", "comment": "Malware payload", "value": "81b5f1e1a01a892296aab30a2e83cf2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125710, "uuid": "f07ef390-b1ce-4efd-8bd5-e0d036fa2b3d", "comment": "Malware payload", "value": "edcba37c26d2af51a0902d72c194d6e736f4567ee8bb64466428b9ade2f477b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125710, "uuid": "a3ebfc16-0f32-423d-8373-227714e37dd8", "comment": "Malware payload", "value": "0fa46a8546247c850751b80096b8fd6358481f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125710, "uuid": "fbaf799d-9aab-41f3-bc75-5a7f3f4921bb", "comment": "Malware payload", "value": "6f2a32bf441fec82ef9a67eb9230fa00601edbb421512aa1067783ba7eae9c049680816a0b67e83a626ead7b1c2a8220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125710, "uuid": "e5d300ff-0bc8-44f9-b1fe-fbbdb4f1514a", "value": "T152A47B997566AA1FED07B772CEEB9754ACE4E5674471D26E232F00E1D2205CE0F8BC20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125710, "uuid": "20104f92-af3b-4c73-bdef-7a0dd879b4f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125710, "uuid": "d9c85e64-ef23-4cef-bbb8-3084dfdf25ef", "value": "12288:/XQmioMIh3Ng7eGXmykPdMVduysaMJcR/V:YmhBh3NgCAmykadDsId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125710, "uuid": "16db6eaa-b20c-4f37-901b-3726b60fb20c", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125710, "uuid": "61ef08e1-eb43-484e-a628-c3e689f46918", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125710, "uuid": "bd7f789b-a685-42c4-a60d-88e0db670f8c", "value": "81b5f1e1a01a892296aab30a2e83cf2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8b2075-19f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632131642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131642, "uuid": "4493124c-3c75-4f0e-8869-6e2c47627ab8", "comment": "Malware payload (RedLineStealer)", "value": "f9d7a16586c6726808ac24b180bc0a5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131642, "uuid": "78483cac-5363-4c8b-a942-c6accc7d4904", "comment": "Malware payload (RedLineStealer)", "value": "eed60b9749e55ab52634fcc2befd94a17eca1e4b31af3eefd5593c0f1ce7083f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131642, "uuid": "aa10d4d9-0063-41a0-95b4-8a62d04bcb35", "comment": "Malware payload (RedLineStealer)", "value": "4ae37dc2ea2ad48401c649269a48eae14be81bc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131642, "uuid": "297e6796-4f0c-4157-81e2-61688d552644", "comment": "Malware payload (RedLineStealer)", "value": "615eb497c50e128b8027af35bcc38ba6801d540acaa23602e0b9127b1f0305f0e1ecf5db7bbd1d6483e119a1cc9a22d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131642, "uuid": "b1cb3367-eccf-4984-99fa-69e00202be67", "value": "T13064BF20A7E0C035F4F711F859B693B8A43D7A715B3455CB52DA26FA23386E4AC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131642, "uuid": "1e5a2f87-0ff2-44a3-a193-938263e9e0af", "value": "90edc546938f77c6811e626812a78363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131642, "uuid": "d9552d70-1401-4e8a-b427-0e33e4084786", "value": "6144:yBZQ7yTsEY6m3Y1aqXNT7VV7jtMvzTGvx0qp9VRCOtqSyUci:EZDY6m3Y1nT7LfOATTVC/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131642, "uuid": "6ec99690-ac43-44af-9182-3d7c53e9e443", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131642, "uuid": "e83cc843-6a67-46bd-825c-083f86c5bd7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131642, "uuid": "0169d734-77d8-4471-885a-cdb8aa8452ed", "value": "f9d7a16586c6726808ac24b180bc0a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8fb859-19e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632121413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121413, "uuid": "fe460615-eeca-459d-bd9b-3b95414a90a4", "comment": "Malware payload (RedLineStealer)", "value": "246f0c171734880af065ec09bbafe4fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121413, "uuid": "841d0180-8639-4f9e-9404-ae62379ea723", "comment": "Malware payload (RedLineStealer)", "value": "f10ffeebd78935f24834715bee622216e9e6349c2562ca4216b3f4b7a0163672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121413, "uuid": "51e7a793-7147-4f73-b55a-918dafc22430", "comment": "Malware payload (RedLineStealer)", "value": "10bd266d7b15f932e50d553fcbc9dda669d467cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632121413, "uuid": "c35ed9d0-0455-42bd-b82b-bfcf15f07661", "comment": "Malware payload (RedLineStealer)", "value": "ac5b6ea8fe1df2922272555864f4c058e7387dfd9f8c3cfb377d86c15923afdf3939ad9c89a786a1b1f6bcaeb70bea63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121413, "uuid": "486cd1f0-9f80-47ac-b189-1ce7c51faa5f", "value": "T1EA64CE20B6A0C035F1F712F849BA93A8B83D7AB15B3490CB63D516EE66346E8DD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121413, "uuid": "e92cadb3-ea78-4351-90dd-9f1003555c01", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121413, "uuid": "1fa65883-989f-4a34-94e4-43b7ba885d98", "value": "6144:+UZQdUkf2YDsu7qZ7/sBqpx+EZnMf5sISdqzq/s571UqkBSv:JZAf2YDsuWJsBQZWffoqzq/e16BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632121413, "uuid": "8594b87c-c0b2-4327-b1be-c8d0f28ef585", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632121413, "uuid": "a816ef70-102d-46b1-a46e-e052a50f9e5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632121413, "uuid": "d72e9185-4369-4baf-a885-5dd1519976ee", "value": "246f0c171734880af065ec09bbafe4fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5377db75-1a20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632148668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148668, "uuid": "d0f13772-32ad-4c85-a01b-64d3a858fea3", "comment": "Malware payload (GuLoader)", "value": "4c239a38e76b05caaa12a4954d183d08", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148668, "uuid": "c962b7dc-1d84-4c2c-9823-242ae27e0e25", "comment": "Malware payload (GuLoader)", "value": "f153db47ca27aaf4074f7bef726c0861747c865fdd81d6b6cf7cd30ecb3324a6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148668, "uuid": "115eb644-205c-422d-a287-311a16dbe2ad", "comment": "Malware payload (GuLoader)", "value": "c41ade49a53885fbe85b91f47a59edc34d04bec4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632148668, "uuid": "964c4441-80c4-4c89-8b5b-52746d9563c3", "comment": "Malware payload (GuLoader)", "value": "4e5553cbc385ed4bcfeaefa647f65964b087d6d2da4946b447059f96414aa536401816d1d0855e3dfb476da480da1aa3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148668, "uuid": "762be12a-a0fa-429d-a943-23c9f6cbfe93", "value": "T19623F13E9986AC479425D345102D924A8B32E4C3B80DCD1E967F8F81B854DBDBFA16FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148668, "uuid": "448622d5-9aaf-408d-bce5-51d8642b8b80", "value": "768:rh5KGCL+yKbl1JwNJGN/2QT6mQv0tAJrn7UvQR/1Ewm7zawfUxcNxKYzqtU4f6QC:rXKL2zGSoQT1mJJr7UvQR/Ow+z5ZiHpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632148668, "uuid": "b9e96a55-6041-4ac6-a56c-b5271452de30", "value": 46466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632148668, "uuid": "2a5b27d3-faa4-4d9d-b672-ce40a23464a7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632148668, "uuid": "56e46486-9828-43fd-9dfe-d1c96fd248cd", "value": "FACTURA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d48d25d-19d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632115935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115935, "uuid": "1149b33a-5246-4aad-8e0e-c00862de3851", "comment": "Malware payload (Formbook)", "value": "01b0dffa7c000f4d55544eb38f8ab238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115935, "uuid": "2b738c03-0b13-43ea-b4bc-c123548aaabb", "comment": "Malware payload (Formbook)", "value": "f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115935, "uuid": "e80db46b-62d6-49f3-b743-57b1544febc7", "comment": "Malware payload (Formbook)", "value": "cfa6ae5441f0c41d5d92e0fab0eb90b44e0d621e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632115935, "uuid": "d4d6a330-3894-4706-b56b-fd0dd82c9d1f", "comment": "Malware payload (Formbook)", "value": "c64304fa71c184420229d2d9ff193ebef37161f3c109ab900cf5ee02abae08cb9d521904bc6a2e14ce05675bedfa3413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115935, "uuid": "f9f46251-077f-4b83-ad0b-319633e16309", "value": "T19B55EE298D1682F7C7EEC63CD06C4F9EDB62AC837A618F0E9881B6D6167770BD18444D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115935, "uuid": "11f13e33-e22c-4631-b479-55d491f5fba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115935, "uuid": "72f325b0-4f53-4150-8d99-f5af5c723cf9", "value": "12288:5pYu9DAwfA8sL+zAFIKGuGr54y6oe9xNY4XCQFY6MkP7r9r/+ppppppppppppppZ:5pYu5APdKzAFbGT6yz4XLFYfk1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632115935, "uuid": "487cc77a-5f62-4c91-82f3-294bd74b6c17", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632115935, "uuid": "930fbfbd-a4c3-437e-981d-8e2066ff6265", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632115935, "uuid": "429c4da7-0986-45c4-95c7-e680d333c5de", "value": "REMITTANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba3c9ec-1a05-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632137005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137005, "uuid": "5b74e30e-7097-4973-ae96-e55703f17186", "comment": "Malware payload", "value": "a1ea89a947786cc4506b2260cd907da9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137005, "uuid": "cbf38076-2dd4-40b3-8bc3-c714887cd675", "comment": "Malware payload", "value": "f15d735d5f92f808aa21bb751fe054b5c19f3aa9a7cb8be31cdbdfd1232bbd0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137005, "uuid": "b4ec71c5-981e-499c-a1c8-874114d416a2", "comment": "Malware payload", "value": "f84a6dc324d7855b82f5fc3d9ceccfc592a34426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137005, "uuid": "eb7054ff-713d-4f69-b4f2-877df0fde3e1", "comment": "Malware payload", "value": "ec5e7aa50436f686c07f926a1759b62dce1a0f56b37be6f5f0125a6476fa0b8f0736f8c2261bd5825539708fabc64ab9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137005, "uuid": "a3f927e2-0137-4ac6-90c1-61862fe82cb4", "value": "T1ECD3A277415180A9C6481738E4670F4B2D69DF38D958B2CC704AF2BEB93968F89FC3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137005, "uuid": "87be1ca6-1fdf-4467-83d9-ea7467fa8d96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137005, "uuid": "9635389e-760f-4415-9cf6-04ed2003011c", "value": "1536:/dX4IbiSBttbRjGlJjVwkEDospmefqATBRDMRm/o5yxoMHwZ:1oIu2ttwlJjVdEDXpmefj1KRmSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137005, "uuid": "4076bb2c-fbbf-4b22-a67c-682619b716cc", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137005, "uuid": "c561d1e0-01dd-4e21-969b-a97fd05e1e33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137005, "uuid": "8103a37f-908c-404d-bc78-e1b5b9e5d100", "value": "a1ea89a947786cc4506b2260cd907da9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cac8b90-19bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632105331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105331, "uuid": "aaa85089-19a8-4b04-b33e-aca559e230db", "comment": "Malware payload (AsyncRAT)", "value": "6f480b22cee012d74e36fc5834177a08", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105331, "uuid": "1b6573f0-725d-4d45-9dd9-6060303076a9", "comment": "Malware payload (AsyncRAT)", "value": "f1a9e938272f47067bf88f71592636f49f069530f2d727ca555ccbb8c8fb1500", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105331, "uuid": "011c752d-66ef-45fa-921d-43da03d28bb4", "comment": "Malware payload (AsyncRAT)", "value": "a5d2d12cdc9748dc9ec2f11246246d15d4a4445d", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632105331, "uuid": "318db969-d000-4b14-bfb6-84ec3daa5752", "comment": "Malware payload (AsyncRAT)", "value": "d0e298ff993d3c3ba2976b191d20ba237dfd219da704dd655dcd4182e9de29685688ed8ea3386e2dd698abc384cd505e", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105331, "uuid": "6e0a3460-9e64-40fd-a30d-f49db9e5e6b6", "value": "T14BE19D0E4D45B745CF29C875D3735F3A7268E439BDA9C78E2A04B64C31610821F490EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105331, "uuid": "7472581f-6dad-4d71-8dee-6217d700bfb6", "value": "96:ZEKr9NP11owoyaw43NGuX35b/CfNDwRbH2x3gcoiQrHdnJT5Ng0Rnfo5+wWgN7s:xrXP/og4cuX3h/+K2x3cLT9No5RWUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632105331, "uuid": "8e24547e-45df-49f9-939c-90f2207fb015", "value": 7412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632105331, "uuid": "01446665-6596-4ce6-be06-564b5ab700ec", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632105331, "uuid": "73531339-10b8-4d9c-92f2-005b7b938867", "value": "Documentos.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069f7faa-1a13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632142955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142955, "uuid": "21cd8a21-e977-4569-a011-ac9fd72e4a2d", "comment": "Malware payload (AgentTesla)", "value": "e49a2a5e3f753c5d618343e70f8e3cc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142955, "uuid": "9faf0586-29a1-45f5-94e2-5f0f963d9e72", "comment": "Malware payload (AgentTesla)", "value": "f28ac8258b51b85063c2a3e2745ced4f9731be08d9e907fb905486d38cbefb61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142955, "uuid": "182bf72d-2712-4cc1-a878-ed6ae9f2aacd", "comment": "Malware payload (AgentTesla)", "value": "86b59eb9416eeabebc3886e997d42599fe6f6056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632142955, "uuid": "88f94d1a-e871-4a80-b6ca-de5352665a42", "comment": "Malware payload (AgentTesla)", "value": "a11dcfd4c33e5d940d063b1cd7bc05668a0ce7b36dbea99008e3256e123f858fb8737227a49dbb4bba9c442e932cf044", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142955, "uuid": "e5bff569-4fb7-4777-8cab-25ff948bc8e7", "value": "T18805AEC17D47D89BF4DF1AB3986FC52011646E8D9161C73D2682BA2B65F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142955, "uuid": "dd611f94-559f-4133-b0fb-f3fbd569b5e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142955, "uuid": "12e9cdb8-4621-4d14-95ae-72b61e54ee74", "value": "12288:fo6smtiK5oCZqrZnQY1ZJeGl9WK5/MzVXGyFLqJn1sXYGQKF:M+FoZVQoZoGKKBo5GIeAYZKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632142955, "uuid": "b2b1ec0f-2a8b-440e-a0c3-7f249ad64e04", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632142955, "uuid": "ee26a181-914c-4577-a38e-b3e1f4687d26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632142955, "uuid": "8ad34711-9461-42ff-a525-95030fc527cc", "value": "All doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89af5530-19f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632129431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129431, "uuid": "2ba92597-7b58-4c62-ae1f-44fa60eb7b2a", "comment": "Malware payload (AgentTesla)", "value": "7dd395dafd4a1a40d360fb3412bd1b0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129431, "uuid": "c69f085f-82c3-49b7-85c6-a47959fab728", "comment": "Malware payload (AgentTesla)", "value": "f2b1bd47322d3f42b51f60dd6887fd2228ad14d1290f0853f5c20ec62ef14708", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129431, "uuid": "16ff998e-de29-4316-8d47-bb635fc80af6", "comment": "Malware payload (AgentTesla)", "value": "adba7d591301c18a916fa7e19cc2cf873d14c395", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632129431, "uuid": "e1b21aa1-c735-4e58-8b87-0c4eedba0917", "comment": "Malware payload (AgentTesla)", "value": "e798f4297d3e833c19c1c366f44aae1df3d1d730f4987d46a2de15b74d902b617d11f1a7aa354748055affa971962870", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129431, "uuid": "0747ac4d-a796-4401-a66c-3468c17f808e", "value": "T16805AEC17D47D89BF4DF19B398AFC5201164AE9D9161C73D26827A2B65F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129431, "uuid": "48f5d6d3-6bb9-4c1f-8b5a-2a25043a6e2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129431, "uuid": "ab50911b-2205-483a-87b8-25e727897edf", "value": "12288:JpHsmtiK5oCZMDBNJNl3Xa4rjLOEbE4b8RqG+CjPsGQKs:c+Fo3rTK4rjqEIiaqG+CQZKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632129431, "uuid": "9bd35769-cfae-436a-be32-c8d5ce17b705", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632129431, "uuid": "1c02d486-11f2-4db1-8e6d-e3e014b7e52e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632129431, "uuid": "cc91dcdd-dd88-4b55-a01e-edd3dd1cdf43", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ffaa71-1a21-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632149021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149021, "uuid": "d8e7f604-9a04-41b4-8114-e7d014a0e674", "comment": "Malware payload (AgentTesla)", "value": "7529b84656b95225fd9f6c01c1533977", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149021, "uuid": "3e413cb6-2867-4a73-b56c-a7603b7d83e5", "comment": "Malware payload (AgentTesla)", "value": "f2df3607d9bf52dea479cec85419189bebdf7030c4c6fbbaa7ee18e4996a3013", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149021, "uuid": "eda73df6-4a3d-4968-ad68-cf8f88e671a7", "comment": "Malware payload (AgentTesla)", "value": "056080371b3315a98b38675f4537f06ca42826b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632149021, "uuid": "fbd72ae9-914b-43d4-b9c9-1e00051d6d97", "comment": "Malware payload (AgentTesla)", "value": "78bed742b5e00f3ef469b567e5b3538cb63c8f8d16d833c451d48d4f4a0bc5479467e6957a6c0cde4348c4b161865f54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149021, "uuid": "aac0d4bb-fadc-4be9-86d4-c2f2f0bb625b", "value": "T18945ED694E2682F7C7EEC23CD05C0BCEEB62A4877A518F0ED881DBC6166770BD58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149021, "uuid": "98dae23a-9f83-41b2-a20b-a919e205b1a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149021, "uuid": "3166b933-952f-4700-98d7-08f0ff0dbdb4", "value": "12288:+3mVngSDODPRPuj6zkDdPLAnAdUKMoP06lre5VapOu//7DNPrdAA:+3mV/OF86yXdN06I5+3/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632149021, "uuid": "472867d8-8d82-4404-876a-8d7d1ab6712f", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632149021, "uuid": "1f8418c7-3177-4f76-b28a-bb56e0dd9b34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632149021, "uuid": "60431cc2-5929-44d9-90c8-8c52b36d8490", "value": "Remittance Advice sku10020109202021 - single customer credit notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af50702-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125568, "uuid": "bb3b6fa8-baea-4031-8ea4-ac84b0bd68cb", "comment": "Malware payload (Dridex)", "value": "02ea0fcc13762a4a06f75fb7198d0d7d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125568, "uuid": "21612656-2c30-49b1-91e4-dae5c6b594e4", "comment": "Malware payload (Dridex)", "value": "f2ef99869529e379b6e863ed91aeff02117694282b95d3f08a5de9c3e2e376ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125568, "uuid": "77322ab4-6165-43f3-acf7-184fbcd0310f", "comment": "Malware payload (Dridex)", "value": "bbfc662a34068d1d8d4ab468e1f7e222998cf830", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125568, "uuid": "14f448ac-aa8a-47f7-9974-0ef0ed3b8c4f", "comment": "Malware payload (Dridex)", "value": "58835731531fa1a41b3fcb1f77fae6c7902df94b866fd9a8f4037d5fd485525017525b32a071fed70c4f05ddd81f742b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125568, "uuid": "82a1b612-d42e-4e5c-838f-c200d741350d", "value": "T17A95D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125568, "uuid": "9b61b200-c21b-44af-89ed-fcca16601711", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125568, "uuid": "2741a529-7b8e-4c6f-b300-c28d2a081d0b", "value": "12288:NVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:UfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125568, "uuid": "955fd47b-f2d4-4693-897a-f54e5d67793b", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125568, "uuid": "294bef72-7381-44d5-83f2-e6c4cb1e34c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125568, "uuid": "340fe231-488e-4f78-86d9-1f03af27417a", "value": "f2ef99869529e379b6e863ed91aeff02117694282b95d3f08a5de9c3e2e376ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2240f5-1a6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632181004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632181004, "uuid": "dfd6c4b0-5fa0-476d-bb6a-8f0bd3b84c4b", "comment": "Malware payload", "value": "ceb3dd231090ce93da86c04e1616c305", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632181004, "uuid": "7ff06731-0c09-4420-930e-8419d8350caf", "comment": "Malware payload", "value": "f30aee9fe1c2ec902afb4b1c040401972139e841bd58d659f38ec124176466da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632181004, "uuid": "a84906d4-2a11-4a83-9395-ff04ebe170ef", "comment": "Malware payload", "value": "01652381f57757b9310d220c5403344902b4a785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632181004, "uuid": "45b11e8b-5a27-4270-8ecc-069246e2beb6", "comment": "Malware payload", "value": "af5839fd65cefe3594ad3d5c4c05030a6071dd43c5144f3f36ba73f1ecc8e27bdac2ef335dae297430333f21284af482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632181004, "uuid": "c624dc90-6ff5-4f33-a7a3-db0d9fa1a032", "value": "T190C3F1194BD82135EAFA8737A8E40982AF70F6175E53EE5F24C4C2125F83F4198A197E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632181004, "uuid": "ced03aec-7361-480d-93b8-b456b6ca8ce5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632181004, "uuid": "7737abaa-8880-4b00-82ea-bd440cc5b437", "value": "3072:SSpVKWFcn2bFGGfPXm0LcsTgSorsAlyY2F:SSjZFc0FG8PW0LcXlrs6yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632181004, "uuid": "2c72a99e-edc7-4d43-a00c-3437f70673ae", "value": 121456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632181004, "uuid": "552313fe-dbeb-4f01-a5d2-bd149fe9c1f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632181004, "uuid": "fd14e96c-048f-4ebc-93c7-b1c13d120dee", "value": "ceb3dd231090ce93da86c04e1616c305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fc904e-1a3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632160560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160560, "uuid": "7b91ddc3-d6d2-4e61-b0bd-611e9af34179", "comment": "Malware payload (Formbook)", "value": "1bbc9d68daddfbdb240d292ad00c3a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160560, "uuid": "a1f8dd82-d975-4fbd-b1b3-f258e43e10e9", "comment": "Malware payload (Formbook)", "value": "f35e37b873cb4bee71eab9a5caa6bc7bcb592d84b7924e83ec00a5c9058eb03b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160560, "uuid": "74b98967-d385-41d3-9111-e09ad096924a", "comment": "Malware payload (Formbook)", "value": "5a3a7e4891e4e24c5d3dacd58fcc6b8ccc02cda5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632160560, "uuid": "8e1d6085-e44b-4130-9389-fa2af23a0307", "comment": "Malware payload (Formbook)", "value": "04da6c8aabca5f29cb4ba316f17a3b6029813f20deec64a44db8ecd943b391556adbf43be8fedc1aef5d0ba3fcaac9c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160560, "uuid": "90100de3-8ec6-4a77-93bd-17f5cc607f8d", "value": "T181059EC17D47D89BF4DF2AF3986FC12011646E9D9161C73D2682BA2B55F331230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160560, "uuid": "eb6508a0-3c08-4db3-a80b-3698ce795d99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160560, "uuid": "cc0d7098-4034-4078-ba7e-6348dc0b62ee", "value": "12288:T5MTdPKMHasmtiK5oyZPHoUFTChoUVmMSU22v9KlSb+ASN:iNx+FoUI4C2UaU2xRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632160560, "uuid": "c2b0eaae-807b-4bbd-8678-07bfe20d83ea", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632160560, "uuid": "2d20ddc9-0999-4cae-890d-2d2a26d8230d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632160560, "uuid": "fb30dc11-d288-4cbe-963c-5e84d5617bfe", "value": "1bbc9d68daddfbdb240d292ad00c3a50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d75acea-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125572, "uuid": "c88a767a-12ea-4957-a28a-33e66c0f14a8", "comment": "Malware payload (Dridex)", "value": "215b2f947a6bb49a8a74879338b00302", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125572, "uuid": "ebc4a4c8-253d-4da3-bfbe-317ad0fe2c07", "comment": "Malware payload (Dridex)", "value": "f5202e8b2a578db22323e9f31e8db2880c12da4a2ae41501a99a91396f3566f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125572, "uuid": "eb2eaca4-74cf-455a-a3b7-7c7132a45d35", "comment": "Malware payload (Dridex)", "value": "65b107212af58baa7eba914db9db04c0d55fee98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125572, "uuid": "cfab120d-21a0-4b3b-848b-5e82e3702795", "comment": "Malware payload (Dridex)", "value": "c617395fbc1ddc78ea939bf11c9b693dd92e139decbca90d98b9e095833aba320984918de1e31052d73be39772304d50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125572, "uuid": "a0892482-9542-4271-933c-811e755efaae", "value": "T1D495E020EE69E1E6C6B89F3E9408352727F93D75110D618CC392704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125572, "uuid": "b9ad7624-a00e-4c62-9a9c-cdaad11a8807", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125572, "uuid": "b8b7bda0-a50e-4340-82d7-591cfb668429", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125572, "uuid": "fccbbdf2-6cdd-43cf-ae7a-65388d33535e", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125572, "uuid": "b49bdadd-8676-4d4f-b1b7-0f8d7aeae1a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125572, "uuid": "0c59b081-96b5-4ae4-a070-e29b6a547153", "value": "f5202e8b2a578db22323e9f31e8db2880c12da4a2ae41501a99a91396f3566f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b3f5d5-1a28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632151975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151975, "uuid": "7f024e94-7197-432f-b022-b041b445b10d", "comment": "Malware payload (AgentTesla)", "value": "4ed51626e6e82e88c2913ef09333e0d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151975, "uuid": "4b6fb4ca-082e-4665-ad44-7cbc60040ed4", "comment": "Malware payload (AgentTesla)", "value": "f53e75831220306af6240ffce3e4a9e9b41d0f344bd22519d497047e273e62d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151975, "uuid": "540e569b-db71-40b6-b5e9-b3528794eaae", "comment": "Malware payload (AgentTesla)", "value": "26e0a2ab4c1cccc3a61bd61486a210305f10fa06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632151975, "uuid": "68ba98d5-f3ee-4631-afb2-d35f31713560", "comment": "Malware payload (AgentTesla)", "value": "38e93d27381f1fdb410a168345b56732ee35f17c412113eaee021cba957c01e3e4ddb6c777a6f6d0bb36013e5662c643", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151975, "uuid": "753ffdda-2dd1-4346-b29b-e2870ef43a15", "value": "T118D4F1EF5084E657EEA9227D795D4190B2E8CC820F66F573CBBC75E16834F92094A0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151975, "uuid": "6f752957-0cda-4ace-bee9-8704d5a3d64c", "value": "12288:9NHXHrfvUXFo9shgXKfD4Sw/uGH0OO+3SouQGuusipTbM6mJpJL+9F+OQKCCq48D:HbfvUX+ye6D4Sw1UZeuuTZDc+vBGztY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632151975, "uuid": "bfe168e4-b6ed-4f59-91ca-2e7f99aa0429", "value": 602088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632151975, "uuid": "4ce17e19-7e52-4555-9530-db08ba013828", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632151975, "uuid": "3c70d85d-1686-4a9b-8935-efe6254a7ca3", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde8ef8e-1a67-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632179448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179448, "uuid": "f95f0810-e7d6-49f7-ba69-3277a54ef245", "comment": "Malware payload", "value": "1e900aebfc28ab3a18d98866927b2079", "object_relation": "md5", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179448, "uuid": "08576344-6631-444e-8673-f1e0c2cae425", "comment": "Malware payload", "value": "f6d8f9dc498e64cccc4c16f817300f6bdd55ffe8989da7a4b69875715824957c", "object_relation": "sha256", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179448, "uuid": "7ae0a0b6-5c46-443b-a6b5-39989b8834ec", "comment": "Malware payload", "value": "308269e1505dec96e7416a9d58cb44720627aef2", "object_relation": "sha1", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632179448, "uuid": "657893e6-7ce1-459c-a93a-253d11632ec9", "comment": "Malware payload", "value": "054ffa34123b32d1c05e5aec4577ed408bcbde943f9bd2772f3640b49ea9362f2b990d6923707cd91352803df633dbbf", "object_relation": "sha3-384", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179448, "uuid": "3f0add9c-f59a-4e76-8fb1-d9c9a0ffb224", "value": "T171C4D62129FF104DF3B79B3C4BD8B9AF456AF773261A60B9207056498B22D82DCD1739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179448, "uuid": "cbfee925-77c1-44f1-a9f7-4c341c1ae837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179448, "uuid": "eb0514ef-74f7-4934-bd9f-62f48c3bb7be", "value": "12288:E6PRZ8QQ6D02tdBfrIEZNt1inj56wgVMkZW7zy7nzo1NmN8a4jpxE/P:E6/1Qr21DIEZNt1injHIMkZNonmN8a4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632179448, "uuid": "bcff48d5-acb2-4fee-9327-36d4871e14ba", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632179448, "uuid": "b002515b-3a71-48e9-aa7a-c7c4042043ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632179448, "uuid": "a2cc5b5a-2d96-4e61-a240-eb1afae789e9", "value": "4eltts5z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d289033e-19de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632120534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120534, "uuid": "fff75266-ca45-483f-a02e-e93b74fa47e7", "comment": "Malware payload (Formbook)", "value": "d362ffc6b594c617852f20b87ab4bbef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120534, "uuid": "d9937f4a-7294-4397-b153-8d577f4b26d6", "comment": "Malware payload (Formbook)", "value": "f7031a211f3a084ce9b215e9faf438125d11cf1daf963b9ec0d994a66dee6df0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120534, "uuid": "9c31056a-d756-4b40-bb8e-20f685f4dab6", "comment": "Malware payload (Formbook)", "value": "ddac3d55f51641552e3a13ce66398320fe29ec15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632120534, "uuid": "b23f1bec-8317-48e4-b5a6-0e71571f6645", "comment": "Malware payload (Formbook)", "value": "28c80b4ab772a2c58eccd623585ef8838aed719a80a0b572be5d58f5f6f983656952377bd107110784ff2d2b75bb581d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120534, "uuid": "ade5026e-04a2-4995-bbfd-ee086b465375", "value": "T15EB4AE243DFB5129F0B3AFB95EE074869A6FF6233A17E45D1451038A0B23B81DD9173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120534, "uuid": "015b871e-0575-48f6-8f08-3c19cbd2a2fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120534, "uuid": "56de5bb1-2e5e-4b62-87db-ee5848efcf7c", "value": "12288:X4k4DbF53e0IUFLK5QwEz+903isUwVu09nqYeJ2VCjWiJ:COVEz+9pRiu09nqHoUii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632120534, "uuid": "9236c614-7dbd-4aab-8d3c-e7814562c215", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632120534, "uuid": "b584710c-2d29-406c-ba08-78645a6544a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632120534, "uuid": "59abca5b-a495-4236-83fa-6cc178306d95", "value": "d362ffc6b594c617852f20b87ab4bbef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c294d90-1a2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632154749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632154749, "uuid": "90e0f73b-9af0-4c07-8092-50ac9ac02062", "comment": "Malware payload (Dridex)", "value": "391e6713774c5b62da0192b2ed750d23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632154749, "uuid": "0da19c3d-dc0a-496a-a467-912ddf0e3fab", "comment": "Malware payload (Dridex)", "value": "f741706a28ffb9b56adc15f4e4dc6f8d29f5982f1f987afb127ef4ff26043373", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632154749, "uuid": "83ee9db7-800f-4b92-997c-7cc037c2f4c0", "comment": "Malware payload (Dridex)", "value": "61607735b6189025056f6b00283029f23637dc88", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632154749, "uuid": "ea32e106-c8d7-4b76-9828-0f780fb6b912", "comment": "Malware payload (Dridex)", "value": "6b2e3aef6741a9a5d54f3cee5e02afbaa480a971ab7192f65f923d4660ca6861bdb0346b02a1bf3c10b65fe4a13ea735", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632154749, "uuid": "a5a13482-9fa0-477e-9e8e-151db6d35533", "value": "T1F914D04BCC8A44DDF6363C366BBF2D7A5F2E07214A28DC29CF54D515AC2370AE45A1B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632154749, "uuid": "8946bb53-c2ed-4c87-af57-d6a58e336f5d", "value": "2640864aaa54b312b8f622402aa35be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632154749, "uuid": "390fd136-dc7c-43d8-a81b-03fac93ce946", "value": "3072:iCbhexUt6JzasssssssspciikZxitibxt1JQA+ONSfqJ/DkBD87dI/lyYZvCsssX:iihe+lKibx6isqJ/DkB47QlyYpBxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632154749, "uuid": "d000f0d1-727a-4ecf-b207-4c84330f5cae", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632154749, "uuid": "29552676-72c5-4910-98ba-edc33833366e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632154749, "uuid": "a31f9a04-aaa9-4722-af18-c84cf2daf4f3", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654f3448-1a07-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632137960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137960, "uuid": "3d63a93b-e1c1-4ef4-a14f-a76d30ab9361", "comment": "Malware payload (NanoCore)", "value": "455b2612824ea479902e446f2197c2d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137960, "uuid": "5fe43773-bf47-457d-84c7-a14a1fb956c4", "comment": "Malware payload (NanoCore)", "value": "f7531173cfb1295eb071081c501ce1c8f3273576edab78ae993a18ce2abc0674", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137960, "uuid": "7c130880-8bf7-4de9-b95c-fdc07d7c1715", "comment": "Malware payload (NanoCore)", "value": "85b7a71bff95999bade5a2ed373c98d301b79196", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137960, "uuid": "8bc5a585-484e-4bf5-ab37-59450dca8e79", "comment": "Malware payload (NanoCore)", "value": "8b6bed71b2f6a85f50dd77370913d3e8c44b5d211a423e8431c0213d5be0eb7904f4d3ecf84209c75d5f6fa3617cb959", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137960, "uuid": "bc01d7a2-a981-4be7-bbb4-dcb5ecdf878d", "value": "T16F340DE4688F44B2E6488C5DA494B148AD74FEE334CA887153AFD435DF59BF2AEC4083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137960, "uuid": "e3fc34a3-e4e9-4271-bed0-c9af88dbac8f", "value": "1536:ixFHYWB6IWEp6aSJIOA0RoBNJTloJRR0ss2wdzFz76mAg5eeVhMDw5wfL7:ixOWgv6ss/dzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137960, "uuid": "164f90cb-a057-45f5-b449-fb8019a2723d", "value": 247316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137960, "uuid": "4ec8d95b-828c-43e4-ae52-9b1255fe10dd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137960, "uuid": "35e059a4-b2d2-4302-86df-adc91b544382", "value": "IMG_Order SPECIFICATION 094765 img.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88638889-19d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632114826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114826, "uuid": "84c570bf-1c16-4162-8f8b-2c02dfb71858", "comment": "Malware payload (GuLoader)", "value": "2945970fef6e09b9e0b05848da6ce7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114826, "uuid": "0ba0215d-ddfd-4aec-bad7-48aa502fe861", "comment": "Malware payload (GuLoader)", "value": "f79513206372f701b84e5be141882aaa08828b63ab7d953e46e35f0ce942b4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114826, "uuid": "5549fdaf-02d2-4f27-a6e7-aa6aefb91802", "comment": "Malware payload (GuLoader)", "value": "fc596bc139a8b193197c9a1e4bda6822233127f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632114826, "uuid": "943ceb41-ea38-4132-9d35-ed2c6a375afc", "comment": "Malware payload (GuLoader)", "value": "fdd6c3108950769f25771efd62f72e6d5706d0133f9efb9ab4eb35aa665c3c5a93a7a31bc69e3e8e1ee07feb3b504635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114826, "uuid": "50283c2c-e94f-4ba4-84ee-2e3bbdd53bb7", "value": "T1E28428A434C1D09AD724E671D799CD642779EE34A8313E2BB0C1B7ED35B25ACD78222C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114826, "uuid": "dfbdcda8-deba-4b50-95a0-ed0bb5037ee2", "value": "6c79b3884460dc3163c2965c3260d4c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114826, "uuid": "eed12f48-b9ee-4622-8d34-0acf9dd40dac", "value": "3072:vjEOu4+UTIha+zlum0xwkscSJCsH0HLUH9wA4B+Yxzth9H4HEruyxRs0w/iE2uu/:v9uthzzleOUrTB5YkCQRsaZOUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632114826, "uuid": "db8e1022-648b-4c2e-8ccb-98e636a3ba8f", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632114826, "uuid": "8e92f517-8377-4ffe-8921-feb687e90955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632114826, "uuid": "f88a0944-b4f9-45cf-9eab-2c90231b373a", "value": "ANMA01101_85746535648163553537635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2513ec-19f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632131315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131315, "uuid": "fa1b95f6-f19a-4489-8783-67c03a580371", "comment": "Malware payload (Formbook)", "value": "fd859a818ffb68aea0495950ef65cd5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131315, "uuid": "5bbe105d-705d-42f6-bfa3-5a08fe3b76fc", "comment": "Malware payload (Formbook)", "value": "f8165688719f90b1ba956beb5f04d5aaa4afe8772fd38469f5a29efde6124546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131315, "uuid": "8aeada10-3723-4856-8858-37cfac5d5b02", "comment": "Malware payload (Formbook)", "value": "450ec0db42f16912b5b07bec99a721f986eba65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632131315, "uuid": "09592f90-2587-4c35-b0a1-2a08e9102977", "comment": "Malware payload (Formbook)", "value": "bd1b24ee4131a8af6137e5bf514ec9882b045ada23de7aaecd5d76c0a7dabc6cfd3eaa87fc07d9d047f9093ce1ec0f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131315, "uuid": "67132c81-ca90-418d-9a18-8d132d648ca9", "value": "T10A05ADC17D47D89BF4DF2AB3986FC12011656E8D9161C73D2682BA2B55F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131315, "uuid": "82db2057-089f-4eca-b5ee-edc197a0272c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131315, "uuid": "cbcbacb7-3937-4074-8033-a55ebaf29d07", "value": "12288:65MTddGQZsmtiK5oyZI2vAnJ3V65MNcpVm7kodtnQW9wNzKASN:d0+FoJqOyjVInQWgzKRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632131315, "uuid": "aa13c2bf-89e0-47f6-98b6-b96d9b4c0ae1", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632131315, "uuid": "b1b4b231-8afa-4c80-800b-8d1b0df3f6cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632131315, "uuid": "bb67f455-91a0-4adb-bb81-e64f02deea43", "value": "Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b840325d-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125215, "uuid": "d9d6770f-19a7-42b2-abc4-93b4c1780d05", "comment": "Malware payload (Dridex)", "value": "5ffbcb3d831183b03e71dc9b47c3f64f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125215, "uuid": "54c60a9e-195d-4e5c-86d9-be76457e4bc0", "comment": "Malware payload (Dridex)", "value": "f81afa64309d297a1b1d397aaab952004ef8cf5ccaeef297849d18741d463217", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125215, "uuid": "ef346791-a017-456e-b783-3d3b9ec6f921", "comment": "Malware payload (Dridex)", "value": "29834e6925473bb7995b6c128b38cbc7e692efa6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125215, "uuid": "84effa6e-6c7e-4344-9aaf-35adc5b791de", "comment": "Malware payload (Dridex)", "value": "354f4ab08000c897bd90c8530241de83fad7bc6b97584ea512ec7208bd75a4dc2547c592d09095092613a16928756015", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125215, "uuid": "19bb38dd-deb8-4390-80ea-c83d654aa04a", "value": "T155A5D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125215, "uuid": "599f2f8d-3087-4721-920a-118c86f39b05", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125215, "uuid": "79c13c81-eaa8-4b01-9e02-ffffe3727a8a", "value": "12288:5VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:4fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125215, "uuid": "8b374849-d435-4a04-a062-ebb6c4ffe724", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125215, "uuid": "4c576b7b-5d6f-4801-81d4-329ed6fcbbc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125215, "uuid": "891700a7-7e7e-47db-950f-6e30135daf14", "value": "f81afa64309d297a1b1d397aaab952004ef8cf5ccaeef297849d18741d463217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b00acbb-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125595, "uuid": "5e969313-834b-4bb4-b49f-02700b868d8b", "comment": "Malware payload (Dridex)", "value": "20f12888765fec30dd3ecb65916953da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125595, "uuid": "e13bb965-a6e7-4f40-aa8d-f956bef40b0a", "comment": "Malware payload (Dridex)", "value": "f8523b8e4235887966bfcee19f70de9877ac89332a636588e6c505a08613568e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125595, "uuid": "768c961f-08cf-4c54-aa77-a96c3d6eadee", "comment": "Malware payload (Dridex)", "value": "c63e90b9749d542c46f465c3fb9408a074737da5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125595, "uuid": "1bc1f67f-ffac-496f-bf71-fcb52f927933", "comment": "Malware payload (Dridex)", "value": "8627b92c96a0ef92683baf4184742aa04a2f1c1126dd271f2450c1676f2304d59d6a0b6d17746aaddd57e322349e7418", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125595, "uuid": "b6f4fe25-0c64-43a0-9d67-05948beb581b", "value": "T17F95D020EF69E1E6C6B89F3E9408352717F93D75110D608CC392604F5EF8654AE3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125595, "uuid": "944c54f1-761a-4a15-9d06-f3a1e1772719", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125595, "uuid": "6a6170e8-f640-4088-81c5-71d0e622d2ff", "value": "12288:6VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:nfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125595, "uuid": "8d07aa36-9ebd-46fd-8dc3-41ba1fb8f28f", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125595, "uuid": "fc45e255-d0c5-44c6-aa07-35e025797051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125595, "uuid": "6dc5dce9-5c1a-48c3-9f8b-f5da0a0e9133", "value": "f8523b8e4235887966bfcee19f70de9877ac89332a636588e6c505a08613568e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0763656-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125228, "uuid": "444bc08a-2782-4220-b431-b8c0210c7968", "comment": "Malware payload (Dridex)", "value": "26a1d6cc17fdf294669ac90a7a9926e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125228, "uuid": "75962fc2-7215-4a8b-9b8f-75e6ae88013c", "comment": "Malware payload (Dridex)", "value": "f8b392db25f9936a4979c0703538631925d603fe033c88b54f84afaaa613c3a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125228, "uuid": "f37e57e2-b8f9-4718-8110-d302f8ff2cb6", "comment": "Malware payload (Dridex)", "value": "1297a0c8660ec25b3cfe07394c2be181caa0d05d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125228, "uuid": "ca6d3504-b924-4b72-9a44-e0f7ca319489", "comment": "Malware payload (Dridex)", "value": "64188eebab2acc916c6b9584c1af122cb28454d1b839c1fd9f49e092767aca73aa7144c41526ace532d119f5b6bf298a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125228, "uuid": "f904d6b7-c98b-4783-98ef-fac2e8a669e9", "value": "T17DA5D010EE69E1E6C6B89F3E9408352727F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125228, "uuid": "23846600-bad9-41b9-9b2b-6528406ebd9e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125228, "uuid": "d0094833-7e04-4e27-96f7-e7d3889c2f25", "value": "12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125228, "uuid": "58e4d159-90fd-4141-9a96-3d749fed696f", "value": 2129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125228, "uuid": "001cfc18-af7c-4779-967e-e11393fe3017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125228, "uuid": "322ad6fb-283b-4edc-be32-0cbd12d9d408", "value": "f8b392db25f9936a4979c0703538631925d603fe033c88b54f84afaaa613c3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e3f6ee-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125373, "uuid": "1b8a3820-abbc-4523-8db4-7a983aa963ad", "comment": "Malware payload (Dridex)", "value": "5bc4f1d785f44d9b21bd456682b29daf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125373, "uuid": "946f79a6-b812-4c64-8e92-a4b5c64dda52", "comment": "Malware payload (Dridex)", "value": "f8d4c0800aa32a9c6433c1366502cbc3d0bc7bcdcbfc5c9cf364da43563b632b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125373, "uuid": "e84111f7-2bce-4925-ac0f-408cde043e01", "comment": "Malware payload (Dridex)", "value": "51984be97561dc7174130cd9f205ba649ab2d180", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125373, "uuid": "01903d85-afb7-4d3d-aa6e-30db1f2a1d32", "comment": "Malware payload (Dridex)", "value": "90ce5fb80f08c698e94a85f0ca810785611ac2158de3077ba4faafc24135c01eab6c4dae26583d9361daaf575d8f746f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125373, "uuid": "47109379-7102-465a-a0ca-defbe4bf4b21", "value": "T1A6A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125373, "uuid": "33d09c50-67ec-4171-86db-0056c318e1eb", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125373, "uuid": "2e225bde-ad84-4290-973e-ea2d8c986404", "value": "12288:uVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:zfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125373, "uuid": "41567259-18d9-459d-bcbb-45dbf9beb30a", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125373, "uuid": "23435aa2-b51e-448a-a4e3-d918a99f7382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125373, "uuid": "fb13f392-304e-4737-ab0e-d300422ee4f7", "value": "f8d4c0800aa32a9c6433c1366502cbc3d0bc7bcdcbfc5c9cf364da43563b632b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d93d299-19e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632122969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122969, "uuid": "8cc434da-3378-46e4-a8ad-b0ca6d379ed4", "comment": "Malware payload (CoinMiner)", "value": "2814d4305c6694071a326efcbd55c3a2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122969, "uuid": "b9fb66a7-b347-4611-b80d-47536041cf7e", "comment": "Malware payload (CoinMiner)", "value": "f97732ec57a865e9740251bae169db88deb546f1eacae127658867a35f95b7c7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122969, "uuid": "ebf338bd-b21a-4c15-9b93-069929333e5e", "comment": "Malware payload (CoinMiner)", "value": "e221e33e99e952d40fe525961759c4f507315c6f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632122969, "uuid": "b6e8dac1-3daa-43b4-b3a7-fde65f6bede9", "comment": "Malware payload (CoinMiner)", "value": "d0e95c0ba69f07ac049644abc10024bde96a6a37d46a066867d16ae7be48c2e5777d4ab8c17475bbe46eb535dfc24f05", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122969, "uuid": "cfdbdc45-6a83-42e1-90f3-f6a5a81083b9", "value": "T10654CFF61A50CE25FDF5893252B6CA144A7ADD063920E93BE5C8708A5BBF3874F435C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122969, "uuid": "75eb5ff1-96f3-4f90-b7e2-b6647caac43f", "value": "6144:zvuWKb3LDaINbAPD2XGf1KHKUaHgIXIGDZVA0ckae++5T8:zAarTdK9LqnHckae+8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632122969, "uuid": "31b9507d-ced4-4154-80a7-02e540bb19ec", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632122969, "uuid": "44376673-d90a-4511-87f9-e00f5f9fe952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632122969, "uuid": "bda3e95e-0f40-45c9-84d7-8335ffb38d5e", "value": "2814d4305c6694071a326efcbd55c3a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e235aec7-19a7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632096938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632096938, "uuid": "62399457-1e85-4c44-b67d-9521e463cb88", "comment": "Malware payload (RaccoonStealer)", "value": "41a0bdf02b95802996d73fa30154fd95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632096938, "uuid": "a33c936d-7fc0-4a20-bafe-c271fd2885ae", "comment": "Malware payload (RaccoonStealer)", "value": "fa387cd1b39abc702be4ced41227bf752bad3b17430b3843a471dbc38a07c54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632096938, "uuid": "3da11da7-6e99-49db-b5dd-92414bb483ff", "comment": "Malware payload (RaccoonStealer)", "value": "28c11d867f4c17e1cc64f76be80574f95269916b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632096938, "uuid": "e18141ae-defb-424e-bfaf-d9dfdf194dd6", "comment": "Malware payload (RaccoonStealer)", "value": "997da2df446a5b9bb0a13db21e48a05966bfe17eee5b2c7e5ac0fbd7be591b2b022b84e5c7a91df307c9de8d6791ecc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632096938, "uuid": "2e01f767-bf03-424a-9d53-8449d565f202", "value": "T1C3048DD17983C87EC49ED5F004618AB52B75A8615A04058FA7A43F6F2F336E342FE2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632096938, "uuid": "11e6c221-2586-424e-9a0e-7eb66b3aa6ac", "value": "d1727cc76cb77410e59de4eb81f68a0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632096938, "uuid": "3c613bdb-1d5a-4410-9200-8a8c151448f9", "value": "3072:3LEo4ZQX3nngrc7+3GTxW9I9yl3h4kC6R8y8a4ROQlCZA9:3LOo7+2Qu9yYVyOROUCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632096938, "uuid": "fccd9784-3750-43ec-862c-e98b36879e47", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632096938, "uuid": "11767a47-9f8f-451a-86f6-8b1146e32dd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632096938, "uuid": "179cf4ed-0390-4e6c-b4de-e42c53a8af65", "value": "FA387CD1B39ABC702BE4CED41227BF752BAD3B17430B3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9da0c0-1a49-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632166182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166182, "uuid": "dde98abe-56a2-40c7-a6c9-dddb5215210f", "comment": "Malware payload", "value": "292614b86c9abbd7715ca37500f8da16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166182, "uuid": "35e5a797-2546-4786-9cdb-3299d9d792c8", "comment": "Malware payload", "value": "fa87c1477f566e729a6dae6517ec20964005f77b063345201eee6bf6b9e1e8ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166182, "uuid": "db2abcbc-e0b7-44e6-97ab-c746becb372e", "comment": "Malware payload", "value": "a7b4499c2e6c320e5f4b6836e409627a3e4a1135", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632166182, "uuid": "2360448d-9b94-410a-ac6d-11d1a93fd3a2", "comment": "Malware payload", "value": "8fc9ed84098aa8aeae41f2225e06a981e34eec1691fa95a355b3a823b62b199ac3c8706f3e8fea54428ceb6eb806d875", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166182, "uuid": "04b16411-cc00-4bf0-a6f7-08f9573c134b", "value": "T1FBB4CF243AEA9019F1B7EFB55AE07692DA6EF7632707945D109003CB4623F80DED163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166182, "uuid": "a9574507-7d7b-4945-a07a-abd2d0692e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166182, "uuid": "ac1c4a50-06c7-4e06-902b-89d51fd67af8", "value": "12288:oThpKN7WHCM2K4CC3I5XILgodH7uEQVttSwjCEKzc7UWU:oTnKP3CcI5IJdbSV7SQCFzDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632166182, "uuid": "d11016bf-fb32-4b8f-a572-9416834304d8", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632166182, "uuid": "0fd27d25-0b9f-4ea7-bab7-0270f8faebf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632166182, "uuid": "8793ca2e-d51e-479f-87a3-d675204842c8", "value": "292614b86c9abbd7715ca37500f8da16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2ddc5b-1a13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632143260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143260, "uuid": "c8f7a513-dc54-4a62-9fdd-12ae26dd0c9e", "comment": "Malware payload (Formbook)", "value": "4b318e66b016aa38e7420851c737b268", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143260, "uuid": "1922bbbc-9531-4763-bb0a-4c8ab7dbcff9", "comment": "Malware payload (Formbook)", "value": "fa9bd0ededa6a35bd948c884848855568c1efd4e77bd2ca7786144f81d3f64c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143260, "uuid": "e860eed1-5b82-416f-8757-f3e294446ae0", "comment": "Malware payload (Formbook)", "value": "b137bba06c4493f15889d75c2eae61205038d420", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143260, "uuid": "b75ce865-69ad-4899-8adc-c169d73e1e7b", "comment": "Malware payload (Formbook)", "value": "fe0e160a5f1b0d0c442bed1aa752963433b7e2bb44951cc11287343d2c49556fed835b79d27d146ed46de292eaa4dacd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143260, "uuid": "d9f253f1-17f3-4833-8261-0a8325df8beb", "value": "T143059DC13D47E89BF4DF29B3985FC5201161AE9E9161C33D2682BA2B55F3312316BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143260, "uuid": "e36fe51f-d2a4-4376-ab2f-cf5f2bb204a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143260, "uuid": "3ea6e1c2-566d-4d62-8f23-5e4f9d3bad95", "value": "12288:QnEsmtiK5oCZXzZF44/PYn7FgOX9i3cbfJ5AWCLE37qAs4LbyGQKq:Y+FoMM4/qFbXM3IUWCwqAfLOZKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143260, "uuid": "1f4391bd-4137-4d2f-b948-9bcdc0ba39f0", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143260, "uuid": "fc04dc56-736f-4ebb-bf42-7a84f7f64385", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143260, "uuid": "b1a75742-ddee-451b-9b15-2207dcc20694", "value": "4b318e66b016aa38e7420851c737b268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71550ff6-1a14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632143564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143564, "uuid": "3018bcb1-c2e0-4918-8148-0c963b76dbb3", "comment": "Malware payload", "value": "d98829007b35b3fdf1ba4d51683c61ce", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143564, "uuid": "a6539839-6de1-440b-98a4-c5336033069d", "comment": "Malware payload", "value": "faf82ad0f5b4e20f93e8eb1c169eea19e65fb9540b601e0aec84b805032ce527", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143564, "uuid": "92183237-c827-47f5-b165-9238d6e4f423", "comment": "Malware payload", "value": "3211bd89c4ce58c778b1b1a31cbf1be3b3773c25", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632143564, "uuid": "a5f46d0a-f5f8-4e54-b03b-8c2531c3542b", "comment": "Malware payload", "value": "3a177b640326f234a882766a60c989a4596c213ea6acab6e9e07194a98803e7600fe6476df3cf85537be34cc0d1ce004", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143564, "uuid": "7f506beb-3c90-4b29-998e-b9d50973db2f", "value": "T19592C61FE01F9AC2AA13E0E762F40BB0A6706C709526D1E8DF7D5C014EF56DD8FA9168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143564, "uuid": "c9bf4f9d-4d1c-4db2-b894-ff35a1fe71ec", "value": "384:NdV0RgcI+3X5M8DZF7w5o/E6gTrkF9FpQEc3R0N4x76q2cvB6BeQEc3R0N4hFoQz:N/0K+3X5M8DZFE50009FpQEc3R0N4x7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632143564, "uuid": "0a08ca27-d1ce-4cf4-9fa3-b7d27aa84e0d", "value": 19483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632143564, "uuid": "3c1eaa2d-edbe-44e8-af6b-ededaae01434", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632143564, "uuid": "052bcf11-7f42-4c75-b573-55d057dd3ec2", "value": "cbnfdhn.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcf0fc1-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632146299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146299, "uuid": "b4b504f1-73a2-4baf-b05a-09b7a3cf1de6", "comment": "Malware payload (CryptBot)", "value": "c49b37ce3e6c20d31fca535f5dae3923", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146299, "uuid": "956e4694-5137-459c-bf0e-07bc04773900", "comment": "Malware payload (CryptBot)", "value": "fb044b65aca85f2778a512ef1a48d4d3d2807f0e6d3e82a038ca39f6e37b6197", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146299, "uuid": "01e70700-0c3f-45c0-b45c-d1d7cd7bbe8d", "comment": "Malware payload (CryptBot)", "value": "f5d9a0e67e5867975f8a877f94c0e095e4bd5dd8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146299, "uuid": "74902e05-e1c2-43b9-8eb9-90c5bd195188", "comment": "Malware payload (CryptBot)", "value": "0559f0ab7c05e49903ce282e2bf81e1877c6306911795ffacab78f9b2995b3d5ba6299f91cce4a1ba07777d1776ab797", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146299, "uuid": "41975fc5-a0b9-4773-a041-406b50432e33", "value": "T1D174AE20BBE1C035F5B712F45ABA93A8A93D7E716B2051CF52D226FE66346E49C30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146299, "uuid": "cfc98143-cb19-403f-9e72-72b9c5db0d9b", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146299, "uuid": "c869343c-fb97-40fc-aa19-95d9eb7c843a", "value": "6144:z77jMWuO1QIRKr3qDQSWFqp2CcVBJnK5xs5jgDVo11gvxTOsSh:ffEO1QmKrePWFqpfC/K5xsIVQgvxTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146299, "uuid": "40d086a8-dfbb-4ab0-bddb-9302c6102dfa", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146299, "uuid": "e42234a6-0ee1-4aae-9005-557824886026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146299, "uuid": "0d3a0e72-4137-423b-9636-aacae7f646ca", "value": "c49b37ce3e6c20d31fca535f5dae3923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30bd285-1a5f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632175913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632175913, "uuid": "e1e779f5-2c76-4b9a-b292-c67d0a768e81", "comment": "Malware payload (AgentTesla)", "value": "806f2bb2a89f7e9e52f1e1868e12f177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632175913, "uuid": "78801781-e5dd-4682-b08d-785b9d8196e9", "comment": "Malware payload (AgentTesla)", "value": "fb263756d4181bd3dbf028d68ee1c342c1f6699a02727d49b1bfd09a663b5804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632175913, "uuid": "f1f253f5-c162-48f4-9489-334ab15460d3", "comment": "Malware payload (AgentTesla)", "value": "b3090ce3efc5b75f6eaa2273ad1a920e7b4d8e4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632175913, "uuid": "cc026c31-5b55-4d86-a4f5-8112fe7e42b1", "comment": "Malware payload (AgentTesla)", "value": "fe8be21bde6b5ef3bddde2d37d4eb0e6252895ea33c87a5d3c300b557087ddfaa493068a8e5feb0b4e9eb7f8818e905a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632175913, "uuid": "c60951ee-f083-4d1a-8c45-7f128bbe860b", "value": "T1CC15D02022A4C26AE1FBF77CC4729471873EFA86A426D95E5DC3D8DA0D25341C51BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632175913, "uuid": "a362402f-abbb-4751-93ee-a2c1ef9d61db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632175913, "uuid": "ae9d457c-b192-4b16-b69b-91bc8c78962a", "value": "24576:gA6qFuhA4mdvpvNt0qG113yDj4ZA+FooObl:yqFuhAzdvpltf0G6o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632175913, "uuid": "431cffed-9944-40a3-b315-f8c44a1e33be", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632175913, "uuid": "7f1adbfd-e7ed-4f20-b946-1aa7b8911a62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632175913, "uuid": "17e6c5cc-9d60-4e79-a270-b65956d2f25b", "value": "DE94094884.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ab4651-1a1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632146423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146423, "uuid": "f96279e4-0acf-4a03-a159-0e331d1fe86b", "comment": "Malware payload (RedLineStealer)", "value": "3da4c18d9f7346178663e3a623af7fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146423, "uuid": "3798ca93-5c8a-4269-a047-44387a7b86e8", "comment": "Malware payload (RedLineStealer)", "value": "fb4bab16f67ebc7ce75c5b34b34d05508963bc31a76f692ba63ddc9869c69595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146423, "uuid": "cb2391ae-3f1f-4e23-a973-b4de6bfce2a4", "comment": "Malware payload (RedLineStealer)", "value": "7ec07cfeecc077bb8f739d28759717f92924c34a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632146423, "uuid": "a5c43406-7368-4e18-af73-53d6e68318ca", "comment": "Malware payload (RedLineStealer)", "value": "b62d4f515a9c0c71dd4539a633750a6755ec052facb544b0e6991041b465bad220794005fd2be08228a071876e6d53a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146423, "uuid": "7921d929-413b-4831-9c11-8311fdee1af0", "value": "T1A8D382379125A8DAD6695E30D02C0FD735798D34A88FF2A8714AF35AD82854C9EFC363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146423, "uuid": "362330b4-9575-4243-a85c-173d64c97107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146423, "uuid": "e586af41-d35d-4409-b29c-265a6ce70754", "value": "768:fb5lTLHFQ9sSuwYtkUEwIixXJxYztg/oQ0IGHml8uwYaOrtNfwDjHVrxPUlBynt3:f9155kUJIirV0/vmYDtFX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632146423, "uuid": "be2311ce-f7b0-415b-815c-4a1402e36b98", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632146423, "uuid": "e3590123-b6c0-4d69-9e1f-a60f73d43770", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632146423, "uuid": "d369ff7c-d9a2-4c3b-b2a7-eafb8858ac5d", "value": "3da4c18d9f7346178663e3a623af7fad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63959a4a-1a1d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632147406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632147406, "uuid": "dd028bdf-6f50-4063-9b6f-c1ee47c5efe7", "comment": "Malware payload", "value": "2c306c9487741154c6d6dcc1066db09d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632147406, "uuid": "c4501fa8-9fb7-4c0d-83af-50a57b271505", "comment": "Malware payload", "value": "fba36a9191cd8bc99a91c0dc7c6c7af955f3ba655a21ad79787efe689ba5c6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632147406, "uuid": "a3b5a6eb-a4d8-4dbd-963b-b0122ff82b6f", "comment": "Malware payload", "value": "0ab81a411fd81a018fcfff0cc92cc0d94f07dcbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632147406, "uuid": "b9de3b70-79fd-4bb7-9ff5-4e1bd6338188", "comment": "Malware payload", "value": "5a0109c469bb5ec5c393662292c524203e76a0a5360a02ef1a2a288f684cf707853ca0c8398e9d6da1e05e6563542220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632147406, "uuid": "044fba26-2fa3-46e3-ad55-dda926d4de0f", "value": "T1BB521A0277E8AB33DE794BF255A2529003F6961A3561FA1E6DC420CA4D73F044A73B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632147406, "uuid": "dc1d7eeb-a15c-4db0-add9-43c1afb0333e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632147406, "uuid": "2ac46861-8667-4a07-9f93-a945e8830955", "value": "384:I1KfFnT9TXMBhNc8fA1CIPH1w0PHzzTzzcbDV/mleQ8GqSffqCgT:GIfzzTzz2IQHzCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632147406, "uuid": "6bcf2aff-565a-4c6e-9f54-9efb1f9cfda4", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632147406, "uuid": "c97b438b-e0e5-4db8-aa10-4897f61329ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632147406, "uuid": "f2d9292e-450d-401d-a1d7-0e1f2860ac78", "value": "Quotation from Jinggong - nut..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9c0db7-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125467, "uuid": "1f530c09-61de-4566-a8b9-6274727eebf0", "comment": "Malware payload (Dridex)", "value": "d215068156be45dcc53c3a4258ef868f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125467, "uuid": "2605a31d-841b-4758-b6fb-0e24d2fe2b0b", "comment": "Malware payload (Dridex)", "value": "fc003fabe1ff3a014ea5ef4df10d154be246e94807d52ad590bbba43c87fd6bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125467, "uuid": "76b5ae90-4b62-4050-8f07-cd4b6cfb991f", "comment": "Malware payload (Dridex)", "value": "e98faf6d68e01d84281a0db415a19be6cd3368ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125467, "uuid": "e5177404-ae0d-4c70-9568-bbb32d0121e2", "comment": "Malware payload (Dridex)", "value": "a441dc1c48dafecf00b0f1f9842d086a91da7dac424be70d54daae48dcb988a34c62d7fa8e41744b7d8930e0057048d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125467, "uuid": "d85e41a8-e952-4f6c-920c-071ea28b403e", "value": "T16395D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125467, "uuid": "da7f19d8-77e0-411a-af0b-3090b73a1dbe", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125467, "uuid": "d547996e-be68-4d51-8ce0-3c53967e8f44", "value": "12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125467, "uuid": "84fb5efb-c3fe-4cf2-8dcf-9f5edf508a9d", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125467, "uuid": "1bd3af4b-6f67-400a-8aa2-8c2673f004c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125467, "uuid": "7b94e9fe-5784-4016-b55a-13af376cccb8", "value": "fc003fabe1ff3a014ea5ef4df10d154be246e94807d52ad590bbba43c87fd6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1f8877-1a5c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632174724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632174724, "uuid": "61d8e082-f3df-41fc-9864-fd56d380c2a4", "comment": "Malware payload (Formbook)", "value": "c5fbab5450dd04e5efc98526faadc9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632174724, "uuid": "9f2647ff-a0f8-4830-ba54-6b2414fe8f91", "comment": "Malware payload (Formbook)", "value": "fc2480dee0caf0759cb11b01bea00a2588a48267c65ea4e81c66ba2a350fc177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632174724, "uuid": "f6db0064-ffbf-4def-bb08-f8502fe69944", "comment": "Malware payload (Formbook)", "value": "884da678a8110cf9224c0b9a5ac1ede2e86bbbc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632174724, "uuid": "5019fe05-fe5e-465e-878f-fe54d75452f0", "comment": "Malware payload (Formbook)", "value": "648b61efdeddac022e9efae84e9288f07cdbe171bc9ae79bdbf91c2d4ffd20af8e631b81231a4cbd53f2d3bf173d2ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632174724, "uuid": "a19c5e3d-d621-4886-a633-bed43e316337", "value": "T177059DC13D47D89BF4DF6AB3986FC12015656E9D9121C73D26827A2B65F330230ABB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632174724, "uuid": "156ad0d4-6023-4be8-b969-3f495fdb126d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632174724, "uuid": "f7d17ddc-5046-45e0-94a0-160bb14ed72b", "value": "12288:V5MTdookDsmtiK5oyZzjedl4nIHvVIoNxFDy+DkRmRLquN:b0+Fordiw9tk+OwLLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632174724, "uuid": "12ee6351-6573-4a8e-970e-a1a15c51dc8b", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632174724, "uuid": "4f1be280-0b5c-4efe-80cd-e00d688e704a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632174724, "uuid": "f756fb47-cc14-4ff8-b5fc-b0ac21c4fa72", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0373d824-1a2b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632153258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153258, "uuid": "002202df-684a-4a2c-9a09-8efcec11a435", "comment": "Malware payload (TrickBot)", "value": "34f19a097d7799afab80ff9d723cc552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153258, "uuid": "276fc9b2-a50a-4399-8d25-abb4f882b989", "comment": "Malware payload (TrickBot)", "value": "fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153258, "uuid": "6186266d-3bc2-4f2a-b3a0-54573cedebb6", "comment": "Malware payload (TrickBot)", "value": "285229d0b36440af66ebeef9f14bfa2f1be476b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632153258, "uuid": "1a5b5a44-201f-48c0-9ac5-39c058388546", "comment": "Malware payload (TrickBot)", "value": "db0ce3493fcc6a1ad7c44495473fb595137d9ef734130a727b14e2fc7d7ba474956fedef3133a65f03b9968bf48f0c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153258, "uuid": "1e9f5a9d-b2f4-4a14-ab27-d43f436af43d", "value": "T130A4E134758098B1E93F467BCDA49DAC077AFA215F46ECCF5258A6870A633E1FD31809", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153258, "uuid": "dfe5066b-827b-4c65-bd95-adcc79c6d14e", "value": "c6fd1f5475c1e8637450d5d63d96045d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153258, "uuid": "a29ce328-50de-4fd4-ae37-dffc3952ec91", "value": "12288:2uAj1uOciEhM47oVoJCo4afenIMTG9+pPolzZ/2aI/:wJuOzsM2goJD4afen1T0jlzpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632153258, "uuid": "cde2c963-ad59-4f53-bd0c-38e687b99e1d", "value": 462120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632153258, "uuid": "ef950836-3a07-465b-80a0-fa86efbdba7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632153258, "uuid": "3be2a75a-569d-4551-9b1d-e93f82ab0549", "value": "In-zoomConference.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ee9fa2-1a06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632137577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "500f1839-3e15-42c4-a38f-1ace708f036c", "comment": "Malware payload (SnakeKeylogger)", "value": "771d733d6f377c5907ddd0478a878726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "8584f146-7f50-482e-971d-0d45ade8478d", "comment": "Malware payload (SnakeKeylogger)", "value": "fde478f195e0bdbdcd2db7c26fe950b5d830228dad216568cf9e786512a59c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "b77223c1-5097-4140-af66-c13808dabbd4", "comment": "Malware payload (SnakeKeylogger)", "value": "8595f0e63ec2a93f86eb3088d87c5f7cd3543a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632137577, "uuid": "64c77bba-b23c-4866-8c59-8a16e7bb9e4c", "comment": "Malware payload (SnakeKeylogger)", "value": "d0e24243ce127b451d84454dee52e1438b6f78d8fada6599501de250cbbbbb6d65ca3b025518f01039883daa2c671652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "a5ca48e6-ca2b-4483-9890-759f708c4183", "value": "T1FAF49CC17D47D89BF4DF2AB3986FC1201165AE9D9160C73D26927A2B54F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "60da9060-e58e-462e-a7be-613424d93cb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "33cb68d7-ef1d-4878-a275-39e8e0787f07", "value": "12288:C5MTdoHDl8smtiK5oyZhA5GeVipRTlbq/wULN+/v5U0xKel8:QJj+FoL55ipllbMw/v5Sw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632137577, "uuid": "8dd6d1b9-6512-438e-b0b7-a5a1f9a5a434", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632137577, "uuid": "0397c3c7-bea4-4135-897a-c171fdc0ce17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632137577, "uuid": "f933099a-c7a9-4c65-b86f-e2affa12af65", "value": "order_list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fafe335-1a09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632138890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138890, "uuid": "d92f643c-d361-4b62-a03f-6e5dbb424aef", "comment": "Malware payload (GuLoader)", "value": "384e0195ae8d1bbebdd8417d45a68644", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138890, "uuid": "4b741623-eca8-4f2e-8e37-194270bcf0ea", "comment": "Malware payload (GuLoader)", "value": "fe290157433d4a7e89601c8536163e266b1fcd6421317ce0e7af1d8a2ce0c29c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138890, "uuid": "dcc7259e-fa71-4b11-9b11-0f2e8447a303", "comment": "Malware payload (GuLoader)", "value": "fca0147efd4efb0856c6d63db83188e0c10fda61", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632138890, "uuid": "8eb3195f-2cf7-422b-a305-a20b65b76d7a", "comment": "Malware payload (GuLoader)", "value": "6f4b1cad55a7571c8013ec55bd31f3727da6e69c1c426568c84f9bf100e92d67fef5d4a07a77b0f242a605691a5582e7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138890, "uuid": "f9179307-3288-432a-9b58-6a83886e91ff", "value": "T16CC4F1FE28A34E57E863717939A6D1506B6D4FF336F45673A084305E08B93E1E8D8C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138890, "uuid": "896de631-3297-4a06-9785-476392866ada", "value": "12288:PpkSelZAnqrr4NzxI1/FCg2LOPYpqG2TZhE8:beMnqq9GCpLac2TZu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632138890, "uuid": "e7cf12dc-6801-4b23-9ae2-a4b6324ca3c9", "value": 594952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632138890, "uuid": "3ab63b9f-6de9-4eff-8997-f0ad04d4ba1b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632138890, "uuid": "efdbfbdd-14df-4a6c-bc64-2e5974f748a1", "value": "RFQ1009202.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642cfdce-19ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125503, "uuid": "e0007000-4c84-4b94-ba39-3008997cd9f1", "comment": "Malware payload (Dridex)", "value": "0edbcf2e142337ef4bdb5f020c42b070", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125503, "uuid": "4da6faa3-4c11-4284-94b2-6e37f93df719", "comment": "Malware payload (Dridex)", "value": "fe6def5203a75d8fa69bb0d0060fb5ab18af8c87f52f750e1aef29e39e6ce002", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125503, "uuid": "e0449f10-b497-4efd-b877-c08c4e85e9a5", "comment": "Malware payload (Dridex)", "value": "bc4d167d1319fadb17773e4fdf7048b6188d3f79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125503, "uuid": "4119c557-f420-4140-9ae7-89dba6669c8a", "comment": "Malware payload (Dridex)", "value": "a3005d68637cd0b104cbdc7cd0185cf1ece1bb2d3455b2bf5952a7fa8e510469443e6eed698ae91fb51587481ae420fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125503, "uuid": "e2fcc1dd-a1e7-4db4-96bd-221683a686d1", "value": "T14695E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125503, "uuid": "da0db31a-2336-4e7e-9e89-c20a310cdeb2", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125503, "uuid": "def3bebc-e19d-41a9-a07c-ccee9c161f57", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125503, "uuid": "f5ffd928-f22a-4199-a4da-1f542229ee8a", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125503, "uuid": "139f5336-a8ed-4d84-949a-a2e3bef7bd82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125503, "uuid": "53503672-e61f-40c3-b02c-20f55399796d", "value": "fe6def5203a75d8fa69bb0d0060fb5ab18af8c87f52f750e1aef29e39e6ce002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6a9524-19e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632125247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125247, "uuid": "cf1443f4-8f6a-42a6-b937-d06b41b0592a", "comment": "Malware payload (Dridex)", "value": "ea9ec5ad3cce27a0abbf0995a26302e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125247, "uuid": "d6256ba7-4f1f-4564-9c36-da69ab20ffe2", "comment": "Malware payload (Dridex)", "value": "fe77289a95d6ea7cbd4ff51da8438f04817b7c1c039963453ef5ba4c4432790f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125247, "uuid": "7cba41f7-f7e0-4302-ab16-6cf7efa9a335", "comment": "Malware payload (Dridex)", "value": "cae8d874aeaca32efefa3e1fbf49b8c31867b946", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632125247, "uuid": "288eeafe-8d2a-4c51-ba62-2358f5330062", "comment": "Malware payload (Dridex)", "value": "775e8068dc71f7ccf1bb6a64337e30d53c7a5aa2264355e0daa2382cb3a45491f69aaf387ff8626f4757106deb4cc718", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125247, "uuid": "fa5a560c-208a-44a8-b7a3-9482b1046704", "value": "T118A5E020EEA9E1E6C6B89F3ED408352717F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125247, "uuid": "276f9202-3da0-40f0-9a2e-095536c8e160", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125247, "uuid": "e794de6f-4c46-4364-b5a5-5edd7f0a28d0", "value": "12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632125247, "uuid": "1f8f464b-d17b-4bc1-b68c-5db3f0f6815d", "value": 2117632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632125247, "uuid": "40734ca7-3df9-451a-ad72-b824ca69ae19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632125247, "uuid": "418af5a0-1a10-4d0a-a342-12f0aa1bcf0d", "value": "fe77289a95d6ea7cbd4ff51da8438f04817b7c1c039963453ef5ba4c4432790f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f6b4f3-1a1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632145966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145966, "uuid": "e0590e8c-0e43-4335-9b25-f5c467cb16d8", "comment": "Malware payload (AgentTesla)", "value": "057bf656f1c829542413873f3e7aba64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145966, "uuid": "740478cc-532a-444f-bdb8-b2460cff5f28", "comment": "Malware payload (AgentTesla)", "value": "ff3c4b310b642ebc8de1d558e3386a423f6fbd203a825d5af6ff337594b7d655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145966, "uuid": "f2212580-72ee-41fe-9409-e1226f2a5f78", "comment": "Malware payload (AgentTesla)", "value": "4a4f812e0280118aa8cef1b0df2aa830b19a5f39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632145966, "uuid": "90a0b629-7f00-4bf5-9260-8305f9209471", "comment": "Malware payload (AgentTesla)", "value": "6e06ecc653f3fac6e3e91c9dc1f448e6459793522f022f1150960becc85761877453eeac3aa4480b5eeed02cd7a176eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145966, "uuid": "d5ac00ae-d002-4c99-9e43-92876d5e0f03", "value": "T142F4DEF5BE13922BF6ED46FB182454811275BD442A20C7FC29913E8B3AF631D3601B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145966, "uuid": "e9e064b1-211f-4fb8-a7aa-0cd842fb6214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145966, "uuid": "8bff41dc-a504-4ad7-bef5-3c32ae38309c", "value": "12288:g5MTd+CDhsmtiK5oyZI0ErCbWA0/irCVNdu1Czbal6WpHTkGskUB99ZdEzK:AV+FozrCKrkkzba0CotkUr9ZkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632145966, "uuid": "b115a063-55a1-4044-a7aa-423d356ebd2b", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632145966, "uuid": "e6119d3d-f5fd-4618-acd9-c33a683ffdd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632145966, "uuid": "9c2daf00-7137-4ee1-a145-36090d073a34", "value": "order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }