{ "Event": { "published": true, "date": "2021-08-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-06", "timestamp": 1628294582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6ff5c173-883c-44a9-87b0-d68964f27d40", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823da65f-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628229159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229159, "uuid": "836471e8-bea2-42c2-8e51-d9ca1d860429", "comment": "Malware payload (Formbook)", "value": "24c686af1d579dff0aebb19f5280ab55", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229159, "uuid": "eb072031-60bb-4923-9b48-a3ee393dc160", "comment": "Malware payload (Formbook)", "value": "011915ff335e599a134472c72f4977d02b7801eb8f1c0f93b8d169d2de33dfee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229159, "uuid": "81b2b51c-89e4-4d72-8103-e0a815da6ee2", "comment": "Malware payload (Formbook)", "value": "43bf76ac64b6e35aeb0f4862f7c82a6538e94e2c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229159, "uuid": "73f58541-46d8-4f6d-ac59-799619bd9d6c", "comment": "Malware payload (Formbook)", "value": "c53bfb3199a7b2fb5c2921312d9e38717b2f510a7128190e7c85c3b34fcaf4cc999c1dc1ff56a64de6269f3a5c4f90e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229159, "uuid": "5d49c7be-b602-4500-82a8-08f9bbb61fb7", "value": "T1E7D4230234F35274C5F8EB4F9B19B7223F70BB617F14A21926D4C94CAF6AA174AD24C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229159, "uuid": "ade52bc1-c085-430a-b11d-6a2bfe5b4fe6", "value": "12288:u9S7HR3Xo/cq1hUyx4EMSYelvdGNCpdmqOS/5D1s776IaDvtgUD1V:kS7R34/z1hUyWqVXpIVSt1Ut6f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229159, "uuid": "414cc4db-97a0-4f95-abe4-00333778acaa", "value": 652102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229159, "uuid": "faa9998f-70c1-403f-bec8-560179b42636", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229159, "uuid": "0dfbd9a6-23cc-4e65-9cb7-160da66ff46d", "value": "neue Ordnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab39a0b-f676-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628227402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227402, "uuid": "895728fa-bfd2-4ffe-bc9d-c1b5464feb32", "comment": "Malware payload (AsyncRAT)", "value": "d2226af0983cf464cca6cab1a66b522c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227402, "uuid": "07738809-1adb-4652-a1c3-292617950339", "comment": "Malware payload (AsyncRAT)", "value": "015ed4c300266add01fb06b7b764c853664a4d60ef126c87d0fd3dc40ab1c329", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227402, "uuid": "3421856f-3eac-459b-9c59-445b3e6b57d9", "comment": "Malware payload (AsyncRAT)", "value": "02c5d656fd98d709ecdcb2935b384d0b90217a3e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227402, "uuid": "d91b733e-6f52-4c78-bd43-02844d447f58", "comment": "Malware payload (AsyncRAT)", "value": "565be5c12d3c7fe218c416fcaf0f300ad5407736c8f56c952823b694ede0269639c54d20c1388a550cdebb464ad3a535", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227402, "uuid": "93330fad-1a2f-4f93-8bff-30a0d2bf68b7", "value": "T16201996188EC21CABBE1D6EF01F8482CE851B304660C753A28B61F1F5446A5623AFCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227402, "uuid": "db68066e-36c8-410a-bcd8-0eef877345b6", "value": "12:mFpiF4ioGgnmXUnjqJ+/9+iM9+DOOyv24/H59+vM7ITkSSsabkg1:SiF4C6CKmWhMpOSZZa9TPSsaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227402, "uuid": "460b492c-26d4-47ba-96f5-7d5d9371b82e", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227402, "uuid": "672a20f6-1059-42bf-91bd-efe42da31c85", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227402, "uuid": "b55e8da6-54e6-4d3d-a0bf-575410efee32", "value": "DNIE372.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c37ff4-f64a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628208516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208516, "uuid": "ef06d09a-1d69-45df-b54e-3dbf0a631d30", "comment": "Malware payload", "value": "fd18bd8ec985410ddfe371dda8acb47f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208516, "uuid": "bb5dc8f3-8d75-48d6-a4c0-deec935c89a7", "comment": "Malware payload", "value": "01de161d9d73bc4cb88842574ce023697302362d0884bdcde33ae8fc3706ba2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208516, "uuid": "9bef6fe1-6b33-4d6e-b719-445de015aff8", "comment": "Malware payload", "value": "2138dc245b4f40b2cd820b8565da16d607b6a215", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208516, "uuid": "c1d96ae4-a667-4118-b816-3dad52411c0f", "comment": "Malware payload", "value": "e807e41d16e21e692ee0ef5d81efeab9606ba9e3d4890f4cdff8f5d604323d7d177a5a716d9b8a653de6f84bcb878687", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208516, "uuid": "04f08a3a-96ab-4bd2-bd51-3318a4d645cc", "value": "T154E1C61163E9073AFF7B4E396C7217105B79B641DD37CA5E2D84621E2D226488933F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208516, "uuid": "a8778188-d9b9-4b7d-962e-48eee13424da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208516, "uuid": "f96ec1b2-c107-47c8-afe3-2de62ca1a649", "value": "96:nDkUyc9FIZnc/9h6+2Ux8VHYlYlfhemtlJvpJlKbzNt:nYUyCVh6DYlYlfvlVprK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628208516, "uuid": "801f909d-7e25-4085-bbbd-aac011c114c2", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628208516, "uuid": "0e50c621-bad6-466a-b9f5-81253c532bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208516, "uuid": "5e73fc4b-c388-4c73-9633-679e630305f2", "value": "fd18bd8ec985410ddfe371dda8acb47f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3e52ce-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628252803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252803, "uuid": "96d39db7-9b62-4284-a376-304dbe64ec60", "comment": "Malware payload", "value": "7a8899cfe0bb4d3685f6cd54e24b2098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252803, "uuid": "1acbf167-6103-4c77-840e-7ac23a2c5770", "comment": "Malware payload", "value": "05c8155ca202fde24ee1867e9defa0866b61e6530390922390692f5631b40546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252803, "uuid": "dab9e4ab-3459-496a-953e-6e158875bc0c", "comment": "Malware payload", "value": "78633b8a959284b1f9570ea0b647333f745754c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252803, "uuid": "cbc287c4-1fc7-437b-aa3e-9f16509a94b8", "comment": "Malware payload", "value": "1c32e9870665797d4f0ea748fa9fe6deebf23eee4a3557cf1831020af06ce10685e1598a665c623ae9691980b532275b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252803, "uuid": "ae52989a-1849-4be9-a840-32c9697e6abe", "value": "T1CCD3D17A4694C0EACB27D670F04BF36D45AB6EE18B50094F13B13DCD3D785868EAE096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252803, "uuid": "6435e691-3be5-4393-85a6-c3ab892ae545", "value": "77f81ec12eacdb769388a8e410647817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252803, "uuid": "1b104af2-ddac-4d87-85fe-758222fd81b1", "value": "3072:8M4dyQhfQ0wz5OdRSzzYzbpfvrYGwJVPJ7YlS:r4sQhfFwNaSne7Qdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252803, "uuid": "fc43e665-5217-45bb-8591-49bd7a63d1b9", "value": 131050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252803, "uuid": "e9d52aee-669a-4a22-a5b6-5c84fd23831e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252803, "uuid": "04b2b2ab-ce53-4701-bdfa-198afb6724de", "value": "7a8899cfe0bb4d3685f6cd54e24b2098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe3c7c7-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628252851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252851, "uuid": "477d67ba-ba5e-4fde-8674-6074ef10681a", "comment": "Malware payload", "value": "f8f8ca85761e800d5e219439858374e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252851, "uuid": "bd1f43a5-8c0b-423e-856e-468e91cb552b", "comment": "Malware payload", "value": "06a2b3dae21085aa5cad1105ec7ae822e4e785c1adf314e3554d515474a322f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252851, "uuid": "dc954e56-347a-4dfd-b68d-54962f4676bb", "comment": "Malware payload", "value": "d50d963357163881406d88a6efd2065048b10c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252851, "uuid": "c48d5a2a-170a-4f26-ae6f-facb358f06cf", "comment": "Malware payload", "value": "310e16eb3f7974223417708ea8246ed17b6b4161c272bae86a2289091f111563df22492f00b358300bea4a4155d9ddcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252851, "uuid": "18541847-3b8e-433f-a6be-a7998bd11764", "value": "T1A414A4E74CD64096C3D47FB1E0514E47BD3F982844B3B17CA04DA29AC81864DFABF6A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252851, "uuid": "d9a0b090-d067-4050-b14f-0b07deffce0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252851, "uuid": "100b504e-aefa-4c4d-98f3-df9c76724345", "value": "6144:VrbJrKpiJn818EeJnnnnnnnnnnnnnnnnbnnnnnnnnnnnnnnnn+:2piB8C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252851, "uuid": "e52d4856-d4f2-4c7f-9e80-b563f9c1ec50", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252851, "uuid": "4218314a-bfc1-40a8-9053-887c1f0dcebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252851, "uuid": "bdc36f29-8370-4f61-811f-095ccfcbff4a", "value": "f8f8ca85761e800d5e219439858374e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6165bd-f695-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628240716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240716, "uuid": "568942eb-29f3-4a4b-8745-7dcdb8068e54", "comment": "Malware payload (RemcosRAT)", "value": "d8e0e1c69f6428c9088df868b798d0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240716, "uuid": "9832e768-94ed-4e03-abcb-3a0dc2212673", "comment": "Malware payload (RemcosRAT)", "value": "0831a0cc863d2c4d118216b9b915a785f2ea52f6fde777a40138ffe771f1c8c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240716, "uuid": "4ba93b18-720d-47f6-aec2-6a2a94573317", "comment": "Malware payload (RemcosRAT)", "value": "f2f6c7c5a07d5783835d7516e34506b5c845a241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240716, "uuid": "904ad9ee-700b-4661-8fcc-0e97605f8d7e", "comment": "Malware payload (RemcosRAT)", "value": "43f65511b683c08d202a6136c5cf554f50edbc624e9dbae9a2fb322e97f5b41e94d4f5a5112bd2ea483d20b1d770e8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240716, "uuid": "1257b014-833d-4352-9069-7d66251180a3", "value": "T1AAE47E66F2A05933C2536E3CCC4B976DA9277F112A28B5412FF93D489F39342356A18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240716, "uuid": "98f79a42-1d4e-401e-a5c8-2cb123a39cdb", "value": "a09d64195bff556eb90ba4781b170ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240716, "uuid": "86496f26-1699-4eee-9b02-22217f5cf465", "value": "12288:NlyPhGe3nf8jHmf/3AwhgFn33DdzQwcApa56Q0uGPQNfXA:NAPbaHLwh2nBZ6oulA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628240716, "uuid": "f9e9c268-3836-43e2-88c7-f6c0eeca41aa", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628240716, "uuid": "384ec19f-db81-4e06-9d1e-949fbecf8955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240716, "uuid": "949b4689-a926-44a6-8487-909a4d8b7b4b", "value": "OC CVE6535 _TVOP-MIO 08(C) 2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b51a98-f673-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628226289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226289, "uuid": "fac6ac7f-3077-4102-8a95-80c525c3df2b", "comment": "Malware payload (AgentTesla)", "value": "1e0b6b6eeb7724b33c37155812a3e382", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226289, "uuid": "f03b6505-dede-4714-8c84-b96dd8ef05b8", "comment": "Malware payload (AgentTesla)", "value": "08c19a18c9a7b32962eb007a21f674e66208d22e4b0ed8abc571ac15167dd4e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226289, "uuid": "62f04605-8c2e-48a6-a6d8-27087d983f88", "comment": "Malware payload (AgentTesla)", "value": "251958c793e7a1059e0811a7731e1d023097e635", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226289, "uuid": "88fce7d1-2de9-475b-a610-3621a274d967", "comment": "Malware payload (AgentTesla)", "value": "997d7b7336762468a5e2ad3ecf48d9e54757b70bb013b79d3f672739efb6b4b5bd94036db8ecc0ce779495b3691fa736", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226289, "uuid": "2fc77ab3-a03a-4488-a6c0-8f2d6a4970ea", "value": "T1C494BEA3C2554995FC280BB5D4338CAD1967BF7ABEB0E46C644EF93627733D31026A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226289, "uuid": "642c4229-6041-49a9-89bd-8a1e79154745", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226289, "uuid": "7f86fec6-4cff-469f-8cec-7ba79f50aea2", "value": "3072:ullsnQEJvQYV2HZght6bkiX/VMzyrdCo3Ri8QO/sA2D1+kqSLIJhprFa+NKMe/i/:ul8hQYVwZ1ftRrR3PCAq1+kqS+e/ivhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226289, "uuid": "cca7efc1-c2e4-4d19-b0d5-fd2c3f782add", "value": 433201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226289, "uuid": "047eb347-044d-4c41-94da-39cd3a3338e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226289, "uuid": "d29c95c5-b3b4-4a53-81ef-b8527bddeabd", "value": "SecuriteInfo.com..26258.8146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a625978-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628253144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253144, "uuid": "2f1ee27f-74fc-4435-8050-84aec31f2d13", "comment": "Malware payload (Formbook)", "value": "91e416aedcac1d95d593fffa9a0a22b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253144, "uuid": "e7810ffc-657f-41f2-853c-4a8db60f7327", "comment": "Malware payload (Formbook)", "value": "0a954ff882c7b2e4c6fdbdfa5254c5f54e0a1616ec9cf8bcd2c1652e903264c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253144, "uuid": "6c71bf6c-6f2f-49e2-b127-ff1494376741", "comment": "Malware payload (Formbook)", "value": "964363c956703d3ad47aabae6a32decc086a879a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253144, "uuid": "b3fe52fa-4a9f-4f61-aed7-cee2d2f367d5", "comment": "Malware payload (Formbook)", "value": "f5aca09d611a5ccdcea71d850da880ed8d5357db5c558cb529b2f54226d99877dff210050addad5c1bfb2e5ed1fabfeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253144, "uuid": "5c850678-8c9a-4a2f-9034-379be195c2a8", "value": "T15A25BE607AA94304E9BBA730693E91000BF7BD3FE726D64E2D55794C87B37824363B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253144, "uuid": "185d10bc-95a7-4d57-bb3c-20b78e016048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253144, "uuid": "8a8c1b02-3834-4fad-a78e-806234294a25", "value": "24576:lWGKb0wFVMNj6hQz8HM6zMyOplwxr05EQzxl:PKYwFSh6hd9Olwl0BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253144, "uuid": "0520648a-fe5d-4831-bf61-192d6cef6029", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253144, "uuid": "efc81b31-6359-472b-ac25-ac1fc9bb93b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253144, "uuid": "9ae8ec78-463c-414a-bafc-f1034e800113", "value": "LIST.KRT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31302726-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628226876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226876, "uuid": "d37c1bf7-7a49-41d6-b063-89614c116231", "comment": "Malware payload (Formbook)", "value": "51751ccca1d67f4fab930e3d1d98301e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226876, "uuid": "24ed0792-baaf-40b5-bcdf-834d43b7bd50", "comment": "Malware payload (Formbook)", "value": "0f1caafd98e2c01b9860eb21ba2fa1b31cfd33bf29fa25a1ea5fc97f4a7ed90c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226876, "uuid": "c1a0ac0d-9c02-4296-8493-28401431af92", "comment": "Malware payload (Formbook)", "value": "51a89dab1f48ce52fbc6672f2e86e77f7f1915ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226876, "uuid": "5712aab3-3479-4e3f-bc03-be3b241695fb", "comment": "Malware payload (Formbook)", "value": "642e8cb5ce0c095385d74eab3cc4b7328a2339c23bbeead3d329b1f589952fa471da47237aa0277128d252c814bf3328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226876, "uuid": "89e1f6fb-5de6-461b-bc75-332feab4e39e", "value": "T1FFE4AE2A25E04907E57CCD3C1991A26AF178EF82B4CDD687ECC73C47D639B8615806BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226876, "uuid": "fe383664-755a-4c39-81b0-5f4553b86764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226876, "uuid": "39425308-6e27-4b14-b1cb-8f8bb9573a85", "value": "12288:lGL22uI/EpUF1iJoEfXet//uQvXcK9ji1OQK4H:lGL22uy2UFCfut/GQvT96oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226876, "uuid": "83706878-67fe-4cb4-9fd9-77fcb28bc0d4", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226876, "uuid": "8fcf3ff1-5b3f-4a48-bafe-1f2b6b117e94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226876, "uuid": "fb4530fc-2e40-4cda-8d47-b18ce770537d", "value": "Paurchase Order-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e26b030-f676-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628227407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227407, "uuid": "a893b6b1-a56c-4f20-a549-1d6adc816b43", "comment": "Malware payload", "value": "d1bac2ca08be6200f439fa99f6e8d597", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227407, "uuid": "2707f4b6-b15f-4230-b1ae-023d936096d8", "comment": "Malware payload", "value": "0f280c01983905288329058a8e6632743df47560ed01408b4aa17df7c24fd3f8", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227407, "uuid": "b3cf507f-da5a-463e-8524-8938bd1c8a8c", "comment": "Malware payload", "value": "e1999113d3d27f313284c83e82607424129caffe", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227407, "uuid": "c7581955-8dcd-445c-b1dc-df05c188f3c3", "comment": "Malware payload", "value": "c6dd791fd30113d6c60b4b4c0477b4b600e9063d2b84390cf50fcda1e997c0228026033691fc706b2ade850c0f1ebe90", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227407, "uuid": "5cdd9209-5518-43c9-935c-4c8fcbec72ab", "value": "T1F0028F32FE84B062C76B0ABF585E11F4DAC09C0B1DA16F869C9C269C9C8518747DB796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227407, "uuid": "2e443700-647a-4b56-9cdd-e101bdaf5e2d", "value": "192:37XqUwNloT907zdVHf/YlvncccxbksWv2J1zPmrsHw+f002ALW:3INloTQvH3yccQjvzPTqALW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227407, "uuid": "8a57e2cb-f773-4e23-84d5-07aedce0bd0a", "value": 8313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227407, "uuid": "4185a848-35da-436d-b31f-1c798c67eacc", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227407, "uuid": "073afad3-76ee-45e1-a50a-9ce3d20602f2", "value": "Contract-Agreement,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f267085-f6a0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628245394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245394, "uuid": "257af207-1379-46df-840c-996f791aaa51", "comment": "Malware payload (SnakeKeylogger)", "value": "f25f629de8fdb4ef25a1e95086c9d9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245394, "uuid": "cd0d57ef-0874-49e3-823a-d2bb4d743fc1", "comment": "Malware payload (SnakeKeylogger)", "value": "0f817ba75c359bfe49dacc2f7c03162282e75b8cc955dc94abaebe5099489367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245394, "uuid": "3c5587d4-4bd5-4a69-a343-29538f5552b7", "comment": "Malware payload (SnakeKeylogger)", "value": "ccbde1ec4060fd439495c6b446e68bcde4d748bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245394, "uuid": "f718d8f8-45c2-427b-92d3-a13ecd07c94a", "comment": "Malware payload (SnakeKeylogger)", "value": "f337686aa45dde8e4aeda27a128c2862af729cc4eb903716305d8c8ba0dfb6649c393e579aa27efb152773055df02566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245394, "uuid": "24ad62e1-4f8f-4c9d-89e3-691be64b06f5", "value": "T15C05DF2476FE6304E1BFEB74563591014BF6F53BEB12CB4E2C64109C9A73A828722F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245394, "uuid": "648e0f94-b7c5-45fe-bfc1-1cd2c27cbb51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245394, "uuid": "f26c9f92-24ed-409d-a72b-90ed8c8c180e", "value": "24576:fsMHAb0wFVMNj9b7CJtS+/T8sL6Wv0J8fXhzF2SYz:bAYwFShB8b1Lxv0JyT2SYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628245394, "uuid": "6ecfe4de-a934-49f4-81bc-423105c5a9a3", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628245394, "uuid": "0185ad65-3833-42f9-ae6a-21f4519ca9f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245394, "uuid": "ab1ef7b9-459b-4f3d-8cbc-c7a86f4b0c40", "value": "SecuriteInfo.com.ArtemisF25F629DE8FD.21928.6156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2179d6bc-f67d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628230285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230285, "uuid": "13a98f22-1bc2-456a-a64d-38010bce8e9b", "comment": "Malware payload (Formbook)", "value": "de5656ea33859b231be8d245879fb101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230285, "uuid": "59ef2b60-bb4b-4ae6-a6b1-8cdc6fcf4d05", "comment": "Malware payload (Formbook)", "value": "0f91cd4c92db7272fae1a765da60d80d3ace80c956737f08d21f11676a0e2719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230285, "uuid": "24361afb-f593-46df-b958-db69597a6fe9", "comment": "Malware payload (Formbook)", "value": "c95708277b7b4e34d9856ef6d181dfeef3640282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230285, "uuid": "d03073db-258d-4bc6-9e40-95c1673dbf2a", "comment": "Malware payload (Formbook)", "value": "26f5b525762aa3bd8a35e6466033329954a80ddc09d28b50f248f2ca7f9255e7954edadfefb761abf7b08c8397830a05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230285, "uuid": "1b5efad0-1f2f-4c89-90c9-dc5bc7319ece", "value": "T1B2056B2229EB114DF3B79BB60FC4F4BE46AEF673560AB0F638421B954722940CE51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230285, "uuid": "c6479d64-bc53-4bbe-8601-1e91321603f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230285, "uuid": "f4acd88b-79af-4eb6-af21-78c24c8be6c1", "value": "12288:jRrxjDE7AUZxoR65AXwgFvuSSvIodboVRkqc4QYqFvY3uFPo1HwqhQIdK7/UGbQO:jRiDoR6qgRNSqqOBFgwwLR0UwMC7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230285, "uuid": "e43a5f64-01c3-475c-8bde-514cee891067", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230285, "uuid": "56ee24cf-1e93-4a1e-9691-348544235ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230285, "uuid": "edf8447b-8cba-4e9d-8d8f-eed94ddad806", "value": "SLB SOA format.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88ee0ad-f68d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628237518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237518, "uuid": "9e15e755-ec08-45de-9dce-ef7cca6cc4b8", "comment": "Malware payload (AgentTesla)", "value": "ddd3576e4c6932c15d6375157ab4808b", "object_relation": "md5", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237518, "uuid": "5a058b99-6294-4989-aac4-9ac1e28b3d3f", "comment": "Malware payload (AgentTesla)", "value": "101566cb28b50877fa9cb5a9e87c7ca06a81d7239bb1db5f7026b32236582693", "object_relation": "sha256", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237518, "uuid": "00784e15-5e7e-421d-b094-4edf90d08214", "comment": "Malware payload (AgentTesla)", "value": "8bb59c633a70f522fb13da37cf8909654df46751", "object_relation": "sha1", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237518, "uuid": "813c45b9-4a82-433e-adb7-8922798e8980", "comment": "Malware payload (AgentTesla)", "value": "b4b58c10a403a44273da605f8a112ce00fbda568ca09ffcf5e282eb124a9c1c4f5d7ddb32138d301da87f8ac6e40dcdd", "object_relation": "sha3-384", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237518, "uuid": "257a45c5-a025-490e-88a9-57ae569e08d4", "value": "T1DBB47A8188F9A861F0FE013F88C18514327C1DDE745FD6BB5876BD2968E7219B83DDA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237518, "uuid": "abc322ef-7d77-454e-9a2f-6b7d649c0909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237518, "uuid": "7f55b89c-c89b-407f-b11f-aa7005660063", "value": "12288:0yV9iC5dpCNHZabmTrYolMHU8RzV8cuOl5AN+GAuT50zxxxxxxxxxxx:jgydp+lvzMHZx87e5AAGb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628237518, "uuid": "35e21454-fb5d-4eb4-81ea-f967d435c438", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628237518, "uuid": "abf79ba5-cd7d-4dea-92ca-61a775cc3da5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237518, "uuid": "9ee5a17e-ba2e-432a-9567-07cf0c001d68", "value": "Richiesta di prezzo per il cliente 003666748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65891276-f68a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628235983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235983, "uuid": "47f45ac3-1784-4e0a-8060-d04ac57d7c0d", "comment": "Malware payload (NetSupport)", "value": "897278b44d8712024391903867a5ef44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235983, "uuid": "ac1b3044-a737-4295-93a9-6a081edfff10", "comment": "Malware payload (NetSupport)", "value": "1104e75f6b1835efc9dd8454058d43b89fca854fb649fbb2716af104a00311b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235983, "uuid": "76889a92-69e5-429b-8eaf-ad7ff6497010", "comment": "Malware payload (NetSupport)", "value": "198e468a48c54ca5c5ba90b17181c0f77d970c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235983, "uuid": "5c790bd3-0dd9-4e73-a439-c5aafb723485", "comment": "Malware payload (NetSupport)", "value": "03838e0d6da688800348952ab5232ae1eab3426cc7e56b3ce0bdcbbec11fa715a6fc276990a7b4c3891d3a9bf469a1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235983, "uuid": "140deee6-5b8a-49ac-be96-408d1510b6b4", "value": "T199A523433792A07ADD9212F228A8A34DDCB9AF306D51D6C6B742F9CB3BB01877951743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235983, "uuid": "758ca82d-add5-4898-a9b2-f3cc89f9433a", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235983, "uuid": "854e0e28-6176-4034-8c46-4015fc15de94", "value": "49152:e3mPjL9f3YkubCggt+k0F6eYClIKzEWHoimigmkVV:e3mf9/YPbfrkI6e1VzEWHoiLgmk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628235983, "uuid": "0ca4c551-668a-4709-9e47-84887a5f85b7", "value": 2066331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628235983, "uuid": "d134aaa9-7e6d-45e2-b046-05ac1019500c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235983, "uuid": "7b13e4c1-be93-4d45-b368-84716fcfa3fd", "value": "897278B44D8712024391903867A5EF44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2333e6-f68f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628238165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238165, "uuid": "f3a029d6-8305-4164-82f8-388620f3370b", "comment": "Malware payload (RaccoonStealer)", "value": "0baccbb3c9954f8e20d00fcc7b9c8197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238165, "uuid": "00ca820b-6b5e-40af-9e2c-31c829d29b82", "comment": "Malware payload (RaccoonStealer)", "value": "11a5764ca8d515eb745b67a1d693fa3747873f80855cefd5eb7bf890cf0a7a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238165, "uuid": "6ab30abf-3ec5-4e14-83c9-b58ed8222573", "comment": "Malware payload (RaccoonStealer)", "value": "fda8dcb393ee1ab90e788dfe4b3813d7bf04c2e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238165, "uuid": "adaa2aa4-74ed-4224-bb2d-045225566210", "comment": "Malware payload (RaccoonStealer)", "value": "2c9bd15aa725b371eefad7a64f9357d32e53355e9af09e91f2bd096c4e874b772437fcfbeee622af8f5bc1f947744d6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238165, "uuid": "e292cee5-b929-45c4-be10-f46485cc259f", "value": "T15AA402123597C033E96175314C33C6EE5B677835ED21AA872B82927D6F76292EF27302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238165, "uuid": "c40b42bb-ea43-445d-82e4-aedcd706d624", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238165, "uuid": "af4bc9c2-854f-4749-8e0a-58fc2c20eebf", "value": "12288:mpJBx86sDHsybjDs/if2yPrqbxduHmogdRO4EWb:mf8FDnbfs/7UrtxgRO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628238165, "uuid": "6f47994b-0682-4c93-a542-f79d6446fa10", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628238165, "uuid": "013eb1d1-a420-447a-9430-716d1f58a55b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238165, "uuid": "e749f7b2-4c9f-4fa1-b45b-567f48d6435d", "value": "0baccbb3c9954f8e20d00fcc7b9c8197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7add49-f6b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628255322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255322, "uuid": "6d0bf6d4-3b51-4f15-8165-96b7dcec3f25", "comment": "Malware payload", "value": "0c0195c48b6b8582fa6f6373032118da", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255322, "uuid": "f10a74d3-c65b-43d6-9cb9-365a556be2df", "comment": "Malware payload", "value": "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255322, "uuid": "1846e739-ece6-4f35-8621-a82a7c1ca534", "comment": "Malware payload", "value": "d25340ae8e92a6d29f599fef426a2bc1b5217299", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255322, "uuid": "f55266fe-8ec5-4e53-b8f2-c88dbfa62f85", "comment": "Malware payload", "value": "bdef11246d5b9507930800b136c0e1cda16da4f3f936fd5e9c05784f0aa1aec6a9aedaa37bf7967a861e338731d57369", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255322, "uuid": "7e4e9552-3fd2-4c48-8003-a5636ec11d04", "value": "T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255322, "uuid": "434d655f-5bcb-4599-b585-6481c6a3ef91", "value": "d41fa95d4642dc981f10de36f4dc8cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255322, "uuid": "dec2bd70-fa59-4196-bab3-57886951b49d", "value": "192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628255322, "uuid": "6094c6fe-4357-47a0-b396-26bc7cbc5645", "value": 14544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628255322, "uuid": "3a6b8551-1ec3-4e83-b7bd-020f4d314529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255322, "uuid": "88458f04-f090-4345-b849-dd28485e9cd1", "value": "WR64.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dc96ab-f64a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628208526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208526, "uuid": "3d23fe87-5b55-4a81-92fb-624ccede007f", "comment": "Malware payload", "value": "902bf3ec932ad1d22584f7c30c35f65e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208526, "uuid": "8008f36a-5d76-4d84-9c75-aa4bfa76e54f", "comment": "Malware payload", "value": "13079f66ab8a1561e3c46fbcd0fcb6d46a75efb5e51986a1468aac2401e931fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208526, "uuid": "b6883136-25fc-4805-878b-c38d7a971bea", "comment": "Malware payload", "value": "020ca4491b5fa8a12959e416c13a5c21acde6fbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208526, "uuid": "674caaa7-fa51-4b7a-b565-f7eb405e2e59", "comment": "Malware payload", "value": "eab8547f147a4116e4a9b11bf4d5a778b9bda70819e0182aa96e7389c93d586a95c3f946c3f369aef3f3e1f589b9a3da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208526, "uuid": "5c87d3f5-de10-454f-82f7-ffaa26db04cf", "value": "T11D35720AFBB611D1F5BAC139A563322AFC7274A1473897C792855A0E1B31FE4AD3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208526, "uuid": "e65acb8a-50d3-45a0-9ab1-b021ac4bcca0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208526, "uuid": "9383150f-439e-412f-9bf5-d918e3fac739", "value": "12288:Fl3PtsG4saYxGrTwyRUkHBs7POsB1iXh1p8QUuEnf9Tg4IpJ:Flfn4saYxETwyikHmWsGp81uCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628208526, "uuid": "6e887568-c295-42c9-95b2-372c2467cb47", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628208526, "uuid": "8c6ff9c4-7d13-4152-ab0a-f5fbed9c79e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208526, "uuid": "bc4649a6-f855-4361-a373-a31a64dc9336", "value": "902bf3ec932ad1d22584f7c30c35f65e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebbaf43-f679-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628228724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228724, "uuid": "e04d8812-a655-437b-b634-5bfe5051f796", "comment": "Malware payload (Formbook)", "value": "85ad14c8fd2d2fbb3fb7b276980c2f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228724, "uuid": "acb5865d-a3a1-45a8-b1ac-4c1625277277", "comment": "Malware payload (Formbook)", "value": "1331f90041e4a4a6dfbbdd3c6292c4dc4e5d1007f80531cd935dacc9a172fbc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228724, "uuid": "c59f3860-04a5-43bb-b1c7-5139189fee61", "comment": "Malware payload (Formbook)", "value": "7114db0475f96d7093ed4d05664cd9f48848be99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228724, "uuid": "02b1b61f-dff7-42a4-af61-e39551303ae0", "comment": "Malware payload (Formbook)", "value": "d3d1c14f47c6b6f24529a8d4e792a0b8d63acc8f352af1a20e9b285c5572d6b568ad1dd0d023fa472fa393f810399c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228724, "uuid": "4ccbea19-f13f-46b2-a5ca-c171c1f682fe", "value": "T1FB8538A3F22CB33EE51552B834D59D6E46ACDE3C561EE1062B72328BE420A5C17D0ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228724, "uuid": "606ff04f-395b-4c5c-a078-1d8c3145bc49", "value": "24576:PuOfaOfaOfaOfCOfWOff0eVfu9RXUp7JIQsqVVEskIWK2OfaOT:Pvu9Rk7JZusb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228724, "uuid": "1547b66f-d026-4542-a8f4-1ddfdb7eec27", "value": 1810650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228724, "uuid": "d84c820c-faba-487f-adb2-850cb29b9607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228724, "uuid": "0afe5328-4f04-4ff3-be1f-35144d633444", "value": "85ad14c8fd2d2fbb3fb7b276980c2f4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c00ffd-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1628256728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256728, "uuid": "7c4e3381-5e35-4ac5-9b94-876126d362b8", "comment": "Malware payload (a310Logger)", "value": "0bb1c29f4a8c046e798cd9781cc127a7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256728, "uuid": "43a64767-55d6-4e40-987f-ddb66a13bf7b", "comment": "Malware payload (a310Logger)", "value": "139b8756b01add9dcac07d3a0137b0ea49a932fc4804ad0eca63ffc2958eda72", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256728, "uuid": "40c84575-66c5-4cbc-8b5e-d89c7b36ed35", "comment": "Malware payload (a310Logger)", "value": "bbad89c8d04b20f63d36014f00ded3818e595a53", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256728, "uuid": "176f5ca9-a0bb-4338-a7ae-8bcffa51f40f", "comment": "Malware payload (a310Logger)", "value": "1b93706bf29b97784df7e089cdb2fc531a7519ef2732d192e218b500a64842fb0de0c698f7b18da25881ec16da8e5d55", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256728, "uuid": "1795ae62-3689-4437-8645-198b311e941a", "value": "T12915CF2A11D54907E53CCD3C1992912AF138DFC2B5CEDA8BECC73D97D639B8611806AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256728, "uuid": "f5d6130e-8706-4042-9a5f-983cfc9a4fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256728, "uuid": "4dfd2ce1-0393-4cfb-b60d-fef0d2f7cc1f", "value": "12288:+nkguFRskuUAlWC/44toU73kJiIWK4vV9BrFZsk1q1/1Yah2UKbnltqvTmDcN:0kEkuUAlV46zbk6K6VVZsuSYgF+qvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256728, "uuid": "7166c230-6962-4619-8bbe-5d99f9acc428", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256728, "uuid": "c0baa66e-fe32-4cef-8de8-0273c55c3d75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256728, "uuid": "a8b3de57-d137-4a30-a483-4b03c86a6368", "value": "Invoicel-datasheet.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6695ac-f6aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628249765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249765, "uuid": "542d922b-d4da-4c0c-a730-af99578ba240", "comment": "Malware payload (AgentTesla)", "value": "edc7fab4454ca88d834094ad33a52ad0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249765, "uuid": "cbb6da12-6ecf-4f60-855b-5cd3507aad0b", "comment": "Malware payload (AgentTesla)", "value": "13cb0fdc377ec006b3b0e181e93112774cfc054de9305a57637d4b1ec0f50f4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249765, "uuid": "16bc3144-f407-48d4-b00a-4c7d9f00d0a0", "comment": "Malware payload (AgentTesla)", "value": "b13df4f78421ac2bc235f4dd88720ed3fe0c689a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249765, "uuid": "56c708b3-2435-4aa1-a923-ed2498720cbd", "comment": "Malware payload (AgentTesla)", "value": "7360479c0c04545220f394ec33990f5ba092929652c73d50081f74a5fc98653360ef5044fab7e5ae1959999041f16931", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249765, "uuid": "06bad21e-d97f-4ba9-b963-5cb8b8b5196a", "value": "T1D844BF819B070997D6BC523AE19B953F73E0C9B5D335C48BBB4603C6A88E5412EFA7C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249765, "uuid": "0518a87f-4a1b-49b2-88dd-1226a3957b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249765, "uuid": "35f9757a-e8dd-431a-a941-abf26224195e", "value": "6144:1/HyObKhe0jjCCsyRifFlP04YyJpy2Kp1Dyy4VafQSWHGjOgi5/iF6a6X:1Che0jrQTM4Y8y2ONyy4ofNOgi5naU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628249765, "uuid": "6dcbff34-3db1-4537-9d79-b36e9157f1c9", "value": 265656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628249765, "uuid": "49890d2f-de52-45b9-bc3b-28ed67379326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249765, "uuid": "f9e37340-fb8b-4412-ac10-88fd3d06a5c0", "value": "E0075070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b6d37b-f676-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628227418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227418, "uuid": "aa208d4e-ca07-4467-bf2f-ca88dcd3422a", "comment": "Malware payload", "value": "ea0ffe41dc235743b76ad11e11928a42", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227418, "uuid": "81dfeea7-616d-46db-92f7-e8ef8ae650bb", "comment": "Malware payload", "value": "14f82c92383ced03e45b02d9183e01f192fc889a14a6766fedb368376139a3f6", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227418, "uuid": "425c9f7f-cea3-41c5-a35a-bc2d25fa78a2", "comment": "Malware payload", "value": "bbc1eb3787c79745a24010e6266351f7aa63ed12", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227418, "uuid": "9cf53c20-57f3-4ff3-8d46-780e5d7dd894", "comment": "Malware payload", "value": "e07d62a0887a7694040bfe2416ade04d56d464bc42be04ad6b3a69e6626169a264cf94196e63a03bbfea8d989c746877", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227418, "uuid": "78deda5a-5718-460f-83b2-d799c99b60bd", "value": "T12C028EEDCD994766DB7C4A3D84B85BD23DB4248F92206789730173AC9F372D1849B349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227418, "uuid": "4a3e762c-de8a-41da-941d-f7085775ee1f", "value": "192:37XqOHqy6hPqO0Rlw71nUGJ1+Wa838KaICcCk3HtmgzwVMl9:3nHqXhPqOc21np+Wx3NaIrYdVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227418, "uuid": "505f1962-d970-4c08-b253-4a26aab9a5a6", "value": 8431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227418, "uuid": "04bb3256-36a5-43f8-9649-0077fe9ef04f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227418, "uuid": "05f0b26f-ef41-4493-bc23-5a36e454d19a", "value": "Route One RFQ8621002,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51f2d69-f69d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628244384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244384, "uuid": "d071ef13-41e8-449c-a284-8bc05c6562e6", "comment": "Malware payload", "value": "1bd06c98d55071a2385273f663442c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244384, "uuid": "5e97c09a-8c82-49b0-a868-12aa4a5a084e", "comment": "Malware payload", "value": "16b81063c92c306ba273c0c4eaf80a8a5c3d38acb997f0fa503440a740f439cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244384, "uuid": "2ffeb1cd-b2ff-43e9-9251-94abe48e1798", "comment": "Malware payload", "value": "ebd490222feb8888015390ed342e1ad44c22cfe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244384, "uuid": "23585307-d6ea-4a70-992a-5dcbec9a0f32", "comment": "Malware payload", "value": "ccca0554629316e36fc89860f8c0182441519ae90db24cbf146b4ab8899c38e665d83a9cbfa64e3ac50282729c4f4221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244384, "uuid": "84bfd76d-545f-4b9e-a127-422910d1a635", "value": "T134264B01BFE88D29E6BA5AF154FE16500878FD879B31C74F2D04252E2D32F59CE607A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244384, "uuid": "085ebf4f-afc3-440e-b040-ebc6183c8586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244384, "uuid": "22a9309c-ae5b-49bf-9399-3e96285c55e5", "value": "98304:7MmMmMkMcGjZ6hbrFjuj6gOzZPVCvAaGPGj8914o:orrFBV6tpjuj6gYPovAaGPG4zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628244384, "uuid": "09a15031-0df9-4c8f-a6aa-8f6dfb9f527a", "value": 4551998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628244384, "uuid": "28122291-e22e-41ec-bd3f-99e78d318489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244384, "uuid": "8c114517-ae2e-4b48-a23c-5e794297ceb0", "value": "cpush.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3283bde1-f6c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628262956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262956, "uuid": "409bb6cf-8148-440a-9dac-462ddc5d512c", "comment": "Malware payload (RedLineStealer)", "value": "295f4d41f0d001f4397c47bbd38489a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262956, "uuid": "158b3960-d29f-4243-96c9-ebb40a79f471", "comment": "Malware payload (RedLineStealer)", "value": "1705081cec341ec9181841ff92651c81cb6614dec11a314cb6db86997260b1c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262956, "uuid": "31b90177-0fbe-4f7f-8605-ff705cf82e30", "comment": "Malware payload (RedLineStealer)", "value": "2b051da1fade23c9aec22109dc71e9aabeaf5730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262956, "uuid": "8179f707-bb2f-4357-981f-2461506719c8", "comment": "Malware payload (RedLineStealer)", "value": "a27afe506e27cb5c268650d46357226ef42fae998fcb6168964dbfe44348c7de6dbc789856e6b02449737441152bb3e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262956, "uuid": "f78a464f-622f-4c98-843f-b5ebed9b2b0d", "value": "T1D0753B213FDA9551F39B2736C7EB940C4BB4AC272791D32B72A53329C3217936842BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262956, "uuid": "13a69ccb-2ed4-4d97-8bf4-29d2aa6cb58b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262956, "uuid": "27f8093b-8f5d-4b4a-8d00-576372f88e0f", "value": "24576:CxFSVqtzXSMo5J9KU3Gy7YXrG9paUuxSNnat1b0uoFy9qEEZ:CT2n9dGyEAFNatl0uAy9qtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628262956, "uuid": "3eec9175-5d65-4516-9b7b-0c045157655e", "value": 1637400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628262956, "uuid": "5fb5e54e-a0f7-4e9c-a4c7-e5752865a1cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262956, "uuid": "dc8c3441-e8e5-4201-b476-752931a28dc0", "value": "2b051da1fade23c9aec22109dc71e9aabeaf5730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b89ff9-f6ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628251061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251061, "uuid": "9224e8cf-64d8-42a5-9e44-ff2428b05f27", "comment": "Malware payload (RedLineStealer)", "value": "92769fab988295a2e0b72a094e4699fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251061, "uuid": "566de832-0816-4b07-b529-d8b780363d50", "comment": "Malware payload (RedLineStealer)", "value": "17e6a54f93998dab95762bd0b1f9d9fda200ad172f69ae0cf253ba7a89c36556", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251061, "uuid": "12157a4b-771b-4240-86f5-27c1ca61a788", "comment": "Malware payload (RedLineStealer)", "value": "8c77f171360f3559920692b77309cd5ccab999f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251061, "uuid": "ce83eca3-e472-41a6-bfa0-5ece6525f6a4", "comment": "Malware payload (RedLineStealer)", "value": "861903b4f622888ab372b90bca23e75ef93102dc42f7fd8992012e037c765121acd9a10ba5a1e6d165ec83ade518ed9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251061, "uuid": "26245635-e635-448d-a2f9-a42eddeae793", "value": "T1E454F1113A00DD32D11339B3B876CB92AA6BF911D72481477A5A1F9F2F312E16E3935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251061, "uuid": "1283488e-9b15-4933-bef1-044b124a121c", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251061, "uuid": "5ba212ac-d602-4462-8c85-adbdfee4e3b9", "value": "6144:WmL/fPRPSFefzvCqtfSHzSlqRLrJxJgLBI:WmDfZSefzK8KH5R3JYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628251061, "uuid": "2a809445-91c1-49cc-9723-675e37c0ea99", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628251061, "uuid": "ba224acd-8e61-43e4-aa5f-d841f0e29ae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251061, "uuid": "c2893606-07f9-45b7-b5f7-c69b9018c752", "value": "92769fab988295a2e0b72a094e4699fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bdd9d5-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628257188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257188, "uuid": "f6a1879f-b3c1-4dae-a583-5cd7f793694a", "comment": "Malware payload (Formbook)", "value": "aa2b257e539273585dbd122622d25c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257188, "uuid": "b58dc429-40ef-4b96-bd46-d2bd289599e6", "comment": "Malware payload (Formbook)", "value": "18e1c0b385dea6c1a52db85580f25fc0a2833084fd04e2a33288e739f08e3986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257188, "uuid": "c9fb416a-4559-4ee2-90a3-0db7c6341534", "comment": "Malware payload (Formbook)", "value": "0b3ca104f6ae953559a969b1e30219712531b2e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257188, "uuid": "9d0ea74f-f7c6-493a-a0fb-1d512e1bfa25", "comment": "Malware payload (Formbook)", "value": "651bf7f7a32052af3865b9ad3d1c5fb01e154aacd662dede97b83cf76d3f804ee4dcb6411daec9383068272216b2dcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257188, "uuid": "6cebba86-63a4-4249-ab49-378802f43a78", "value": "T19305DF347AED6714E1BFE774463192408BF6F53BE712C74E2C24505CAAB3A824722F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257188, "uuid": "3c8e5286-fd95-43c4-830e-6a5c23b3f91e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257188, "uuid": "972d7940-4841-45f7-8234-c1958c174fc4", "value": "24576:mK+Qb0wFVMNj5N/7BZ01bMy1QVPEfaDYO6E:bPYwFSh3TBZYbH1Qmfal6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257188, "uuid": "ddbcee3f-1dce-4739-ab82-deccc150fea2", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257188, "uuid": "1abda753-35b4-43c7-b367-bb028c196ed2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257188, "uuid": "7298580d-2013-4701-970f-ec743a8ea3df", "value": "Nueva orden de compra_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064ef076-f686-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628234105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234105, "uuid": "63aac201-4574-4a41-ad27-543d6f4bf5bd", "comment": "Malware payload (RemcosRAT)", "value": "55503e853926c19ab04f98d0d86e28dd", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234105, "uuid": "b2ccc80a-2e77-4629-9742-d3afdaa9a946", "comment": "Malware payload (RemcosRAT)", "value": "1a5ea9265d5780ce51f8fe5b1ebe0bc325e41237972abb3cca5474b82b935b0c", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234105, "uuid": "ac5bf91f-cd07-451f-bc7f-eeb787bdb7b6", "comment": "Malware payload (RemcosRAT)", "value": "ab9f9f0a60523938edc4938547c1e50f321e852b", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234105, "uuid": "49563080-1f7b-4fe1-bce4-35737bfa09c1", "comment": "Malware payload (RemcosRAT)", "value": "f5fa986334c585e345124c53c6801b4cee5a8008a17b4e797f861a583b97640e1106afa978a101dd5419a9139c3fb613", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234105, "uuid": "e1f29f52-9a91-4b69-ae16-0204347c8d48", "value": "T1A3E47D4748F294F1C52A257C9C6731E5B4ADBD6139282CCA2EED2F486A1D783243BC5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234105, "uuid": "98c9685b-8b48-4498-8d3b-2fbc79fa6cc3", "value": "1379487e213e9660a192f7f9b27f1132", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234105, "uuid": "469ce5b8-9575-4d6d-87b0-6584c17d0a57", "value": "12288:CHuv6TaXda6yswPypNz+w5cUsCPFExCUaMliTE5p/YrfFyAm:466ga6ys0Kz+wHpzUEoBYrt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234105, "uuid": "37b6c3cd-8df4-4deb-b733-2c95f97c4017", "value": 702466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234105, "uuid": "c565cedf-ed9e-4be2-bf39-a4e20bfd1618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234105, "uuid": "78b23d92-1027-4f29-843a-38ba4798ea80", "value": "1a5ea9265d5780ce51f8fe5b1ebe0bc325e41237972abb3cca5474b82b935b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70f5216-f6de-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1628272224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628272224, "uuid": "21a21b43-bf31-443b-8932-511be99c3264", "comment": "Malware payload (Pony)", "value": "d7cfb08249fbeb6f4943b6b94919d39b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628272224, "uuid": "6d51cb25-b78c-40bd-9716-f8a3126632a0", "comment": "Malware payload (Pony)", "value": "1c3371f96ce677d88cc9ad8ef8960491c3b9b643117e4d2d435bc7bf9d21154a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628272224, "uuid": "6af7b65b-352f-4cad-b6d5-6345bc126aa8", "comment": "Malware payload (Pony)", "value": "8ceae95286062f372d3da2a66146477cae7a582f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628272224, "uuid": "a631cba1-8ab8-4eba-8c9f-418b284cbf07", "comment": "Malware payload (Pony)", "value": "350a2b188c0930cfefe3ad0947a42d415590d87df9e77b2a19165e659178cd8f6f068a158d39934098c4ea14511686e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628272224, "uuid": "8219faf3-11a1-4303-a840-828cf0cd70fa", "value": "T19DF3E165BB5B04F3F551C4B381AA42D0E5F11AAE0F46FD8B36F1ED3D601E891E911319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628272224, "uuid": "2f8859fe-49e8-4a7e-85f6-6394417475e3", "value": "60fd1f8a4d62b3c300aa0a0b884a4c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628272224, "uuid": "45e503b2-bfe2-4062-94cf-c7bdbdb5fedb", "value": "3072:gT01H52EkRm9zLydRtlWf9y+VmzuSBRas:q0YOyOguE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628272224, "uuid": "c9dd7956-aab1-45b0-a3e6-df67b1b7bdef", "value": 165024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628272224, "uuid": "59930005-c24f-4fe7-84e8-8e97ca069b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628272224, "uuid": "5209c81a-6cf6-4bed-aadd-1ece7f3c9d78", "value": "d7cfb08249fbeb6f4943b6b94919d39b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4367b07-f6d7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628269294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269294, "uuid": "3e865c0f-16be-4569-ba79-18605698d762", "comment": "Malware payload", "value": "af9c6107c0af8704755f7bc3b81ff716", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269294, "uuid": "f43dd13d-556a-4711-9c51-2ef2b84757f6", "comment": "Malware payload", "value": "1cb45238fc3fa833a7c95cdd968f2bec141ff231b77f3903d5b020d4a2a74df8", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269294, "uuid": "67f94bcb-24b8-4317-a689-4b94084a0f1e", "comment": "Malware payload", "value": "f2401fe50f24f238c941c51df20f691ddda96185", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269294, "uuid": "a6be5955-8a02-4cd6-84f6-040462c269fe", "comment": "Malware payload", "value": "3262f225e5cf59921884fcc1480cf291899b1bd5c126e6709171edc131660f95554ab1d8255875e6b74c06591d2982c1", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269294, "uuid": "7c547728-a8fb-4361-856f-a2ef1abc67c6", "value": "T1C283E502BA508B43E25943B86E87CEA56F1E2E1C99D256DF22633F0FB9707710D1E64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269294, "uuid": "ff4fb282-0865-4d4d-a612-fd8152c85544", "value": "768:4CE/yLwTnyLsMB+L+MDiMsPMmTq8yXKWh7gQdUL9jUztLivF/3MQ3y3sjZYAJ:2pTyLSKIsPMh8y6W6Z4zt2vV3MEy2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628269294, "uuid": "5323b014-20bf-414b-a24f-bd3b8819be81", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628269294, "uuid": "4c16c0b8-3d0d-4798-8ff3-2c7d734f0a4a", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269294, "uuid": "edbdc69d-2b37-4c5e-b4ba-0fee2c6a6727", "value": "SecuriteInfo.com.Heur.9736.30438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72ee961-f66e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224201, "uuid": "3e53aef4-8910-4d61-b653-e2da0cdb77f5", "comment": "Malware payload (Mirai)", "value": "b9f950e52412e03d089b0a08307c77af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224201, "uuid": "32282579-31aa-4e5b-a778-049e5c3422c2", "comment": "Malware payload (Mirai)", "value": "1de238a8fcf822c77393341f909da28b1cd7e9c04af6acace2a8d27a009dd8f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224201, "uuid": "7939b06b-f66f-4930-b137-578dc288d6ee", "comment": "Malware payload (Mirai)", "value": "a3cbe847ef140d895b9fdaaf53611549b3f59e35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224201, "uuid": "8ccd5e57-8151-4f5d-bf0c-708ba8869855", "comment": "Malware payload (Mirai)", "value": "30326a04a55d8ac74119a5e53d06de266f19f8d34626d79013416b7c6f4b051130ab8bedd236cd76e0b6b7dbee616578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224201, "uuid": "c332fa87-b183-421e-992f-29d4f339b43a", "value": "T1DC93E709BF610FF7E8AFCC3709E91B05198C550A22A97B367934D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224201, "uuid": "cf8cc790-61db-469e-82d8-2bac6fcf46d2", "value": "1536:nSITUINkErQWGKbZn8fgoCAkuI91rFHUZa72Pzh:nSITRNgWvt8TSPHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224201, "uuid": "095fe022-20d9-4891-8842-80a897820045", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224201, "uuid": "2e799fdb-3b6f-43b8-9cda-a3211d6ff41c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224201, "uuid": "ec312ee6-5367-4d2f-96f8-7cafa8c57a6a", "value": "b9f950e52412e03d089b0a08307c77af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685a62da-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628226968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226968, "uuid": "e4aff134-1290-463b-8c02-d89b2162e71f", "comment": "Malware payload (AgentTesla)", "value": "f927f2ce41569d1d2c5a576d93374ace", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226968, "uuid": "acd0d27e-3301-4eb8-bbed-67e8a87c1f11", "comment": "Malware payload (AgentTesla)", "value": "1e3432a2d3072ee5958b26e15d97ca1f6734c3522e701682b237544f5eb66645", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226968, "uuid": "bc6547ca-1bcd-488f-87a1-40ad6af62be6", "comment": "Malware payload (AgentTesla)", "value": "1493b82cd46be1ef2fb45bc12c432d0bcf175a90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226968, "uuid": "b94c70fb-3c81-4db9-b8d9-7f02feea04bd", "comment": "Malware payload (AgentTesla)", "value": "2af10142bb56169437d3c8cb9b05cf3b5fcf38103299688b622e7dd60d659f6f974f0add513bee53e85af23dd952b39b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226968, "uuid": "9c76be73-cb22-4b9b-a9e2-1640308f91fc", "value": "T10B15CF91E581A606C58818BF1F3DFAB057FC9D8A155680812DD8EE473BAFEFA09C35C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226968, "uuid": "a4e86f4d-2334-48b0-8894-d7edd406a02d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226968, "uuid": "15c5662a-4b20-4718-9d27-21fa8dad1e52", "value": "12288:w1cfM/nlPljFQnV40j1yxdTw+MSOVtki1Nv0IeGN+grplH6eUNFje1jwt2NjFoO4:w1Fnl9jFQGdwlOeNv0IIgrXccjwMNjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226968, "uuid": "79f28de1-8b87-4ffd-b1b4-4d5668bf2724", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226968, "uuid": "a604744f-e542-4cce-8f5d-5191457d118f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226968, "uuid": "bc63cef5-897f-4bc2-8a3a-7262fb8ebc0b", "value": "PO-Signed-08060021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6349143-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628231447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231447, "uuid": "89ff10b8-4438-4a76-b299-105f3a4959f6", "comment": "Malware payload (Formbook)", "value": "12fa35cef108edde1ebfe01d69c1186b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231447, "uuid": "7715f45c-4477-4c1f-8220-991ad96f75f3", "comment": "Malware payload (Formbook)", "value": "21819dfbcb4f450bc55706acc971444f6f3452604dc0c19a0b04f2e21732987b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231447, "uuid": "a3861579-25e6-4553-b1f9-99e9cbbbb276", "comment": "Malware payload (Formbook)", "value": "becaf95d431c35b3ad8cbd480f230a4b2323bb86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231447, "uuid": "f81cf38e-361b-4b2e-a3ba-492c628d13ba", "comment": "Malware payload (Formbook)", "value": "726ece8eb2f1481e30fe6f44fa9112e48d1fbff9970f4303f4563caaec56ddeb017bb5a2dd73fe69562beeea87f51022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231447, "uuid": "10a6baa8-94e2-4a81-9bca-d840b7845f60", "value": "T11A05CF90E585AA06C588297F1F3DF67053FC9D8B1556C0812DD8EE173BAEEFA09835C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231447, "uuid": "2e33fac9-9538-48dc-aa08-5306ee47ff84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231447, "uuid": "66d3bdec-b955-425c-a702-317dc947bc82", "value": "12288:sul/f9pg3s8XqvlQXjMN6wfHQOovMacUVtM7g3Hwe1jAt2NjFZOlJl:sgjq0QTMN6woOpaVKg3pjAMNj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231447, "uuid": "4c92432f-769a-43cd-bb8d-924b6ca76c8e", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231447, "uuid": "6a62e9f2-4914-41c2-9322-a1e684c0b02e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231447, "uuid": "874d8902-13ab-49c0-9e80-a4e60aebd01f", "value": "ZYJY-2021010005.RXHT0021 \u79d8\u9c81\u7bb1\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f166e696-f674-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628226769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226769, "uuid": "e9745a5a-cff5-40ae-9ed8-631e8242705a", "comment": "Malware payload (Formbook)", "value": "23886efb34e216c268008573c3c690c1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226769, "uuid": "ae667840-2f3b-4dcd-80e2-86378c0a4dba", "comment": "Malware payload (Formbook)", "value": "21d86f21cd024589b36634ee4d148100434a8b2afb76e897c34778864c029f24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226769, "uuid": "ff2988e9-71a5-44b7-a619-00704e614a9e", "comment": "Malware payload (Formbook)", "value": "685515cdf13abfdfd39cd92e84acb811d2dd9da9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226769, "uuid": "5628c989-0d45-401e-8fb4-ac2dbc46d3d7", "comment": "Malware payload (Formbook)", "value": "a8fbe9cd6499a46664bb610b639c657baaf625fdb3622c19972f96803a2d8fedb48b22bd1d8dadb39524bda1ff0568d8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226769, "uuid": "280e26a9-1f2c-4f70-b9cf-fe76fa42a01f", "value": "T113C3947CE18345988F825BB86B0B5F49154C761DF788A2723ABC97369BD2CBB011793C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226769, "uuid": "e1a7e40d-192b-4b0b-a9bc-00c1bd2ae74f", "value": "384:GFeVpTOPvHoL9+EYtqBnquaMuHFaOK5TM:oeTWIZDYtqP10FandM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226769, "uuid": "f00345bf-63d8-4237-8374-50859838f291", "value": 119527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226769, "uuid": "13ee21dd-97fb-4a86-8724-4071e2ea3db5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226769, "uuid": "cc8116cc-022b-4d08-a197-8bdbafd1801a", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0ecde4-f676-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628227459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227459, "uuid": "2a48c422-b061-472e-b72b-621227cb6b93", "comment": "Malware payload (AsyncRAT)", "value": "7dcb8b39547fd99ad1da08b1988eefb0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227459, "uuid": "1918a4b3-c8e0-4e0f-aa24-9a7a7f654195", "comment": "Malware payload (AsyncRAT)", "value": "22279bfb1838f499d4777dd2fd9a53f86252ec267e22d136da7455593e03750f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227459, "uuid": "4910d4af-f23a-417d-b633-ce421db59253", "comment": "Malware payload (AsyncRAT)", "value": "d3b7d6da251876993768233774040eb52858d6ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227459, "uuid": "54570449-de75-4610-8efb-4db900bf0edb", "comment": "Malware payload (AsyncRAT)", "value": "8130c6bd075224dcfaea4ff69c6749135bb0d2358d17a9822b17a6c388f21cf683cb59b2f99d30d10a5dcf31c6f85b00", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227459, "uuid": "9335e1e7-c14a-426c-a8e5-ef6e9bd86839", "value": "T131012D11A8AE30C5A3D0C8EF44B80868FC43F3611308382D2CEE930F1412B9613AFCA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227459, "uuid": "fdcf8818-642e-48da-aa98-a55bd288eb85", "value": "12:bnPmo5tnOiY+/9+iM9+DOOyv24s59+vM7ITkSSsac4V:bn3X5hMpOS25a9TPSsacY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227459, "uuid": "98a36e6c-5a2b-4f80-b9df-df18ca61a6c7", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227459, "uuid": "aa416f9b-3cb6-4859-8068-b108e39f025e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227459, "uuid": "c09a0e4c-5683-4111-9143-24674cbbcb78", "value": "JAXG354.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639ff3e0-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252301, "uuid": "7c33c7c5-a70d-484b-b799-79be70a84406", "comment": "Malware payload (PlugX)", "value": "ee233e16958768992086207345e84556", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252301, "uuid": "de6ccc11-7084-4b26-97fe-e0d7310bf39b", "comment": "Malware payload (PlugX)", "value": "24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252301, "uuid": "6bafe2d6-7b95-41b6-b72d-8507496975ad", "comment": "Malware payload (PlugX)", "value": "7647ac35b342f27ee51407ed63fa680b20b8fafb", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252301, "uuid": "34fd05a4-bc6f-4c6b-a378-d998be4ad889", "comment": "Malware payload (PlugX)", "value": "351365253ec4e4a58d5b4fac8f2aa6c1f5126cdbfd77ab618832a2f96943eb35fd7e985af4838b724bb2fac9dff5838c", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252301, "uuid": "b6991c62-4b54-4c94-bafb-e1e749a80f5b", "value": "T18BD34B48F541D275E87F40BD1BBCAE0B172DADA5871806DF27C058AD7991CE26E38E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252301, "uuid": "dd54fdc9-400d-4fc2-bc2e-61ee249364d4", "value": "2d4775b7b89703e701e20d373dbc259e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252301, "uuid": "98050e25-d537-4c5e-96f3-95a077a65b7a", "value": "1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uW:5sURE3VW8POLwlKb21uRYCuLMF6eFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252301, "uuid": "b59a8ebe-76aa-445b-8a66-781f0ae62eb6", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252301, "uuid": "279c9f43-e440-426d-be0e-a285f63b161c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252301, "uuid": "337aeef1-049d-4413-ae7b-c8b412cd046a", "value": "24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932768d5-f687-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628234771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234771, "uuid": "c8fbab87-fce1-4c2e-9329-3ac489c74dea", "comment": "Malware payload", "value": "c7734ea57d7286c885a4c146c9a30b01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234771, "uuid": "84870543-22c6-4d03-bae4-688092f520c0", "comment": "Malware payload", "value": "253cfd082fb0c2fbbc318ef255ed89fe343f3a003b89823698e6ae076cff7854", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234771, "uuid": "896a8585-39a0-4b8f-9906-d097856af8d0", "comment": "Malware payload", "value": "369f80e78b35b5c26d1c0a8a625bb563d9c2dea7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234771, "uuid": "79f06792-ac0f-42f9-ab03-85883da6f28b", "comment": "Malware payload", "value": "b5974be90805b5f82c96522a38f7eb6109d0426f351256c393b1777ec2a29abfb411186a8bb8ba54281b9227902b674c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234771, "uuid": "f0be9c19-5b79-4730-97a4-b846dbc5bedb", "value": "T1A15163CDAD65F11781073F342D4E286CBCE6A94189B9D4A4D895C7E93C2906D8E26C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234771, "uuid": "b245c2f6-9fab-4451-b120-e9f1cf29b8ed", "value": "48:d24DdGn5eQxE6r7r5DGvq2QXMAORdXUMl1LvyzeipUEI+UdCt0TN7sGkIRY18LCJ:zErcy3X8XUXppIDdCkNoGyOHtj52TWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234771, "uuid": "00c6b574-d9e7-494c-aa55-467a99963f0b", "value": 2925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234771, "uuid": "7edbf3d6-38d6-4015-9b04-aa18c111210c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234771, "uuid": "e78a58ea-2f11-4805-af77-4ad19773d248", "value": "party_wall_agreement_neighbour_selling_house 2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869f4aaa-f6fd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628285431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285431, "uuid": "e3acf27e-a568-4fc3-82ff-b1af6c095b60", "comment": "Malware payload (RedLineStealer)", "value": "a15432e92d18c9f770b06b7fbecf68e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285431, "uuid": "66c6cf90-7444-4e9d-a16b-6fc5849fd8dd", "comment": "Malware payload (RedLineStealer)", "value": "261b33850dd1404b22acfd5fe7e46806dce68f710f9b21b7ec00a264804e2137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285431, "uuid": "e1c717fa-2822-4e41-9705-bcf9cba80dbb", "comment": "Malware payload (RedLineStealer)", "value": "ea6b2bcfa914ad069a5a4537a2a62ad3c8ac8c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285431, "uuid": "91b7239b-2e32-43d4-9b1d-ac45cc3aebfb", "comment": "Malware payload (RedLineStealer)", "value": "9287d316593b7f25905aeb123e03f2089981436a9ef333488cf02b370cb32f8bce22b6c5e8625e4e1d2711274806e760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285431, "uuid": "db255ba3-4644-4af8-879a-dddb3ac5adaf", "value": "T14D0633C23A228AAED9F2D5363A3927D75C11796D2458607FC3D0CECD7A877F2A597008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285431, "uuid": "a73cb365-4c88-49c2-9ebd-1374f9c8426a", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285431, "uuid": "9ca7f14d-1315-403f-ba1d-8cb298906dca", "value": "98304:J9QcAe8V4gdr3UrxlzQYR7xRKxMuukWUfHmSjXsUud56DO8L:J9bAHDLU0YnRGXfHDcUa56DtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628285431, "uuid": "1e4d215e-8093-4986-95ff-a89c0569c5f1", "value": 3742220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628285431, "uuid": "c016dede-8eef-493c-bb36-a73d2bc6a712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285431, "uuid": "8561e617-889a-452d-b4c9-79fb37d2c2bd", "value": "a15432e92d18c9f770b06b7fbecf68e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88f3e0c-f688-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628235371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235371, "uuid": "f5e13698-9a19-4172-8196-9d681a97ffd4", "comment": "Malware payload (RedLineStealer)", "value": "1cfd3a83d9cf05e3f35449f9d8d5273a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235371, "uuid": "76c72f22-9d37-46f5-ab54-b693b44a77ed", "comment": "Malware payload (RedLineStealer)", "value": "275cd3c09afaacc06adbdbcd5c638b5894c81eca008446454864b537f54593bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235371, "uuid": "7732596a-c883-4a66-bd26-faae09447c04", "comment": "Malware payload (RedLineStealer)", "value": "547af1250db68ac9001550bb4a05ff8714b6e64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628235371, "uuid": "0ec77e09-e219-4665-956c-849458c39c86", "comment": "Malware payload (RedLineStealer)", "value": "3edc4a4b36cf33fb82a2c43cb4ddebb88f0381113719969ace815c57991b8bc75938d0779ad6cb7acb235c2048578cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235371, "uuid": "8961b9df-b09d-4cee-b793-60f873839015", "value": "T1DA652203FAC188B2C7B009754669AB11597DB5300F289AEFE3E84E2DDA742D0F735667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235371, "uuid": "bd66e2db-2364-40e6-94df-afb88e2d9edd", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235371, "uuid": "d9d75e2d-36d4-498c-ae28-f5ec273faf51", "value": "24576:j2G/nvxW3WhzK4e1JoKhifKmijMF6FoTzx2BYJ1oMBcbajZh80fJWJzlNhy:jbA3IK91OCbjMF6uTV2Bg1oMBfjPjRWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628235371, "uuid": "fa1db493-28b1-4e2c-b3ae-d41411b57794", "value": 1439848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628235371, "uuid": "e9617ad2-11d3-4e6b-b99d-e61752dbbf58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628235371, "uuid": "d63eca62-bcd8-4303-86e2-954a902bf477", "value": "1CFD3A83D9CF05E3F35449F9D8D5273A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ca7b0f-f696-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628241325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241325, "uuid": "9f7987ae-5f69-415d-a25a-3e8de971f760", "comment": "Malware payload (Loki)", "value": "ef5105caed1d432aca814ba5eb4b9d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241325, "uuid": "1e7adc3a-57d9-4f05-81fe-506da84fb3b6", "comment": "Malware payload (Loki)", "value": "276df8a116116425e538bfea657c789006d45a6e9f2802f396154574aa0085e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241325, "uuid": "874daf55-1752-4803-9eb3-041f7e087ccd", "comment": "Malware payload (Loki)", "value": "d7d6f953700e1873d59728ae0f4aac32d33e7c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241325, "uuid": "11a8069c-5697-4d0f-94c3-ee2ea0110724", "comment": "Malware payload (Loki)", "value": "ce3fa1232874a39f2ab757574d44f1c569f7616ea954eb475685b8e442888869c4982352fb7246ec7d6d758994a53417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241325, "uuid": "a5ec4bf5-59a0-4df5-bcb0-2c9d1b0a6a4e", "value": "T1AF14E11C3A70CD76E55279F058AACB816A6BFC21CA3586077F5917AF3F202C12B3535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241325, "uuid": "b39267d1-3639-4c4c-9d61-ef0757317792", "value": "14314a2a561f3c740022851a022f21a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241325, "uuid": "ea8f3121-ea2c-474f-b8a4-875fb1da6c28", "value": "3072:JmZ4LE4JUUIbusMwdSLA68JI1lR5SrReX6owI8zxJWtk0+syVUI:JfLEGUL67wAPSrRgzwIoxJgTBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628241325, "uuid": "ea5cb83a-db40-40bf-a063-f0f84163df50", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628241325, "uuid": "9fa648f9-2d70-42e3-acd2-1b2addf6a47e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241325, "uuid": "fdc87237-bc0a-42e5-aa16-f1077f8a3ff3", "value": "SecuriteInfo.com.Variant.Zusy.396701.32036.27764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3aa61d7-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628253321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253321, "uuid": "be8827bf-cafc-4dc9-b1a9-e45e760c06a0", "comment": "Malware payload (CoinMiner)", "value": "3e71d2e715046c0f2e8241cdccbefe4b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253321, "uuid": "f7ee0657-9ae1-4aef-ad13-39159e5d0e89", "comment": "Malware payload (CoinMiner)", "value": "27db806a5b1919f930f40810624889f20bcafaa485c89d4ca522fe6335dfea1f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253321, "uuid": "98f79924-764a-42e6-8e86-0260e65614a8", "comment": "Malware payload (CoinMiner)", "value": "754f41de14a8e2e03a0df5d16d7c54c85dad1bf2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253321, "uuid": "87bad455-7eac-4b3f-ba40-641ca4da5ee0", "comment": "Malware payload (CoinMiner)", "value": "12e17bd1833ddf319f3dba0cfd98970f673fff647c640fa4e9332cb3350748902b5cf8db1d8ee5a15a256dd9f6d97c00", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253321, "uuid": "240e63db-4073-459a-b6b2-a8bdc5d625b4", "value": "T13D15CF90E584A616C58818BF1F3DFAB057EC9D8A0556C1823DD8DD173BAEEF60AC35C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253321, "uuid": "30ac35b0-812a-49fb-8277-5d4ae8502efc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253321, "uuid": "8aa3231f-f05e-4104-ba28-84d2fcca5558", "value": "12288:5eYYBqpmHXjNQWzqQ+Prrq5SdIBuIz++T46XQo0/T1jct2NjFWOHeF:5HYBTakbC/q5ScuIzdM6kjcMNjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253321, "uuid": "746581a5-fe88-42e0-99da-7d5366388f85", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253321, "uuid": "9c30277b-1386-4cb3-b398-e2574a3ef317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253321, "uuid": "14746ed3-c327-417b-b64d-c6c6d2689dde", "value": "Qoutation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac8756b-f6a5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628247776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247776, "uuid": "524bffbe-0c6f-412f-95d9-0b4a4fc10ce8", "comment": "Malware payload (CobaltStrike)", "value": "8b6f6e7be8c3364e565cc991c7cb7179", "object_relation": "md5", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247776, "uuid": "b6a992fe-ad57-4d15-ab1c-5b03761113c4", "comment": "Malware payload (CobaltStrike)", "value": "2874c64342b0deaca1f44aac74b0663926af3d039f0eebe5b20c0788ed6df4b4", "object_relation": "sha256", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247776, "uuid": "42c9f07a-4153-4b9a-8cc3-cc1cbb06a15f", "comment": "Malware payload (CobaltStrike)", "value": "d2aacfe6c36031bedf4fd7ca3e78d663811bc13b", "object_relation": "sha1", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247776, "uuid": "9041eff5-5986-4094-897f-d20ad2d74ff0", "comment": "Malware payload (CobaltStrike)", "value": "45335807e9070dd8b18268d2a6e3b6d86c5d3783bf828afdcaa898d16ae277d4db26b531525988bc1ccb46dc7712c305", "object_relation": "sha3-384", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247776, "uuid": "3028c93d-75ef-4227-bf57-ba79d6e8d41e", "value": "T10F521975EA0378F2FD1A897014EBB6FF9E73E2238C105C96CF94EC4158274BA881665D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247776, "uuid": "b9c88ff8-801f-4c72-9a4b-e0e3b8d96f15", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247776, "uuid": "c51d7cf5-54a7-4255-a7a3-1460dcf48bbd", "value": "192:AmH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzQbqUqV/Qjo7AGa:Ay+kGKqbOCdWIVBff+xzcfCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247776, "uuid": "1e11ee16-9d19-4652-8992-a19c4f1a91d2", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247776, "uuid": "28ad4bfc-e264-4bb7-a71f-4d1d7dafa5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247776, "uuid": "3abe886f-09e2-40fb-b7ed-62fcb4489c27", "value": "svchosl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e01275-f6ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628251331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251331, "uuid": "02277a64-891c-4c31-bdc2-68a98c69379a", "comment": "Malware payload (RedLineStealer)", "value": "52a85f92b9fc0a7560f10215719ddb8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251331, "uuid": "d64fe642-4113-4cd1-9af8-4d543ddbade8", "comment": "Malware payload (RedLineStealer)", "value": "2aa76bdc54bdf4a5f8a4ce81a9bdd14e6789eb1cc1565d8cac67e101de4dae63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251331, "uuid": "77698efd-3be8-47a9-beb4-7d605eb191f4", "comment": "Malware payload (RedLineStealer)", "value": "aa65bc5f88ea5aa118331ee4599a792351737604", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251331, "uuid": "73b6ab73-83c0-4aa7-a34f-bad59583c1b9", "comment": "Malware payload (RedLineStealer)", "value": "aac2296236144de381c369edc61114b077d8c9cc00142d3e48e738c6df6b10994e08cc0d652ffe8fcc9bad7ed5fd409f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251331, "uuid": "c46724ff-d675-4971-8165-bae16e7baed2", "value": "T190C4128235108F32E9A1BCB1249BA754566BF910D77401CB3A486BAE7F306E05F3E779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251331, "uuid": "0536b67e-2489-4e13-bf1b-0446e016c7b9", "value": "38170c4d65ff42b014b27008b95c5de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251331, "uuid": "964d9843-160e-433a-95af-3b4c2c20f208", "value": "12288:XX4dhgc5I1MPRLBfjtHMmtiKxlKz/pcilye2AlRDdY/:XXShgc5FPRLBfjtH6Kx0ZXXY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628251331, "uuid": "e5064c4e-e774-4e4b-b015-381f27609b0b", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628251331, "uuid": "f192ec6f-ac7a-4931-900c-a8a4a9227f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251331, "uuid": "4fd99d04-f43a-44bf-970d-6271e17b5919", "value": "52a85f92b9fc0a7560f10215719ddb8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79d96a2-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628256763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256763, "uuid": "a2a8ed01-888f-4ac4-8db4-940912de431a", "comment": "Malware payload", "value": "4daa823ec2b951fa3e35a60807f35c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256763, "uuid": "2bb2007e-417e-4694-8814-4042a132c08a", "comment": "Malware payload", "value": "2b4d71571285e2013568a2c422a2a2e6bbe8ac7e1401a71d19bf9b26bd2c9d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256763, "uuid": "5277ccf9-ca77-4e85-bfd2-3234979c58d1", "comment": "Malware payload", "value": "6cab9e246cfe4454ada60dcd37478286481580ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256763, "uuid": "f16769f5-e268-45c1-8055-c6c30fce4bad", "comment": "Malware payload", "value": "d689ed63281988844cfef1df7ec742aaf18e8b680967b0786ec6c89bc99f95ab574815a7eebc7e9846c6e235647bebdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256763, "uuid": "871a3772-3c37-45c9-8571-3d07a05a566c", "value": "T16C63F941B7D49311C69914B5C0E7163043F7AA8763B3E68A3F4486CB2E227E49DCEBD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256763, "uuid": "8d78bb46-4e52-46e1-8f8e-f93dfe5ac7cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256763, "uuid": "5e85d5e2-7967-4cb9-8eb3-24aecee1b06a", "value": "1536:j+s/4pEX0Lvx/79980c4K5vDu5UD7zlRxSH0:Z4pjN/7D80XK5LFDFRMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256763, "uuid": "b358b86f-4426-41db-aae9-5d9d7d233ff8", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256763, "uuid": "4131c3da-f97d-487a-81a8-acb8aaa0bf28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256763, "uuid": "6d56d3d6-8be0-460c-907e-31d6362f9531", "value": "Shipping Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205479fa-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BlackShades)", "timestamp": 1628256912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256912, "uuid": "7ddee51f-5566-4e31-bc4f-136f8349a495", "comment": "Malware payload (BlackShades)", "value": "82666a12ddc74522a4147900bcc0109e", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256912, "uuid": "d7ed92d2-89e8-4498-8bed-eb829d9d7d86", "comment": "Malware payload (BlackShades)", "value": "2c173c0d41c9c6904d6820225ea67c214d1bd6c5edd8c9aad238bc66b264c80d", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256912, "uuid": "dce0da54-86b6-4baf-85b0-aa56c358ebce", "comment": "Malware payload (BlackShades)", "value": "b36afc1027a6e1fa867f8f3feb5e44d60b577098", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256912, "uuid": "fb8fe0b9-0083-48e7-b111-601d6428866f", "comment": "Malware payload (BlackShades)", "value": "ba65ce2bc99f25fc08be40e7392f25a13f0788590d5f08948de8b5626af8ec0f26dcaccecbee844bfeebc8d35c87cefa", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256912, "uuid": "2091f736-b6b6-44e2-b4de-91ccdcc6af9e", "value": "T171D40175E359FC35CC2516322970B929462EBF41B824D8AABC6DF04A1BF77813094EDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256912, "uuid": "abc5d1eb-8fc5-4ac2-a5f3-850439ced868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256912, "uuid": "165403a2-c3ec-4933-a9ab-77cc9fd61455", "value": "12288:N7ugo4JHeIXqR1ZJGOUWzi+oBFEuneDbFZ1Q+K1hcXFkT+965+DHGHWSwE:cgo4efLDLhsEusbu+KXT75+DHGHWSwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256912, "uuid": "47af6e44-02b3-4caf-9dd6-671b1bbb4ed2", "value": 638592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256912, "uuid": "b4bdd42c-23d3-499f-aa5b-b2422bc2ebd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256912, "uuid": "800352b7-0f05-47ca-b156-c0c799a3d183", "value": "Invitation Letter.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9ac93e-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628252559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252559, "uuid": "2913d470-239a-4bda-8eaa-335f23adce13", "comment": "Malware payload", "value": "c84668aaa8f907ee0cc9d14c750480a3", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252559, "uuid": "bf8cb7fa-6033-4e49-88f2-5d4c42e75c96", "comment": "Malware payload", "value": "2c6ea9b40d366e1baba060aacc15356154c80756d5e1a9883812d3ff510b671f", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252559, "uuid": "a77c546d-1666-4ec7-9c73-643bc0f0efb7", "comment": "Malware payload", "value": "9f684bcb8e9961ce5d19ec1e22df6b2569ea9038", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252559, "uuid": "59193962-f012-49e1-8435-63c36f94db14", "comment": "Malware payload", "value": "f5fbcde2f55f2b30d5aa066692d6c05e0d2f66795079e472b4832f8e64feafdc58d4c22dc02957d97f352d82ddd2b325", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252559, "uuid": "e5bf282b-94dd-48ef-92d8-50e1d21d6fa5", "value": "T1A002BFD5EFE27720CD868F30418F2A4685275AF50E98970B8984D3BCD9927A15B3B1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252559, "uuid": "4935be4d-8021-43e1-bfcb-abc11c1cb54c", "value": "192:37XqK5kiFSR7OolPB3JqHVCkdat24HgTlym2BYE/j5kRB:3t59FSZOo1BY1CoavHgTlym2BNjq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252559, "uuid": "d17dbac6-bcdf-4542-b365-7d5ecb6f96a8", "value": 8496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252559, "uuid": "92368bdb-235d-4164-a31e-7a6bf2b0f673", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252559, "uuid": "ea8df747-447d-48bb-80de-17b022168733", "value": "7,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758e88f5-f69f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628245029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245029, "uuid": "6c142a4b-c0ad-4cfe-98c3-f43abca9c6d9", "comment": "Malware payload", "value": "47266eec238195f4d70edba436d4554e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245029, "uuid": "14d15c75-665b-4b5b-beac-ca5ded6cb0a6", "comment": "Malware payload", "value": "2d6424f4611e623f05560bcccc43c87819cb60488e0ada6f0eae17528f33a3b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245029, "uuid": "7e8b9c53-d450-4da4-b703-f91640832c2e", "comment": "Malware payload", "value": "f69068cba2a1a8fe822f513987fe2c734f7d92c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245029, "uuid": "522e7b89-5b56-4e15-a18b-b13ef28e73b0", "comment": "Malware payload", "value": "0608eb97c54abbdfdbde01d3bf8d47cb449cdf5db9acca432602c297647da05896cae9ced1d4b2e1a1d070cbacfa8d32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245029, "uuid": "55108df6-1c83-4c1b-8b3b-ca8192db4c7d", "value": "T1DE9533894BDD9C52E26B663E3BE0F70B9A045F6100C8130877B5B4A16ABD17FC796933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245029, "uuid": "41fb6323-3ac1-406f-a253-1c9764ba5dc8", "value": "49152:80F9P7Q3MQsEux212OiYTK2AIbNu2eiDw1t0t70pLs:T9DQcvfdOZTleixqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628245029, "uuid": "81b93c16-0bd9-4701-8ace-bee7d6a0cc30", "value": 1985536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628245029, "uuid": "4aa58160-bf94-48ca-a324-260a0322822a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245029, "uuid": "4ee115b8-b70b-4585-99ba-87d9c87aa140", "value": "47266eec238195f4d70edba436d4554e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83412526-f6ea-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628277264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277264, "uuid": "bcf0bc0d-5e2b-4880-82f5-8840115ba40a", "comment": "Malware payload (Mirai)", "value": "f6ea435c1beb0c0814e89d3ecaaa87f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277264, "uuid": "39b91fb9-5ac1-4265-807c-aee9a1fc4895", "comment": "Malware payload (Mirai)", "value": "2db806906bbe535c67a5f6967c51651eb0b86dbef2c17fba8735672f8362314b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277264, "uuid": "ce95999f-643b-46d1-a11f-c6b5f5cf132e", "comment": "Malware payload (Mirai)", "value": "426ae0ffb98730af0893412a8ab5a951c3a3b679", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277264, "uuid": "495c8d76-3c09-4b12-afe1-b728a49279b5", "comment": "Malware payload (Mirai)", "value": "361f44528f9ef0093f5c2ed9749051e6c949d724e811ca8b755408cdc93be91a097b49ef36ac734c8e841a905cd8ad82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277264, "uuid": "39ea0bc8-e225-4fe4-809d-3947a7dc0826", "value": "T1BBF2F05211CDE8CFC751D73116176BDA6903DCCE8CFE06CE09A8F86C496D1A95F8E906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277264, "uuid": "6f143497-abe5-4bd2-810e-c38eefaa95ea", "value": "768:ocRAvvNlYpOhJ+DqdtuUQdBsTNJdiuPXrNwfeaRZtyVHROAo6eR:VRAz+OhA2Gid/PXruHRjyJno6eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628277264, "uuid": "42b08875-027f-4186-8e2e-7cf4e497ddd7", "value": 34920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628277264, "uuid": "58338bb5-1007-4fee-8e13-7b8f5a3c566a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277264, "uuid": "ccf8b99a-13d2-45f6-b50e-f7779c7ad723", "value": "f6ea435c1beb0c0814e89d3ecaaa87f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464b8cba-f6ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628278880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628278880, "uuid": "b7f7320c-8d7e-4a63-9314-e44f7ad5e81e", "comment": "Malware payload", "value": "66da4f45cbae5079197f8dc2861bb6bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628278880, "uuid": "df727884-ca28-4f69-9d86-ceab77dcf236", "comment": "Malware payload", "value": "2df38c9ffc008ab333ee116a5ce147f5c58a7fd779f1ef155de47fdbffe9f1db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628278880, "uuid": "87939dcf-f9e0-4af3-b2b7-64984b3b351d", "comment": "Malware payload", "value": "1b5af185da03d3bcd86669c1500223f95e345367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628278880, "uuid": "ec1dae9f-710c-459b-9e69-64e42f8a9e82", "comment": "Malware payload", "value": "9030ca9b78d37b91d23bf119e27752d18acd4883db6fc135d50e4240818a234b60f7ff6916ad7b66e25c98c39ae5ed35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628278880, "uuid": "19c398b4-67fb-472f-876a-39e757c5f34d", "value": "T171B512D531997C8BE2424C31EB478961B204EE07E37B82753A1AF7C5EEF9174A216D0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628278880, "uuid": "a56fa368-db68-4b40-a858-defbe64530fe", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628278880, "uuid": "79406813-b74e-43a1-b3e7-ad9f0966dfc3", "value": "49152:/UoeXHCiOnEhTrev7KTfSHIxNCQPol5rcvaaAs5sEQ1f:coeXzoEhT6GTa+Euol5rHaA4sE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628278880, "uuid": "47b3721f-e38c-4a66-91f3-3d68f6b9485d", "value": 2408848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628278880, "uuid": "861581ba-5b9d-4c76-9a2b-f77ad7c47aec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628278880, "uuid": "a0eb3d8b-4e8c-41b3-a04b-72635a3fd8de", "value": "Syndicate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7bbc06-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628231564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231564, "uuid": "5993d041-e3b3-4ef2-a0ad-86b0b35d5252", "comment": "Malware payload", "value": "a3d0ef316fcd95050bf9c6340ac870f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231564, "uuid": "41b6fa90-76bc-4f62-a372-8c9fd249f840", "comment": "Malware payload", "value": "2dfdc495160b8492466dfe6108702ea44b5a7ff1b8d439d6a6dc9af9359a0838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231564, "uuid": "74ed8836-b750-4c96-8c9e-99c8679e47eb", "comment": "Malware payload", "value": "2a5a7284812fe11b84e52183fa8f5439afeb923c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231564, "uuid": "9eee5737-0dbe-42ca-8e7f-509be259888a", "comment": "Malware payload", "value": "1f3e7be68388b0110c51d1275a23081691f3c4e74d059bfbccc6396ddee869c41f429c65543b006b485c08094abc223d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231564, "uuid": "29301186-84ea-4bca-8c3f-89a68993d616", "value": "T11C95336AF3A1889FC8FB1EF84D334544B90966ED6C7B1AAC90779736F91448D2380D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231564, "uuid": "90e6ddb2-587c-4763-b40d-1f6c4ea14158", "value": "49152:nO+f2nEfPqumw8wie7W2uVwn8nKn/3fMyOB8qMU4824f1j5:OAgEfmw8TefuVw8K8DL+Tc1j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231564, "uuid": "1957ec31-afd6-427f-a807-8b4d9c1849a8", "value": 1993728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231564, "uuid": "a21313b5-8cfd-4e2f-b8f8-2447c2b0dba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231564, "uuid": "3ecee6dc-bf8f-45da-93ea-f01d63891bdb", "value": "a3d0ef316fcd95050bf9c6340ac870f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42752638-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252245, "uuid": "8935e60c-178f-4f8e-9aa9-fab6522ca810", "comment": "Malware payload (PlugX)", "value": "f782fa626b0c53d9cca2fbb29a65f23f", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252245, "uuid": "7c154deb-c718-45d8-97ee-2e37140c682d", "comment": "Malware payload (PlugX)", "value": "2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252245, "uuid": "9c809eed-5c1b-47df-a26c-6e6afdf8f9e3", "comment": "Malware payload (PlugX)", "value": "9fabc6c255ea94262b6339e4b5949174afd30114", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252245, "uuid": "921f41fb-0a81-4421-8ba0-279ac755d26e", "comment": "Malware payload (PlugX)", "value": "75a1418b9f5fb52793b5034e65f9e72390d58cb87564adf78bd933ee81b1f0507053d4c6a9165a3099e03e91c2eddf10", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252245, "uuid": "228e7a56-9974-42e9-b008-4f98085c0ed7", "value": "T1CBF31800E040D3B6E4BA40F94BBDAE5B257DA962071515DF37C29C3E79D2DE16B38E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252245, "uuid": "5172b86a-cb14-4bf3-81dd-96f8523d614a", "value": "397051b6d9c5c8b855041d0a2769af43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252245, "uuid": "c657dd59-cbef-4f8a-8741-e95cacc409ee", "value": "3072:SXZC1fhEIosP/HMP7kUj6IXE6i1xRqLCJVQPyR:uC1fWIpP/H67kU+I06i1DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252245, "uuid": "cf701195-6660-4bc8-be96-5531d0e5bf7f", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252245, "uuid": "5e90e09d-2406-468d-8d2f-f274519efe23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252245, "uuid": "6093c910-a5d6-4703-b2c8-bd542c950d5b", "value": "2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb85063-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (zgRAT)", "timestamp": 1628256965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256965, "uuid": "49b98a70-ed5c-45b2-8eea-367089812024", "comment": "Malware payload (zgRAT)", "value": "907c8cc629ae409033ee0a7f89a831f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256965, "uuid": "4fc39b06-17dd-4068-b6b7-eecbac5b68aa", "comment": "Malware payload (zgRAT)", "value": "3125dcaa097260cc2c569a569bb1ad45a8bb6a9d60cdadcabda5d5e71157e174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256965, "uuid": "82b23fea-07d8-4248-93a3-782519230f3d", "comment": "Malware payload (zgRAT)", "value": "55c1beb814e6a2d095b7e8f0985066478c816951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256965, "uuid": "c533e9bc-66f3-4167-a49a-b2b1eb1b9787", "comment": "Malware payload (zgRAT)", "value": "c221698f0ad89afd23c878af6d6a9b41e9abc912818cfea614175cb95e88833671958a2232159e9b9552e4bc062f5f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256965, "uuid": "49c83846-ce12-4dc5-8b1c-0f79bd447e3e", "value": "T1ADF4E1257652C901D3AF2A37CDDF40084FF8F9423A63DF2B799A329D0A523A768465CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256965, "uuid": "68d7dbe5-50e4-4fe2-a731-26e374a62c8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256965, "uuid": "141470db-4969-4a7c-a83f-def08843867d", "value": "12288:RzegfN/O4FVekt91G5ybCtSGU23RvlFoUMpXZ02sz0YTmklzugw0DNRt2NjFo:0K5eybCEbG3Mn02sNTXI30DNRMNjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256965, "uuid": "0e6c7618-464b-46e3-be3e-32562aeb2c28", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256965, "uuid": "2c7a44f1-e190-43e7-8be3-e6cc04f30094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256965, "uuid": "552fbc7f-c984-4250-a290-6daec5209b5c", "value": "Payment_document00591742.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a597d9-f67c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628229864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229864, "uuid": "bfb54106-eccc-49e4-bdb9-cb2b4368683f", "comment": "Malware payload", "value": "d75a3f726d5b780c8f294a079902a32f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229864, "uuid": "080ee4e0-2e23-4922-b306-b3eafcf9e6d4", "comment": "Malware payload", "value": "32de2e309f6b794ef23b504cb8cabdb79a78984c7fc428c6722491c9b32d49cb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229864, "uuid": "57ffdb56-e38d-443f-91af-004c1b42678b", "comment": "Malware payload", "value": "e87d60f18fac13406766d3362b14baffee9982b0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229864, "uuid": "426cdc03-e63b-4cb9-989b-372f1ae2bf0d", "comment": "Malware payload", "value": "4ed1af1d3d598b4114a9891fc0a9882f0ee3272ae1a61ed8783a2c0bb4788b0e760d2020fbf34d8a0faa496a2e613cd6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229864, "uuid": "90ecfeb2-b130-44e4-92fd-8fcb3c74c1c1", "value": "T18C03DF2BC509AF57EE89CBBEBF9201BEF3410295F24271CC2956CD4FDB15B014A2A164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229864, "uuid": "0d5038c6-9f8c-459c-99e0-d8ecf8a2b06e", "value": "768:hCScgzbAHO0sYa3SIUt56qt+NCgOYALRArbCg7:oSNfAJP733gRGRuG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229864, "uuid": "f5595dd6-4e41-48fb-882f-ca612c908db8", "value": 37863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229864, "uuid": "3812aba4-c501-4318-9d6c-ec9a4ebe8f84", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229864, "uuid": "1d3de48c-114e-49f4-9116-fd81d100dcde", "value": "a. Summary - MED014.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac093159-f692-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628239537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628239537, "uuid": "74ff9a31-ee27-47db-b2e5-84cf0da8a818", "comment": "Malware payload (AgentTesla)", "value": "cfbbb36700468918bc86e83edc30c6b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628239537, "uuid": "1ef0d531-13e5-4723-a405-af42deeb85bf", "comment": "Malware payload (AgentTesla)", "value": "33990c7027bd2b71b3097729edcadbe6d06a4b8746dabe85e251793f64022b1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628239537, "uuid": "2c794d4f-1c47-49e8-978e-1a467cdb8dbd", "comment": "Malware payload (AgentTesla)", "value": "49192f1ba346d9c18740c50b965c1190592d65c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628239537, "uuid": "4e628e54-6aff-4817-886e-70e61909183e", "comment": "Malware payload (AgentTesla)", "value": "bc42789bbd1af3c1b226093546d5e76ab0f64ff3a741af791424f0a3275a058ce980f5717f87556f5cf2958b87faeace", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628239537, "uuid": "c1fbd264-3f4e-4ad9-a7b9-b39ccfc611a4", "value": "T12D05CF247AED5314E5BBA774463292004BF6FD3BD72BCB4E2C25305C9AB3A824712F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628239537, "uuid": "dac68089-b9da-49e6-bb44-a4377e72228d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628239537, "uuid": "67b6da53-9e55-47d8-90f4-d9ba24a9d246", "value": "12288:NcaQxt8DBSpObgDPwFVt2NjFEvm0RVdsNVdps6Py6T9CgiRHmhbuJ9jzry:E0b0wFVMNjem0RYNxG6TkbRGhSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628239537, "uuid": "efdaf4dd-a7fc-4f6d-8fc6-17f9df199d49", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628239537, "uuid": "07803ffd-103e-4b1d-a6b2-86235b266a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628239537, "uuid": "ed8d1f97-16be-4b01-ba03-84f1404538c5", "value": "ordre 1486b Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a9829e-f654-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628212975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212975, "uuid": "bf3c0702-8b21-4207-bed2-a74ecc8deee6", "comment": "Malware payload (AgentTesla)", "value": "9397f9ef101f1d09575e585705fb95d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212975, "uuid": "fcee0a5b-cbe3-4a40-83b1-9437098e5817", "comment": "Malware payload (AgentTesla)", "value": "3409c1f1c5f2ea8d70638e1719ffe45ce11ff3a4068e180b581ba4befca4d50d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212975, "uuid": "f1ffd5e6-b247-4821-b592-0f6efed55fcc", "comment": "Malware payload (AgentTesla)", "value": "0576e3f4bb3315afe6cab04ae9c1e6f54ef85afb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212975, "uuid": "0446027d-d6d1-4320-946d-5ae5f5dbb263", "comment": "Malware payload (AgentTesla)", "value": "ef16d9b87531ae2628b0b2aadf30466dfc431b4db3abd637e372adb9a0016617136c6d8fd23675bfeb709aee8d2d4075", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212975, "uuid": "dc2736bd-ec3b-4072-be12-f86525cd3e94", "value": "T17E05F1227651D801D3BEA636CDDB40084BFCFE013663DF27BD9E32AD4A1237699465CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212975, "uuid": "425b8b54-e37a-4a37-a74f-f56f8d5d78bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212975, "uuid": "6e1fd528-f5fa-4df5-a082-db071d71e5c8", "value": "12288:aT/+WvsaPIMwgDyVqOhdkbX+EVDXendE5m3FL8hOxKQp/tmyt2NjF3:aTBIMlDimD+EVDXenC5aOCKetlMNj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628212975, "uuid": "7164ed38-59a7-4d2c-ac14-5a5915f02d54", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628212975, "uuid": "fcb69f85-07e9-4b28-b822-8a2a40d793c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212975, "uuid": "e53c00bf-6b42-4644-ba3c-8b9148555a17", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.28121.24348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939d04e8-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628231765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231765, "uuid": "4fb45d02-7dd2-40a5-b649-23a06dfbb10c", "comment": "Malware payload (SnakeKeylogger)", "value": "010fc8c62909d925afed08701a446395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231765, "uuid": "45b1444c-75b8-4ccd-b24c-503778e0e877", "comment": "Malware payload (SnakeKeylogger)", "value": "34424457e08f19db15e9901f47deb53a4dac3ba8646ef3d07f753e1316b83f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231765, "uuid": "954141bb-f05e-4af5-b536-793719e980ee", "comment": "Malware payload (SnakeKeylogger)", "value": "69c52143fcfd5b57b157aea6c5319bd0737fcaee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231765, "uuid": "f8ca715d-cdf3-424f-9762-e4d4d46c0d39", "comment": "Malware payload (SnakeKeylogger)", "value": "739abed2e33eb344700171e8f2adcc3977e708195c47faa24e10f09e756b00bbc59009c6f3bb4b4b147a202c8c726035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231765, "uuid": "f448980a-380b-4127-80d4-7dbbcfbd30fc", "value": "T1D5F45A2229EF158DF3B39BB60FC4F8BE56EAE573571AB0B638910B464322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231765, "uuid": "5a16a35a-688d-458d-affa-a1997ef08ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231765, "uuid": "4510650e-9a28-4aad-80cc-cc677759366a", "value": "12288:d7P7oR65AXwgFvuSSxsBp7iOiP+c7XGxTQawvWdFCjukyJAQpWdECE/K0:1oR6qgkuOQ+meTQFvWdMj9BPdECE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231765, "uuid": "3543a797-ae5e-42fa-bfb4-c37815857161", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231765, "uuid": "e2b64db6-4d89-48d9-a9f7-76b4d85c6448", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231765, "uuid": "173e27a5-9ab1-4ce2-a9ac-c1be86b5e489", "value": "010fc8c62909d925afed08701a446395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19c4857-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628256780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256780, "uuid": "8e1fe00c-d591-4a7e-aa57-543d103517e2", "comment": "Malware payload", "value": "9087c87d6cb74d5c1791f3f27fa68586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256780, "uuid": "db2ba92e-1ca1-43ae-8dcd-c0ef70389d41", "comment": "Malware payload", "value": "34df71e1c8afa4f4909ee40372ad547fc67d2d7d97ded03b5e0ced87b39b2da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256780, "uuid": "01832fda-d69e-4dca-a828-c12728d4c470", "comment": "Malware payload", "value": "70a0e7d031787ca88aec2dfe355c02e42c9690f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256780, "uuid": "2234e76d-25b5-452c-b409-5ab31da52af5", "comment": "Malware payload", "value": "e2112bc6941da138b4f74086cf7c4b2c69a76166c1d43598a3c5472756e21b6c5060ae651302766c5bf0d185cd00e5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256780, "uuid": "89452d04-6534-4b83-b344-9003dde591f3", "value": "T17425D02A15E04907E63CCD3C1956A16BF174EEC6B4CDD68BECC72C47D639B8225806BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256780, "uuid": "cc03bf20-c855-459f-92c1-e73ca13de33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256780, "uuid": "2f591fec-a257-49f2-8ed1-474598e5e33e", "value": "12288:Gf0/nU4XJmZPSufsmNzXO26VcwWVmIP/bnEK3hc0PoLj4E6SdHjW85m+b3aWClsD:GflZdfJ+2nX7EKOgonrtjFHbqWCKhEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256780, "uuid": "7f2a4053-2f16-4654-9933-169d597d3cbd", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256780, "uuid": "1caf0e69-f942-438a-b99f-05165e6c5002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256780, "uuid": "94e69f58-99b2-4896-9077-b26ea932fa5d", "value": "Invoicel-datasheet.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ddc2ee-f696-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628241320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241320, "uuid": "547dc5fa-1446-4a43-8637-8c86172efcad", "comment": "Malware payload (Formbook)", "value": "e1ad89d88c9ffed81a10e3b2e7a323c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241320, "uuid": "16328637-c714-4f47-80e1-712f932a47ca", "comment": "Malware payload (Formbook)", "value": "34ff91c0be47c6edae673081f4814ca9b7432d6db4975ab66a911f36fe481d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241320, "uuid": "de817bf9-dbcf-4f72-9c11-8236b1d534df", "comment": "Malware payload (Formbook)", "value": "0888d6bb8344a647f353ac70ed5737e99bc613d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241320, "uuid": "50fa5ab9-6e48-4b30-9a8c-5d489508324c", "comment": "Malware payload (Formbook)", "value": "eebb5279460722327416b64e288287756cad8b5c7b467e566f00b47c92f0038dfe3a1bec9f7b6b6350f5c3eacbed2916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241320, "uuid": "ba98f057-e127-448c-b829-feca261ff1ef", "value": "T1B3F40115A2985B68E43E5778293000402BF4F2195B36EB5FFFC1A4ED4BE7B18439BB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241320, "uuid": "a52347b4-67e8-437e-931e-a68ae92a4e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241320, "uuid": "12053faa-818d-4522-a42b-dd617400ff61", "value": "12288:WaM+DkFpOdNfVhMkRVuWYfCdEG8dR8BwSDVoB1kAJR0OpROdt2NjFO:/DMOdNf8CdEGPmcoB1zodMNj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628241320, "uuid": "ae730756-f27d-4b2a-98da-48f098969e34", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628241320, "uuid": "b11648d4-4179-4283-b7fa-9772aead46fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241320, "uuid": "31f7b048-2a02-4823-9a86-23d464aa2bb6", "value": "SecuriteInfo.com.Variant.Bulz.591793.28369.23931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598ff3f4-f6a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628246700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246700, "uuid": "39ba4846-2fac-4a50-a4d4-788ca64c466f", "comment": "Malware payload", "value": "a5d73c168b845709a0ee66bf2ec04f28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246700, "uuid": "dd37886f-2781-4d52-a105-705a3e43d8a1", "comment": "Malware payload", "value": "3660451767a88435db24c6a55892706fa3c167d5207d78716a13704fc9f2e9ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246700, "uuid": "ded9147e-7dd9-407e-a3a6-796bf78fe3a8", "comment": "Malware payload", "value": "9c679bc7cef2e5d12cc64f34adf9e10b3e7da0f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246700, "uuid": "a9611975-b6bd-44f4-a05c-41a8ccd8df31", "comment": "Malware payload", "value": "d65c80c8487e97ed06d6e28336b7ddedd1aa27dec40aa4b48496fdf24196210ed210744253dd70bfe59bec9e9ca8e44d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246700, "uuid": "436e6026-c075-49a8-b18c-00f4288289ee", "value": "T1B544CF97BE989806DB0803375FCBC2921723FC21AFA2DE4B31C9B71D69367935941A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246700, "uuid": "d69f2cb7-334d-4692-874f-2c2d2cc06b9a", "value": "6144:3k3hbdlylKsgqopeJBWhZFVE+W2NdAF0mW1LVLIlymSgZYdDqvyh1M1cr7z7tPC:X0B1LVLIlLSNDq6hScHta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628246700, "uuid": "bb34f0c0-6280-41c6-a1af-40952170664d", "value": 264709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628246700, "uuid": "ab379c28-7703-40e5-869a-150aa263cfd2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246700, "uuid": "bc735e1c-f27e-4ea4-9f11-d21984a5381b", "value": "3660451767a88435db24c6a55892706fa3c167d5207d78716a13704fc9f2e9ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed5c8bf-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628252695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252695, "uuid": "1be84eb4-6c17-48d5-a958-d3bab78d703e", "comment": "Malware payload (NetWire)", "value": "c43dfab7c0f6fed061463f255c9787a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252695, "uuid": "d2203572-293f-4a75-a4b1-1dcd670019ba", "comment": "Malware payload (NetWire)", "value": "38effbd1f70f9c1b7a4ef499b2cce40c8ea78d6ae65662655b5306ba76d7f542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252695, "uuid": "33f15ff4-f73c-4363-855f-d41c94a7e055", "comment": "Malware payload (NetWire)", "value": "46354ba0f0cbfc148a19d3fa0ab50b150bee1155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252695, "uuid": "d2eaa2ad-aec9-47ac-82a0-2beff3cf3159", "comment": "Malware payload (NetWire)", "value": "a60cb368123d08c0c4fa4b26dbe0ca4b2dcc6c49e6324176ebc407586607b1f1984ff45c14f3f1a658139c03e557c601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252695, "uuid": "01429531-e3d2-4b53-99d0-2bdbdbf78345", "value": "T12C34D007B3681056F58B45351474BABB4E329DB09A909C4BE782EE4C5DF2BC2BDE431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252695, "uuid": "1e55ac47-2d12-464c-9f08-16a13ea9dc1a", "value": "fb0fb8edc31fffe9bb05edbac608d5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252695, "uuid": "2ffd65a7-8399-4c20-9f09-f81931dac997", "value": "6144:ELRCw2gunh+9ypWrbqLq6cXSiyyHpl8dHz:Ofwnh+9eKXBXryMple", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252695, "uuid": "e0e70edc-8e87-4134-9aee-4e0adda9e850", "value": 245240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252695, "uuid": "fd05c616-25ea-44df-b0e3-6b8247dc984f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252695, "uuid": "cd6ec5d6-0ba4-45cb-8e71-e005d2dcc029", "value": "c43dfab7c0f6fed061463f255c9787a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908c5e9d-f679-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628228754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228754, "uuid": "c2b12298-3584-44e7-a40e-8aabca552264", "comment": "Malware payload (HorusEyesRAT)", "value": "c396fcd76492fd9cc11e622b6c432412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228754, "uuid": "67a82f3a-f1d9-4f81-9803-d9f05822cfc6", "comment": "Malware payload (HorusEyesRAT)", "value": "39698d4ab922d098c2b7e85e48e9417865c77eb39a0b95f8599c26fef8a7a4ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228754, "uuid": "e903508e-66d2-4e82-96d2-c89b29c2bb68", "comment": "Malware payload (HorusEyesRAT)", "value": "0864474454657fe492a47ec846a3578a12661b5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228754, "uuid": "52e1ab93-aa9d-452d-b53d-457ef484f136", "comment": "Malware payload (HorusEyesRAT)", "value": "aae3fd368f58a767665bed4dca11c9269db1e27166ea8e86829db9cf081eb92a6d9d5ef155b97affece7d80d6e7ad6a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228754, "uuid": "b2fa6be9-12cd-43be-b1ea-61b52b391a70", "value": "T195F4F11F7A5CE7DEC100A9B5897FE1F20B39362B5883CB8238407A5A56F1D5C1E0B95E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228754, "uuid": "4ce3b2b0-f899-4119-a47b-aef5bdd917b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228754, "uuid": "771450ec-3c7d-4656-b3a5-4d98c8f9d90e", "value": "12288:Bhbz8b+QcZd2n1mM2u1Wqg2JR4k3AULev9eHdrafDbDPu2M4qbmMrb2/hrvcO2Jl:jjQMCoH2JRXLeFDbbu2Pqbmybcpsorob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228754, "uuid": "83ffb7bd-9ab1-49fe-9bfb-a4bba90a8c96", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228754, "uuid": "3c74a7bf-5525-43fb-9d49-1de0356c4127", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228754, "uuid": "0c01ec5e-12fe-45cd-afd9-b4e48cce44d5", "value": "SantanderModulo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea8f858-f6d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Neurevt)", "timestamp": 1628267754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267754, "uuid": "6b65b7d9-e089-47e3-b8da-f967f174d449", "comment": "Malware payload (Neurevt)", "value": "b9091ef41de734fdbd7c7df7b2a5ea20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267754, "uuid": "a1dd730c-a51c-48bf-8fa1-4fd4e07cc027", "comment": "Malware payload (Neurevt)", "value": "3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267754, "uuid": "49eec53f-e062-40dc-9599-3712f2389cd4", "comment": "Malware payload (Neurevt)", "value": "4d313c6379933dfcfc79cab04a7c83899862b0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267754, "uuid": "71265ff7-d8bc-4655-aa34-3986582c4887", "comment": "Malware payload (Neurevt)", "value": "36dcea881c76ece3190cd47663b856bd4575ebacbece19e264c8bc2143465194a1e2b3be523cbcbecf8ec5b769b0839a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267754, "uuid": "fddbaf2f-7512-4e44-a6a4-8c1670f8e034", "value": "T134641386B1C1E8BAD5E752B22D33BE7A82E379590114CBA777446F339C30656CD27232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267754, "uuid": "daba6639-06b5-493c-a45b-b0a1926400a0", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267754, "uuid": "e4a939d1-2b27-4771-97ee-a4b71cf8bb2e", "value": "6144:E1onIw+yeYJGW5jt6IAqQXkZ52XZFF64v9VXbBkl/TEJf5:soIwZ5HQ083FPlVX6p+f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628267754, "uuid": "1ae1596b-35b3-4246-b0e0-4a3f33514fb2", "value": 324356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628267754, "uuid": "d2679eaa-8006-4e63-8dab-2e190716962e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267754, "uuid": "6ec3fb66-522d-40b8-b02c-9ae49b41def6", "value": "3AD3E9FECA98BD1C94415F0319340C3C9416541F4592F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34ae6b9-f66f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224598, "uuid": "2ec0ff9a-accd-4722-a6c1-82bcb4345c8d", "comment": "Malware payload (Mirai)", "value": "adcc60c96ca6413ed63104ba62ecb847", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224598, "uuid": "47bc59e8-0c71-47f9-ace9-56c423356b4b", "comment": "Malware payload (Mirai)", "value": "3b42c7116afcdd8646fc99112e5cae579e03e7105cb6cbd22a073e7bf185fd9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224598, "uuid": "00cae1e4-1f7b-4163-b668-f8a28eac1dd9", "comment": "Malware payload (Mirai)", "value": "74a7e19875bb3e825b575076ea7cead670a9ba3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224598, "uuid": "99c99c30-ef38-4e78-bbed-bef5ecc47045", "comment": "Malware payload (Mirai)", "value": "6b94d9d86a610f86633ae966edb70a28a94cb564f12b79d3528e1b87b2d77f8adaa8178431a5156972a53bf6c6ed2d01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224598, "uuid": "0253d651-74a5-4cf5-9d40-ed4873cddfc4", "value": "T159633999B4029F7CF84BD6B990170E05B92163C547C30F2BA6A6FDE37DB3054AE26D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224598, "uuid": "7dbd945a-3e02-478e-9c36-7c761e133f46", "value": "1536:SCIDy1ka41+KjyIB8Ok/zAZunbGpjlQqYc:SCIDHae+KjHU/Bbol1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224598, "uuid": "19748164-7dd4-4cf0-bf82-16b3032e2721", "value": 72324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224598, "uuid": "1179ff85-fdfa-4274-baca-c6246fd99104", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224598, "uuid": "9f93ea90-696e-4a60-b53b-80be7dbb02e1", "value": "adcc60c96ca6413ed63104ba62ecb847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58f1d3a-f6be-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1628258451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258451, "uuid": "6d53fa95-a459-4a17-899a-8b6254ade92c", "comment": "Malware payload (Gh0stRAT)", "value": "43d85d7ac639fdb67b756c977c46e03e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258451, "uuid": "11b8b079-c75d-4e3d-82f3-ef02bc50bdfd", "comment": "Malware payload (Gh0stRAT)", "value": "3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401beeb704513a0d97763cb54", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258451, "uuid": "5affadad-449a-4da0-aabd-8d7eea95cf24", "comment": "Malware payload (Gh0stRAT)", "value": "dd304803bf067ea3cd9a0a44255fc73c3639d9c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258451, "uuid": "1cdad179-8a6f-43e6-8d45-237f87227f7d", "comment": "Malware payload (Gh0stRAT)", "value": "68440cb13c7bc7a7865ec3e612a7475fb1c4473c4885ecc87c4cd8281cfb2f2756ff0929b7afd6bf874268777651a8d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258451, "uuid": "25cac824-176e-46f2-b33b-244cf8d8f9e4", "value": "T1CF342385B112566CEA9B4F3A12975A03B3229275080DBAC6DF9ACD27D7F263F3435312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258451, "uuid": "e8791a15-56cb-498b-9b34-6d3868905ae2", "value": "9b821a35d20f9a8955f8d5e54b175675", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258451, "uuid": "33a7b742-146b-47c0-82dd-6f7f7037254a", "value": "6144:EoKI457oMLCUfZwOvVh6lz2IvMql5i1IWaS67ANLr5cc:E57owCUfaKh4z1N5iCWaS67Ax5cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258451, "uuid": "da71497d-db48-4cb8-85ca-a0ce81efc6e1", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258451, "uuid": "5ab4a8aa-d593-454b-95ee-c3ecbf3cac1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258451, "uuid": "98a3a097-9f61-407e-ae44-99cc73471cc6", "value": "3b5ce6a6dfa672d7d1f4c4b9fe0f6571cecea58401bee.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daf4499-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628257552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257552, "uuid": "3e3ba97c-e799-430f-804e-90e54bf2e2e9", "comment": "Malware payload (Formbook)", "value": "2dff0088cd70e51e064c7e7393e53ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257552, "uuid": "79b7fdc7-2fbb-4e14-a053-b061e41724d3", "comment": "Malware payload (Formbook)", "value": "3b612f10d1f41e30c40ce875d094f2e78c8744d4b3647683fc6af2212da4e233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257552, "uuid": "d113a950-d112-4090-9751-302b5be26780", "comment": "Malware payload (Formbook)", "value": "d7db4332d9815e1645c89594666bb133eb881f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257552, "uuid": "c755e010-a6f2-44dc-bf42-7d95066c9deb", "comment": "Malware payload (Formbook)", "value": "c33f81c56dab244318b26f3c614295feea6dff2b43c05abc7131213d3b4e000a7f04020252e7cee2c67549691ef5517a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257552, "uuid": "921e433c-80e1-4214-ad73-89bac81b9c9d", "value": "T1F334121FA0231B31E02558749BD165F9485D0AB2CBD219E4DD42B5BEE272B309BF8F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257552, "uuid": "c68b49fa-e699-425d-ae2d-a3e43fcece5b", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257552, "uuid": "d6078cfa-363e-4ca8-bcfe-0af03378f188", "value": "6144:SHa7kigAgZKA1xG7plOkMdpHnJCp4XStzADm2nTp:v7xgN0SxG7fNMrHM4XS4m2nTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257552, "uuid": "ee8ea9c4-2681-442c-b6c9-d1c93c379c30", "value": 234286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257552, "uuid": "1198dc23-8f7c-4c8c-b4ce-da141c22fb5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257552, "uuid": "a6e5be25-0844-4d70-a679-9852a79b8d91", "value": "scab_document087654321234567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6c563b-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628256803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256803, "uuid": "436a263c-1eb8-444f-864e-2f33e2461536", "comment": "Malware payload", "value": "e6b556dafd087a3d79f48f8e86e09a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256803, "uuid": "d1924b9b-239e-4f18-bf40-d25c9f9544ee", "comment": "Malware payload", "value": "3c1f3dca6ac8776c79fba50e2a2b605f907964e9eeeff4891b8c9b4b27cdec24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256803, "uuid": "5bcf4ecd-17be-4b42-992c-b9a9b44bb8b4", "comment": "Malware payload", "value": "f9f8dc6436787f2a7a2e3adc2099fbf95b9f3924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256803, "uuid": "22642db7-532a-4e48-aa31-4a9784c0703b", "comment": "Malware payload", "value": "3074b7fb007537c241a5fa11b017f0de8058dfef61ebf2d997806199757ff3c63779fe0aad332b4206563b15b0a9d450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256803, "uuid": "8bd5fac8-d7a8-496c-8d7b-d78f37816692", "value": "T1D5B583E4B8290DADE58E316DFAC4355AB7F3AAF8B938998E0DCCB5157C205E044B441F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256803, "uuid": "f2c9b36c-16c3-4065-9a0a-9fd61d97483d", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256803, "uuid": "f71889e5-738e-4d0e-9d6b-94489f3dd3fc", "value": "12288:8hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aEoH0I3T1oVAI:0RmJkcoQricOIQxiZY1iarH0MoV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256803, "uuid": "882c5581-4e5a-4dad-a68d-97bf373483ae", "value": 2368206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256803, "uuid": "7629f7ee-bc29-49c7-875d-a584281318cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256803, "uuid": "4de9950d-f9cd-4206-ad6b-0bca9205dbbb", "value": "CMOYDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dce3210-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628228964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228964, "uuid": "35ba635b-11c8-4ab2-9bae-ffb74258cf9f", "comment": "Malware payload (HorusEyesRAT)", "value": "cb89ca5e71e10df0943613a8aa6e689a", "object_relation": "md5", "Tag": [ { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228964, "uuid": "430ef3d1-9aca-4914-a4ec-d3143302a5b4", "comment": "Malware payload (HorusEyesRAT)", "value": "3da1839278ac4d7965aaed37d048a3124ad5eaabf31915acc8bc97533f7befca", "object_relation": "sha256", "Tag": [ { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228964, "uuid": "18c24b1d-95c4-4564-91ed-e143a9687ad6", "comment": "Malware payload (HorusEyesRAT)", "value": "8cf4bfb63449f1bc50fa4fd8cdf4dca3af027ef3", "object_relation": "sha1", "Tag": [ { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228964, "uuid": "7db69cc3-e8a9-4d69-a37b-b721ebe1d5a9", "comment": "Malware payload (HorusEyesRAT)", "value": "43f20469721b34a27881305583c50f5521a1dca87ddad810660bad5b3cfcc287a0b02409c4b294a9d5b9d2e3cafbb9bb", "object_relation": "sha3-384", "Tag": [ { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228964, "uuid": "c5bd065c-1417-49c7-a5c9-75a64bd08720", "value": "T1304723EE66209C79CD4527BF71120E53FB7E8184C0BD6819B8C6B03A5AB730E135A57E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228964, "uuid": "b1b76905-8830-450e-b594-b41d20b5afd8", "value": "393216:il7gE0lLbj2ln7FpFUc4g02bGfrWSxhcyOB9b5qiGYhTH0AEKC:c7e8nJvz0vrW/z1VJ1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228964, "uuid": "21fdf06c-6b89-4496-8076-b078abf08215", "value": 24759290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228964, "uuid": "b45e2984-1894-488e-9c35-c18f93733ff6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228964, "uuid": "e1981ff4-b354-4bff-b12a-7256b0761991", "value": "HorusEyesRat_Public-master.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32195418-f6a5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ShurkStealer)", "timestamp": 1628247493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247493, "uuid": "126aa464-258b-4802-8233-64b321f2dde7", "comment": "Malware payload (ShurkStealer)", "value": "74d9427d5f06e83790361ce7c2cadd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247493, "uuid": "afee57ef-6167-431d-b31b-674c18fe4c23", "comment": "Malware payload (ShurkStealer)", "value": "3dc83821af5e8c315cfe4c710e603bf776e866f99f41532dd280d411bc103725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247493, "uuid": "0c9316b1-ed4f-4a9c-b7c1-decbd269f850", "comment": "Malware payload (ShurkStealer)", "value": "608fc51e8b018264c8879528d9dd81bcd8319aa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247493, "uuid": "588e7a02-3f0a-4fd7-990c-8e030539fe35", "comment": "Malware payload (ShurkStealer)", "value": "7f597aae99b508536a0ebd235876038e6365145ba6e52cce7487e38f209709557ce6057940ea0291970f0171864d7990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247493, "uuid": "d1176746-95f1-49b4-8262-110f4d8ca92a", "value": "T1BDA4BF12E5B1C171D517A47007BCDF7289BEBA300A6199FBA3C41D6D4E311D2A73AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247493, "uuid": "47b0182f-7da5-423e-8e37-dbf5adf1c15c", "value": "f78ec1580e5cf11dc31a5258bb19ce5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247493, "uuid": "e0685eb6-a688-4940-ba4f-40de21f8769c", "value": "12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSPWpJDalpS6Xq2EVUfdm:7WTkqKfrTko77i3CXEigVVSPhlpSy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247493, "uuid": "a3fda977-8be4-4178-91aa-0366a61d7cf6", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247493, "uuid": "e4fe19b9-e6b9-405a-810a-897c780db847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247493, "uuid": "d563c0c6-3a4d-4faa-aaa9-83fcca18daa1", "value": "3dc83821af5e8c315cfe4c710e603bf776e866f99f41532dd280d411bc103725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddf9465-f6e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275913, "uuid": "bdf07506-8683-4a08-b298-84c0ce9a7747", "comment": "Malware payload (Mirai)", "value": "fdb1d801aa5c7c6f4a64cf900c48c15d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275913, "uuid": "f82c00cb-4a36-4924-a4c5-7768239e8a39", "comment": "Malware payload (Mirai)", "value": "3fd2f12358fa1005036471977f68afffbd4608ab9486612eb68366213cec1de0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275913, "uuid": "d77fd4b9-487a-419a-b281-162ad52a8143", "comment": "Malware payload (Mirai)", "value": "25c84d2a0d8d060b9d9b5168ff6c939f48e10f0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275913, "uuid": "d332b1cd-4774-4938-b959-57fb1bf3b632", "comment": "Malware payload (Mirai)", "value": "10184c28c763ff0a6d0c678e1ceb9321f9e66c932c8672c42940a9887180e90583b0a80429f84b83bf6ed82426adfe95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275913, "uuid": "600c984b-fe4b-4c68-b4af-894b8f19bbd6", "value": "T1C1D2E0A2D3C06929E7A1A9724C64FDB11291DF85F3CDDA03151C56690FB1F87C8EB0D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275913, "uuid": "2282875b-a622-4a0e-b752-9a01a547c614", "value": "384:My791P51eeqmaVrNyNgORVxmzKViUF23Ep71v9KJJyROFsbeYgN+PyPPVpjUcIxE:Ma1h8YBNNx/i8xVKLywcJgZnelvjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275913, "uuid": "7e02b8fa-1c06-491f-9898-db329036e661", "value": 28552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275913, "uuid": "06f06e54-17b0-4cb0-8bd8-0a2cda94c221", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275913, "uuid": "b04ecb52-a821-4cbf-b6c4-dd843bd58cfa", "value": "fdb1d801aa5c7c6f4a64cf900c48c15d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4387d36a-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628253106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253106, "uuid": "4c282d1e-2704-49df-84f6-3e9251cef0d7", "comment": "Malware payload", "value": "e5a0a215ecfa2adce667dc6460829581", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253106, "uuid": "1a1f4894-d365-417d-aa08-705f8efcb22a", "comment": "Malware payload", "value": "40741d22b740ce06d607e5ee8e8ae8f55bef454bafb32cb51de5f13c47bb2846", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253106, "uuid": "13e93a0b-3dd7-48f5-a5d6-bb1f876345ea", "comment": "Malware payload", "value": "61626de90241f4ad713e59e72f76a8da9a08577f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253106, "uuid": "caa0a08a-5963-4138-8071-94ba867ee371", "comment": "Malware payload", "value": "3fc41075f34ab0aa876dd924eda7a491fb11d06ebc5bc1862d0008135e8c1b873021185b38e51978fb8665b6a01f637d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253106, "uuid": "592d062c-7940-42f0-ab85-9385191d79a5", "value": "T135F3D00366414742F52E8274EE63938C2F25AC5CD992719F226B3F4AF7B53724A2C739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253106, "uuid": "6e1ad3b8-e56d-43d7-b21b-f4776a30714c", "value": "3072:w6VFVUTsBf53VnT5RZzO3iyXn47STz70eAPLA9j64lY2v6fQTw:BVFVUTsBf53VnT52353DpkAA4lPioT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253106, "uuid": "73db7bbd-921b-45c4-9d9f-0c607a998753", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253106, "uuid": "c5f162c6-8242-4167-bbf8-8975a357cc30", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253106, "uuid": "f0b577cd-8f6c-4142-b145-8ea927103492", "value": "Authorization Letter..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e42aee-f6f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628280866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280866, "uuid": "8d37c182-061d-4ac8-bfa9-c1435d0bae5b", "comment": "Malware payload (Loki)", "value": "8e47b5e0749459f6ce98d1045c604f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280866, "uuid": "a00e7658-8ed5-4c78-bdf3-46fc2a5fe837", "comment": "Malware payload (Loki)", "value": "4198007277ec99bec08e407732a82faea47b1042a2432bf26b002142ee14fe69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280866, "uuid": "0163cbf8-b23c-434f-ab6f-6555e1f0dea3", "comment": "Malware payload (Loki)", "value": "cf4ef28a46b00565ca4a420b655ab53a92b8fe15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280866, "uuid": "89cfd34e-b18a-420a-a6ce-118e8b772a65", "comment": "Malware payload (Loki)", "value": "4174bc79fde1f2c31b34445967579221637164cc61f5aaadbc8c37bfc735ab9350398455f12c35a4454af2553ac314cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280866, "uuid": "e7c53d45-524c-4dc7-9118-3004a8f23da5", "value": "T1DE05CF243AFD2314E1BBE7744635A2404BF6F63BEB17C74E2C64509C9A73A824722F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280866, "uuid": "095949f4-dbb2-4c63-9a32-b482201dcc4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280866, "uuid": "a8f55df2-d8a5-4fb9-80bf-c02eb3e47a1c", "value": "24576:lLb0wFVMNjknM9lwti1ZobEaqxX0w0w3:lLYwFShknM9lIa+bENxX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628280866, "uuid": "8bc1324c-3650-45ad-9e3f-3654c8145497", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628280866, "uuid": "de5414ec-499d-40a1-9f50-2a6206ea4b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280866, "uuid": "9f4608fd-c357-440b-8a40-60cf780ba630", "value": "Bill of Lading, AWB, Packing list and Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d911c64f-f6bd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628258081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258081, "uuid": "ddfaebdf-3dc4-428d-93a4-bee70f3e05e9", "comment": "Malware payload (TrickBot)", "value": "03637247f00592c84c61e3a40aa0537a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258081, "uuid": "542ac0fb-4d81-4b5d-b193-7385fd0560aa", "comment": "Malware payload (TrickBot)", "value": "4395417b093e4e54ecd0373827dd3b67caa8a4a52679af7a7467a1cd6d951667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258081, "uuid": "bdd490c0-0ab4-4b5c-924a-a509129bbccb", "comment": "Malware payload (TrickBot)", "value": "791da349e06f0ec449ca371f02bcbb5f46e93ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258081, "uuid": "d968d872-10e0-4678-9398-d0aafb643160", "comment": "Malware payload (TrickBot)", "value": "6b508ba0d317a33da6e7f1c593156e1419d2f25b23f721d1f3f5e94ee5b4256a6b422c3c933b79a3b2f56ff4e43f2e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258081, "uuid": "fc73ccc5-275a-4dcb-9604-ecc546bb6627", "value": "T18E053D8F7C530A28DC431977FE0486EE8966DF54EE54E2176283F52E6AB14CBE831E44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258081, "uuid": "c7b19c5f-948e-41cf-8383-6b63d9621253", "value": "c751286c14021aa783bbe12910f00ae7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258081, "uuid": "ab59e9f7-af15-4172-bb9e-5befcfee606a", "value": "12288:DpD/MO2pEPBOENPyB3BrdVYze1b9stDfCXc5n:FPJApLCe1MTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258081, "uuid": "bcdcaad1-5130-44af-97bc-7f51443b2682", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258081, "uuid": "fb7b63fd-c7b3-454f-9056-50fc3482a72b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258081, "uuid": "874a176e-5103-45f6-a23f-1b567393aa63", "value": "03637247f00592c84c61e3a40aa0537a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae12903-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628231777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231777, "uuid": "dd8990f0-7239-4e31-883b-eee27f77f5cc", "comment": "Malware payload (Smoke Loader)", "value": "a0f04ce667b56a6575b625ab2bc035c0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231777, "uuid": "677f66dc-e0b8-4a41-be7e-6e915c601b34", "comment": "Malware payload (Smoke Loader)", "value": "43ee2974cd7669252f7749c8f304f9c0d564154694dfc043acb9df528e57b054", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231777, "uuid": "d86dfb17-1ed6-4605-8e2d-332a25e1fada", "comment": "Malware payload (Smoke Loader)", "value": "c8fa394a64ade241fed4c64e389d70b9e8de68f6", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231777, "uuid": "50ca5c5f-7d82-4d02-96ef-3a028e5aa4f7", "comment": "Malware payload (Smoke Loader)", "value": "5110f3d6f0077102e54d7c0703dff9223f6b8596d1fe18cf28d224cac93ab742e57208ecd5c2d882e8574f72fa520763", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231777, "uuid": "17e3e081-86f0-43e2-9bb3-38d2955504cc", "value": "T14504D0217A40CD72D15139B028A6CF926BAFFC61DA2489477F991B8F2F212D25B3531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231777, "uuid": "0afa6e1c-96a5-48ab-877c-72e446d8907a", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231777, "uuid": "3748faa6-b4cb-4b7b-968e-be84e3d6235b", "value": "3072:dmJX38LJN77RbidOlpV+WURgLiRxQqRu060/1zxJWtk02syVUI:dfLjV/TURieQqRL/9xJgLBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231777, "uuid": "fbcbe74d-ff31-45e7-b11c-89d1815fd024", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231777, "uuid": "78bceb9f-b4a8-44c6-9192-e513d9f49e6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231777, "uuid": "a5ac5166-d790-4213-ae7c-6a0059ecd1a3", "value": "a0f04ce667b56a6575b625ab2bc035c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e298a1-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628253135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253135, "uuid": "6836568d-129e-4e66-87d3-aa335e630976", "comment": "Malware payload (Formbook)", "value": "b1bdc26944639f40a50b61a173b5fad1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253135, "uuid": "e98083be-3872-4ee9-be54-1bbbae53ee71", "comment": "Malware payload (Formbook)", "value": "4406e3dc44f1ad394f993770c0307ee3cb97718ba09790643f6d0878ca931001", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253135, "uuid": "21ede26e-827f-40f3-b6b8-45a61d21485d", "comment": "Malware payload (Formbook)", "value": "048ece0eb3842c90858a3b2505516aa9b7393cbe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253135, "uuid": "ae483976-6d86-4915-801f-c23be108c3a8", "comment": "Malware payload (Formbook)", "value": "9b51b73d4043db518af5a886a6bf80cffa83d12262d55b8194c6f69d93b54f77eb771cbb4fbb78695249309bac617523", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253135, "uuid": "a8fcd70b-35ac-48f1-b055-b764359f3d2f", "value": "T175F42383C5AF249D1F7D621714255B2D1D2F48128A9314CD7B81B3248CAE2DAEDAB7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253135, "uuid": "45280ebf-a3e4-4aa6-bd1d-7b900a9b0eb7", "value": "12288:DzUIDmZRBCohidz8BU0URSC4qqqixRTOaWr9wxzKSlnq113u0vfmny7DRF:DzUVh+z8JC4nqeO9RwxTq14IOnyxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253135, "uuid": "67cf1dbf-339b-41e4-905b-284a4f1229e1", "value": 747937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253135, "uuid": "ad3d0d2f-18c1-4429-9557-b99af5f9b9d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253135, "uuid": "80d6f6ab-d348-431c-88c2-d29e16938caa", "value": "LIST.KRT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd04a89d-f6b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628256316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256316, "uuid": "3ec96564-2dfb-4a94-9ea4-96e0e0491041", "comment": "Malware payload (Formbook)", "value": "31b142cebbf97b880ead6a2dc3f415e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256316, "uuid": "8f789c0a-5eaf-4abd-9ef8-630718aacc95", "comment": "Malware payload (Formbook)", "value": "4411b4a05f3bc654dc86eba66de02e9a20751357b57a411468eee55cf3c879ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256316, "uuid": "10a94991-eb0d-45ee-96bc-6e36ca7661c8", "comment": "Malware payload (Formbook)", "value": "b8b33c7492e0c6a25b2677f1126663d06a91fc2c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256316, "uuid": "e26f92f2-be1b-40bc-999d-4b415a19ff5b", "comment": "Malware payload (Formbook)", "value": "8581371b70a595cd938c5114032532ff464d1d6537af5ff7926cb0b4843f98630279642b1b8959c511fbca5c00cd5fc5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256316, "uuid": "1282140d-9036-4b22-b5c7-59918aee3797", "value": "T1BD7523E3A0866FE1C0DBA8F074E2D8AA1D340D43269D6DE37548FBE9587B93583C915C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256316, "uuid": "67f1821b-73bf-4155-8bb1-a91424fb3fae", "value": "24576:9vv/qvKcOeEnZ9c+YO/sx10hPtmZtseb6aLeirPX/SVtJEAsx7UB7o:9vaD9Q3cFJzImZioeirOq7UB7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256316, "uuid": "9d711a2f-e53b-4694-8d6e-475fab0b8400", "value": 1567000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256316, "uuid": "e95dbee8-4c52-452f-ac85-14d263c87397", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256316, "uuid": "34762d68-29fb-4253-913d-f78d9e710d94", "value": "FX-Transfer-Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70356b3a-f6f7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628282816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282816, "uuid": "cc874312-8d7d-4241-88bc-30b51f423d5c", "comment": "Malware payload", "value": "a86d2af2833f8cc15ad5bca904660fad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282816, "uuid": "de6e07ae-6c8a-44e9-8af1-2dafeefae677", "comment": "Malware payload", "value": "447aa2f5e42261abf74c0dba5a5abde2563dd63a55a92e9926749df9746fe72a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282816, "uuid": "444313c5-2659-4d1a-8215-a1d2e801915e", "comment": "Malware payload", "value": "27ac50bc1372142e8deb22b20935f3bde102e438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282816, "uuid": "eee5644c-1868-4aff-bf9e-c1be5384731f", "comment": "Malware payload", "value": "14c7588d0fe9d1dbb45c1a2f82e77f5d6c21ba301a46f4dec58abfd473227c2163c4256a708ebaec627103f923d7185d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282816, "uuid": "01e83498-dddf-48b6-95f3-a91f83a29075", "value": "T1D4659F21F6429036F8E300B685FE47BE9928BA21031454D7E3C46D7EAA719E27E37717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282816, "uuid": "943a0695-2ff4-4f48-9d97-3f657293a713", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282816, "uuid": "ea19dcc1-ee33-412a-8c5f-b6a68e15243a", "value": "24576:u8TJtpd95n1HCEei6gFT/L+V3F+kyRejskFL/whBZhnHo4Sad5RKrE0zudrPC6ew:tJtpx1iErFrLK3F7QojUnHo4Sa0rE0Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628282816, "uuid": "cd4d9a50-d8a9-41b1-a7b9-d3b3401f5e33", "value": 1474048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628282816, "uuid": "d2637449-3433-4603-af6f-4ed48355ecdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282816, "uuid": "c4c3632b-4cae-4428-95f9-107ca702f067", "value": "a86d2af2833f8cc15ad5bca904660fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4075477-f653-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628212600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212600, "uuid": "41d216c9-d383-4cd7-b806-3b4ce8b31cb4", "comment": "Malware payload (Loki)", "value": "b253da13f9f3d422640c449b96494a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212600, "uuid": "2168ec8d-c7e9-4b23-974c-6d6cde4ed99e", "comment": "Malware payload (Loki)", "value": "45bf191a26823f2c36d5b1f74d9505c5ea5caca3f61aa4012a03589cd22b3284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212600, "uuid": "440220b5-0ef2-488b-a807-eb73d4119879", "comment": "Malware payload (Loki)", "value": "d181aadef105972d41c55a671575866a7191a307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212600, "uuid": "635c2011-9907-4da8-8988-aef75e3ab11a", "comment": "Malware payload (Loki)", "value": "33ee2da4bfffe84a8e7b07723b00d2cd3a213dbac0e55b7ddddb97cfdbcecc871d4ae205a4f26be2d181c0563b824999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212600, "uuid": "be5349ea-2140-442c-b461-d2c639b296c7", "value": "T1D834018469520749EC63D679534C72766A3FE9012F3E840B9D520CBEDA6C3A2FE0FE51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212600, "uuid": "7b741416-29a8-476e-8915-ab9ce0c06805", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212600, "uuid": "58133fce-e36e-475e-b26f-ba04105e46ff", "value": "6144:NYMyeZIdtCuz/clFaOL7mMGHDVoLvgxVZyfTof4:6dqlFjGH5oExVov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628212600, "uuid": "56c9c0a9-b3a9-459d-97c6-2f326fa0243e", "value": 237527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628212600, "uuid": "6ceb18c3-8617-4d63-94e8-9621100f91e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212600, "uuid": "6974ec06-c959-4c40-aa93-b48de4cb28bb", "value": "b253da13f9f3d422640c449b96494a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5210931f-f6a5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ShurkStealer)", "timestamp": 1628247547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247547, "uuid": "c62a6aff-4e11-43e3-bac5-d20681ddbe7d", "comment": "Malware payload (ShurkStealer)", "value": "5d5c4906b9fc098fde8d5124f5f3b284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247547, "uuid": "e8cecc7e-816c-412b-816d-2b70e7093fe3", "comment": "Malware payload (ShurkStealer)", "value": "46450a5e309835d161d4e8d834835e46f8329885a7fca0d560226e526692b0f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247547, "uuid": "7df6790a-0af9-4849-82cb-43a94156c8aa", "comment": "Malware payload (ShurkStealer)", "value": "347dd37f6a946206bd334fcc3f90782bd7750f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247547, "uuid": "3fcfc397-545d-469f-b495-7bb8b4e00354", "comment": "Malware payload (ShurkStealer)", "value": "8de9ea02a9193a237bc002bf33bae2fef3fce678e9cbaf70a4b124cb03db455886d657907ed34262946d9eaab562f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247547, "uuid": "b90d2603-abfc-4787-b22f-765dcb65483b", "value": "T183A4BF12E5B1C171D517A47007BCDF7289BEBA300A6199FBA3C41D6D4E311D2A73AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247547, "uuid": "6d9bc8ff-7e62-400c-8d47-6a148faee5e5", "value": "f78ec1580e5cf11dc31a5258bb19ce5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247547, "uuid": "7bdc5929-2f69-4d8d-868a-9f33835f0fb6", "value": "12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSPgpJDalpS6Xq2EVafdm:7WTkqKfrTko77i3CXEigVVSPTlpSyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247547, "uuid": "09bb804d-25e6-4e44-ab51-b4a0d673415e", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247547, "uuid": "aa588201-c5ff-490e-b7df-6d5a5ddc1020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247547, "uuid": "3e57f658-98b9-4520-b486-08a4b9843a95", "value": "46450a5e309835d161d4e8d834835e46f8329885a7fca0d560226e526692b0f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fd540b-f6f7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628282826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282826, "uuid": "3842382f-c18e-4d67-9b12-a9dc33596422", "comment": "Malware payload", "value": "9192eed4f3433a1fe590754041c0a0cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282826, "uuid": "34e975a3-9dc9-4ad1-bd9f-e17d8b64044c", "comment": "Malware payload", "value": "47d35b344cc8c6ef8e8ae82899655f0f1010d2af4f3c0413e124b9ae94378362", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282826, "uuid": "975d7d4e-7870-439f-8266-af82d3941063", "comment": "Malware payload", "value": "418b2ced928bda145299323e2e162ccbe2fb4454", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628282826, "uuid": "446166ea-9408-4c30-adf2-275bacb9baca", "comment": "Malware payload", "value": "9ef6792e518b73efe4608792dd766095b874008f5e7537acb01751e32d719edc829cf019755996a4e32f90118a4b9358", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282826, "uuid": "1f0bc49f-6497-4971-b8f1-495f1d7210a8", "value": "T156659F21F6429036F8E300B685FE47BE9928BA21031454D7E3C46D7EAA719E27E37717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282826, "uuid": "bc707d49-df2e-47c7-b0a2-1dbc80582821", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282826, "uuid": "3c97fd61-2300-4f55-8084-9dbb1b0fdd6c", "value": "24576:M8TJtpd95n1HCEei6gFT/L+V3F+kyRejskFL/whBZhnHo4Sad5RKr00z4drPC6ew:jJtpx1iErFrLK3F7QojUnHo4Sa0r00i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628282826, "uuid": "69d5a207-3e88-480b-9540-b0d620a21382", "value": 1474048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628282826, "uuid": "08fd43b9-851b-451f-8fa2-861b11a7bcb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628282826, "uuid": "dd129d25-2137-4586-b3c9-2913592492b7", "value": "9192eed4f3433a1fe590754041c0a0cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285b1203-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275394, "uuid": "849b6f55-8ff8-4cb2-9ad0-74f97dbc7892", "comment": "Malware payload (Mirai)", "value": "fa25303e07763fc53a5c6665f1d620c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275394, "uuid": "258b575b-c792-4d3e-84a6-989ecac6b420", "comment": "Malware payload (Mirai)", "value": "483f86726cb976c06339b97c192c3ebc189c3ce43ced0ff773c9c42a0d91a6c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275394, "uuid": "82fd9cf1-6963-4a1e-a7f2-6d15a4830140", "comment": "Malware payload (Mirai)", "value": "6a05e3b6e6329f92450cd45a9d168fae19ee80cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275394, "uuid": "3dbe08b8-ccf6-4353-b942-94974c5155e1", "comment": "Malware payload (Mirai)", "value": "5e2175a2c38e539238f2d24a32230333a47a82bac9097d3a14b273b8af56c4c0b362b5f5c6da2187d65094ab50e7f0db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275394, "uuid": "81f54acc-2abc-4ee6-b503-02358a1058f4", "value": "T157538C66C1B85DA0C54949B07228EDF48B53A404AAD37FF1C683CF654407BECB64ABF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275394, "uuid": "d2102487-bd3f-4731-82bd-1937c187f6a9", "value": "768:waWS//tSsRSij1quwqP3m0+lH8FLalajDiPV44g5N2tS7QKmtBL5QqRR/VD6in3z:waWS/FfAYeeJ4YEScKGh/UvoClvCos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275394, "uuid": "3bcfd5a2-66b7-4d93-b8f5-29cf08b6fd59", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275394, "uuid": "b587c18a-66fd-4c60-a6ee-47e9288c9bb7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275394, "uuid": "1ad2d9d2-9af4-404d-9d3a-b5302a554300", "value": "fa25303e07763fc53a5c6665f1d620c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68c5513-f6b6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1628255044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255044, "uuid": "1f1c5e06-7c13-4c16-bc67-f82ba0620421", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0bce8a5e688c5b01944888fa78475f18", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255044, "uuid": "d9806232-4420-40e4-9fea-36dc38485d03", "comment": "Malware payload (CoinMiner.XMRig)", "value": "4940200e009c811c47fe102fe47b20f32cf6b1abf309759b24b6a4f79a26b708", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255044, "uuid": "5e097979-3395-4cfc-8528-a2020e9b47ae", "comment": "Malware payload (CoinMiner.XMRig)", "value": "a221f48f0c1abad0bcc91c7b92e8752afeb17e18", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628255044, "uuid": "40d85a84-976b-4a13-8b5a-b3c0af0f947f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "8a178a2d59d6a88c0181222bd233e494f9fe499dd01ecf4b9320b85df173f597bde80d40b44fb38061349d0044de4a40", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255044, "uuid": "b0ebc2ce-bf3b-4e08-b103-80a7e5e1b920", "value": "T1A3E2E019937ACCF3F2320F381E2453E552B6EA2A5DB5673F06D06A270DB06159E90A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255044, "uuid": "2dbbe508-ff7e-4c17-959a-3da796b3b416", "value": "768:uwf0dvEI3I2BmmDKNgjSTbd8cSw4RrpU205YFYCknoV:u5dsIVVDKNuSt8nJN8MYbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628255044, "uuid": "8ed5280c-546c-495e-99fd-9e22585975c8", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628255044, "uuid": "01eacc33-68fd-49cd-8026-86bfd02a5eae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628255044, "uuid": "93ee20af-ed8f-4fff-af4d-459c23fe0e0b", "value": "yyyy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4beb66d-f6a1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628246021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246021, "uuid": "6b56d774-d9a9-4d2e-a2a6-ede49c03fe6c", "comment": "Malware payload", "value": "6453afe61fcd25f72efb86202365f84d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246021, "uuid": "a3b1a4f1-b376-4ddc-9ffa-2008ceb22ca1", "comment": "Malware payload", "value": "499eae9a096054df68b9f2cfff37fb0b9393fbda085e05a01dc25bc5ee011020", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246021, "uuid": "5e256360-fd1a-4495-8ccb-c73f14e90efc", "comment": "Malware payload", "value": "08266ee7d7aac833e04ca037a5435f0438c6b973", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246021, "uuid": "eba2a807-ecd7-4736-9bfb-e48085da0ac0", "comment": "Malware payload", "value": "c94a7adb8dd017d4dbcd5a86d907cd9f99da0fbbb508955ac687998befcfa668a49c6d172da52c61604e64142fb4eb32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246021, "uuid": "ef6aa370-a8cf-4b00-b17a-e1b2e27d6e01", "value": "T146724A17F3136CBAE41A10F06187E3E12785E56B27929E1A8398EEF51061131796F70F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246021, "uuid": "0ac74d48-2fbe-4a83-997e-0917e5bca6b9", "value": "d4611b7489fd661cb9dfe61054934715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246021, "uuid": "2b2fb35a-701b-4d3e-8ffd-dbeae148d3d9", "value": "192:1/C7qjiqT/1jzhSezaf022+mSL9kD42tftUfoxXJElxMfMZjqpiFnbI+C45W5:tCCnZXhSeOf0226LmT6H4TiFnLZ5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628246021, "uuid": "a8006978-bb69-4e82-9a24-a455a4fe4852", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628246021, "uuid": "3054928d-74c9-4803-9b9d-65768b68c651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246021, "uuid": "c8e67667-150d-4512-a0fb-d7c4990d7e10", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06856fe-f697-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628241746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241746, "uuid": "519165ae-73fd-4e78-94f7-6f2e3fbc205e", "comment": "Malware payload (RemcosRAT)", "value": "656956260724815646ff9b83998ebcbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241746, "uuid": "97b8fd18-501a-4716-9d89-07ed8dbc9d8a", "comment": "Malware payload (RemcosRAT)", "value": "49c7a57f44a76d4cea065a5b4c7fc66190b46d2042f867f1e4789eaf4e56d470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241746, "uuid": "1270cb1d-dc43-41ef-9856-b65b77e76f03", "comment": "Malware payload (RemcosRAT)", "value": "3b715d8eb6768b0b0e9e34c50a6397402b73dbc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241746, "uuid": "6b48dac5-8498-4419-a0db-efd9b8807872", "comment": "Malware payload (RemcosRAT)", "value": "5e7abc952ae02bf018b7ca440dea7781f1205bbe100a917943627c9a271a45c376848c6eef090b17dace3d6fa4f74937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241746, "uuid": "2d881156-b21e-4b6e-a346-da1306a70b9e", "value": "T1D815B54421132C48E7186B3C41EE556D1E61D5FEFC7888EEB7AA2FAD548F548BCF9082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241746, "uuid": "75d0f3f2-bdba-4df0-abab-42e967cefb4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241746, "uuid": "54198181-1249-4b9d-97c3-30adbdc181cf", "value": "12288:jB11Vt7syT8RJJ58bOZmZHGGPVo5yOnpBNq2EjaQEkNWkXgQ4:jFVtYyKp2zPPOpPEjaQEkN1Xgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628241746, "uuid": "bba8baf5-8396-400e-a0cb-ffc5e45ef226", "value": 955832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628241746, "uuid": "36f06739-3e8f-4e3c-870a-a4f7d015c504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241746, "uuid": "c341ea31-32df-46b7-b08b-09c076a73d29", "value": "TM_0938736379387TR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9bd720-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628256990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256990, "uuid": "8185eb11-b018-422c-8ae3-483caddf0f50", "comment": "Malware payload", "value": "d74c9409fac1db403b27c24429bec9aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256990, "uuid": "21f1df61-2255-4426-9eaf-e8dd2a7c71f5", "comment": "Malware payload", "value": "4b304cde3bdd2df4155089c1ef0e1eee949dc82899dbc5e1f2662bfd6113dcd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256990, "uuid": "d23dc617-8f34-40a2-b410-5dfc920ca505", "comment": "Malware payload", "value": "c3e33edb056395c1367d1b41e917f4893d934059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256990, "uuid": "30adc96c-b9c3-4276-94a4-3bb4f632a5ed", "comment": "Malware payload", "value": "8c2b7f81e2a4e733154d3ed8e7036961bc6711690b1b2150b280d2be62786eed9a668178dbc0c74aabcefc42fe3a2efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256990, "uuid": "cd7ec28f-4449-4f94-9f4f-6cfc8a98bbea", "value": "T13854E102FDD142F0F175887545F7906A953FA5158FA0CAEB17CC02BE1E296D0EC2BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256990, "uuid": "02bd32e2-6e0d-452e-8c11-a98e70d46516", "value": "eb692bcafb7844ec23ba375a9c36b95e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256990, "uuid": "997c26a0-7c21-44d4-869f-b65ef2bba2c1", "value": "6144:RfAn+VymyRPaHdGlMqy3AxZNKgw2QYZB7oo6ZnaGB/T:RfAOBYSN73A7NKgzJdZ2nP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256990, "uuid": "f0ac02ff-73f6-4351-a2cd-02522837475c", "value": 300995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256990, "uuid": "de9cf811-2149-4a1c-8700-723641668a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256990, "uuid": "bf575ffc-6909-40c2-b323-f73a5b7d4006", "value": "QRT02135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8aa33c-f67d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628230252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230252, "uuid": "9881edcd-f14f-4814-8ff9-863ea48ca1a8", "comment": "Malware payload", "value": "2cd4216016be95674391ee01fb7469aa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230252, "uuid": "f4ea8206-9827-4cae-b256-a62875d5b3d4", "comment": "Malware payload", "value": "4b7c7ef8d00b24fb61bb332cdce16768544c0db09830e817942affe32f630e48", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230252, "uuid": "3b67b15f-6158-4857-b69d-4c33dde3c21d", "comment": "Malware payload", "value": "e14b8a211f6cd6933ed73228a4f5e3842c43ff4b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230252, "uuid": "0c0831ab-23ae-4aaf-b7c9-acb1cc2f085c", "comment": "Malware payload", "value": "983eb5d97b8148e442a94df5d549664fcdf48a81ebb21f3839a9f12b15af320720ea1cdded1f4f8cddd058cfd36d0407", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230252, "uuid": "0dd5dc3b-59bf-4049-8766-1d008459299b", "value": "T1015423BFF21B081D6F59886ECF7CF4101A347D2116D1986F6A3A77C72B55E0EA029C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230252, "uuid": "ad8d48dd-45fa-4b71-a1fe-0d5d6bc89ab5", "value": "6144:2zJLUrot1Ll//tiGSe4L5qwZFgWuI13fg1lRNkoopHorP5VJJX:2ztRtLj4c2CIdfgbRNkRpHorxVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230252, "uuid": "88543e9f-d029-4672-8c6a-48ffd2766c1d", "value": 289744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230252, "uuid": "7e829210-941a-40d0-a697-2a2fd6d5ffc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230252, "uuid": "fa449c6e-619d-47f7-90c7-27ed5bfe7334", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c289b23d-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275653, "uuid": "4885e881-3aa3-4b15-8ed4-cdeaeeeadbd1", "comment": "Malware payload (Mirai)", "value": "45207ff9165edf9257b9820cf250e5d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275653, "uuid": "1b66c45c-b56d-4f5d-85b5-5a2a84a65eec", "comment": "Malware payload (Mirai)", "value": "4bf600f2b6baf26eecbfe08c99023e968466db0813305473973a660fae3b5efa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275653, "uuid": "2cb6aeea-b87f-4556-aaac-167160ce3df1", "comment": "Malware payload (Mirai)", "value": "65b5af9f33581c3325afb1d6adb2d142df444f0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275653, "uuid": "d57115fe-b0b5-446d-acb0-c68ccb2896f8", "comment": "Malware payload (Mirai)", "value": "e246e0fcd02a377547c0a84f34803009a533646250caac9ba60264af8a7e89c50040672eb04b3d2b515c421a449a0ebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275653, "uuid": "5da243eb-2568-4802-a599-888085b5ace5", "value": "T15AD2F1D880444C3FE92A8BFAA3AF5FBDA119FA56076ED7CA550C19CB5B5313910110BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275653, "uuid": "aa65c14d-cf3c-4c5f-8934-0191b85f464f", "value": "768:jRpCCvlLMNvwYDLD0RymFGXzQ4fvhElHJQ19Gm5LS:jRzMBDLD0xIc4fcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275653, "uuid": "c7ed5121-d166-4998-9064-17d3039ea463", "value": 29740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275653, "uuid": "67485dbe-4b18-41e1-834c-c212dd04d914", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275653, "uuid": "05f58af0-b92f-495e-a8b2-ad6fdd1f6063", "value": "45207ff9165edf9257b9820cf250e5d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae90815-f679-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628228798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228798, "uuid": "94cb8a1c-7778-4aa7-a066-20d1b3289013", "comment": "Malware payload (HorusEyesRAT)", "value": "8b982d2179165f31d1815bf266a555e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228798, "uuid": "f0604dd6-07df-44f4-b863-1505a2d0590b", "comment": "Malware payload (HorusEyesRAT)", "value": "4c1b0156ae10399cd738495c490b4586160ad4f28d5fed767c593baefd0fd893", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228798, "uuid": "9574e802-d769-4655-97c4-a2c35410e135", "comment": "Malware payload (HorusEyesRAT)", "value": "3b071b3e15d9076b9aa7448d69e8081f5d410747", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228798, "uuid": "8abe8626-dfb8-4131-9ff0-f86518bbcdb6", "comment": "Malware payload (HorusEyesRAT)", "value": "617349135f5a1a8dac5dbf35e234498510c60756a85544346713b844042071e4bb6362c64e3c612e1647c2fcd4127851", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228798, "uuid": "23df090b-be05-4f4d-94f5-c2d96df3db41", "value": "T128C1A511B7E80632ECEF1B71ECA363514BB4FB4089239BAF5588911E6C567088DB1F74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228798, "uuid": "7472d3d6-c448-49e3-9878-7bc92717123c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228798, "uuid": "b0e69900-92de-4623-ae84-3676144ec8e9", "value": "96:c2Fl/3CswTRBXSiBtV+0UyxP+LdtOa8N:cS35CMoTMO+Ld0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228798, "uuid": "69408c0a-3506-4491-8daa-ddff62ad4ed3", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228798, "uuid": "2ca6d4cd-12df-4e20-a1af-02e0bf8b67ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228798, "uuid": "ca3ed371-f586-480e-84dc-e4ce2d7d8932", "value": "Options.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7537de-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252287, "uuid": "2a13ed5d-6e15-47ce-837f-47db4d6ad577", "comment": "Malware payload (PlugX)", "value": "ef81a01e614a3a7c7a06171e8ec463b6", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252287, "uuid": "92f1b8ce-fcf3-4c90-9c6d-5d1d5b11478f", "comment": "Malware payload (PlugX)", "value": "4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252287, "uuid": "fcf210d5-c955-4346-89c4-38b13674da5d", "comment": "Malware payload (PlugX)", "value": "499cceeeb6485b34233b85fdbd5e26397423f0a7", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252287, "uuid": "4dc46c89-aa75-4e35-bbbe-63baac5b809f", "comment": "Malware payload (PlugX)", "value": "2c34f8fa5010aaff1e2af2409e0163d1b6b94de682f48fe6c1d2775b3e6bb6aa44c160cd6ee42b5d849cb340bd02213c", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252287, "uuid": "e81e0d65-a4de-4cb1-9685-e8c4894dd440", "value": "T13AD32915E140D3B2E8BE40FD4BBC6E0E267EAE65471405DF36C8942A75E1DE26F38E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252287, "uuid": "5cab2244-a71d-4e0a-abc2-eeb3103bccec", "value": "75c054ac1bbae1f166a73824a11d5efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252287, "uuid": "f61ff8aa-cff7-455b-989e-465be6cea628", "value": "1536:fS0nQkNkx7AeJRhNUoCthFYJmw44uh9nVJUWlDYnyrCo5CqydiEz1t4PpZnM+zgV:zNelNEvKWZYKika1t4PpZ/bVn7Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252287, "uuid": "c086ba93-3a2a-4af2-8b18-7ca7b80c2680", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252287, "uuid": "d0f095f0-6d26-4235-987a-2f141e1bee13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252287, "uuid": "2fb3792d-c761-4198-ad8f-b04d7752083b", "value": "4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044ba694-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628226800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226800, "uuid": "48aeb8eb-33d6-428a-947f-d29b490cde69", "comment": "Malware payload (Loki)", "value": "e34b0cf91a9f23455c53a770b0d3db3d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226800, "uuid": "56def5b1-9094-4ec9-977a-ffcb78147803", "comment": "Malware payload (Loki)", "value": "4c899ae6fcc7c84371ad690133523689dedb4a81ff6a94b090bd75029721833d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226800, "uuid": "6d74c308-3691-454a-892b-c76cbd705c23", "comment": "Malware payload (Loki)", "value": "5c26d358ad128fab94b2878a6f76807e180dd620", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226800, "uuid": "fb77954b-55d4-420b-b7da-d110aa58f164", "comment": "Malware payload (Loki)", "value": "cef093951ba29c2974142dfdb0202114265c790503f371e92fb0051f202019b073b11e77cd0fb1a04b51257ebbe8ff55", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226800, "uuid": "6c081d80-01fd-4ca9-b311-642ba18af49b", "value": "T1105512619A926664EBC5243CAA23CBFF005A5D50AF1D18D3D43772FC34BB63888D279C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226800, "uuid": "8f69f81c-92a3-4de6-b16f-b08e471fd084", "value": "24576:axH8tyLy0u+KCy5lRHpFttipJtCGtql/bpgVRC3D0mtpZcbs:afL25lbFttiI9iRCzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226800, "uuid": "43392145-1d9b-4d44-a50f-b3c2d3f67c48", "value": 1294936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226800, "uuid": "b28f1282-8047-4c16-9d37-13ced2a6e72b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226800, "uuid": "d5bcaebb-5c47-4713-92db-c0d1d47ed1a0", "value": "Shipping Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc27d2dc-f66e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224210, "uuid": "7695b5bb-1d22-4dfb-8179-550b58ae0b55", "comment": "Malware payload (Mirai)", "value": "f9360aa4727af4a717f3dd60e14e257d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224210, "uuid": "26bcad01-282c-44c5-8a2f-8b6344cc0d05", "comment": "Malware payload (Mirai)", "value": "4df7adbbaace836b0272c5542f1505f2b354b834e38feadf16abace2831e7d0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224210, "uuid": "e2e24884-7be6-4b9d-9f59-53695349a2e9", "comment": "Malware payload (Mirai)", "value": "1d34326f4dafe85772b896ebbb4f32822275d4e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224210, "uuid": "1c18120a-80a9-4629-a4c4-34de17055edf", "comment": "Malware payload (Mirai)", "value": "9722245db3dd44b37fd98807b0bf1f858f902640dff4dfdae00af64219637633f5ad21ed03a685e46cf31efb8560aecd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224210, "uuid": "e6cf8ecf-b8df-4fb1-9610-9b52c8fc081c", "value": "T128534BC0B643E9F5DE020674306BEF324E76F6F6211AEA87E3E4D573AC425419503A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224210, "uuid": "e3e1e414-a8e0-4900-b432-010b7a4b9b3d", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKjMaww2AXnt05HFEiQ:1jSwY4keBfrtOCQsnnFaCwF905l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224210, "uuid": "38158e54-2919-4b6f-a2aa-e6b3abc81679", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224210, "uuid": "61fc5a3a-7461-41ff-bf06-6e09f510f702", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224210, "uuid": "0428069d-eded-4e01-97ec-78890fbfae4f", "value": "f9360aa4727af4a717f3dd60e14e257d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b359a4-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628227012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227012, "uuid": "88474769-964d-4afe-b15d-d7ffb9bbda75", "comment": "Malware payload (AveMariaRAT)", "value": "b79b1892b717f1233f63451b5b7c626d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227012, "uuid": "7800e9bb-1116-4f76-8a72-f07414cb4d4e", "comment": "Malware payload (AveMariaRAT)", "value": "501c54e45dcff8ae57742bc1ab0ba09791a68a6345b9a84f6c92af401556af07", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227012, "uuid": "9f9c072d-dcbf-4e08-afd8-529dd38dfbba", "comment": "Malware payload (AveMariaRAT)", "value": "7a7b6a0c006501124b6ee00149aa72900c489396", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227012, "uuid": "428de897-82f6-4324-8ec6-a6adf79d04b4", "comment": "Malware payload (AveMariaRAT)", "value": "675452cadc2be3970bfab501cf3140c84276d7b691022f50aa566d20dfe9628c50f93e80be6454946ffd90d039427cc3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227012, "uuid": "1985d54f-49ff-4548-843d-6bbc4cd4f6f5", "value": "T14C356C1D9E75D14FC407AEF52668DA3614242D7C6B06816239E8B2EEF6723F859E303C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227012, "uuid": "f8bea944-15f9-48e8-9d65-4dfa426abd4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227012, "uuid": "39beafba-2f16-449d-ac80-b643fb1a91f0", "value": "12288:ZX8m2m03/fTScKZfs6k53TOjGYlnk1/S6BEKcy0Ft1j8t2NjFc:ZX3OSW6k5jg9lnk16ccJj8MNjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227012, "uuid": "9b2d08fe-335a-4357-9974-66f3ccf7645a", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227012, "uuid": "7ea8a8ff-2aa7-49f2-aed7-3c91cb0f546f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227012, "uuid": "357fa321-437c-4f34-ae79-71bebfed29b3", "value": "NEW ORDER PACKAGE - EDS INTERNATIONAL AUGUST 2021PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad8dbad-f67e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628230892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230892, "uuid": "8d1d9b8d-dd2d-4c17-b075-4957e8f88269", "comment": "Malware payload (Formbook)", "value": "f2b81b42990cee987ce0168b14abc4c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230892, "uuid": "311a079f-9c17-4a19-ad86-3f08c19934ef", "comment": "Malware payload (Formbook)", "value": "5023ffb96d6d21805c48f275dbb208a1671ab8dd7f3c170ca4dba1ac08c075f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230892, "uuid": "48ce18d2-4f80-4330-8d95-b42be887a5d6", "comment": "Malware payload (Formbook)", "value": "e3deb21646a87850cc07bc6fdf7d1642274ed5c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230892, "uuid": "144d19b4-1bf5-4190-8c72-088d7f2aae33", "comment": "Malware payload (Formbook)", "value": "87d30d0d9fcb81e309b44fe2300a583f69c78f341165a7d170723817afe9773b6dd3216c885a3c2e41ea2c939983811b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230892, "uuid": "d9d079da-0cb0-46b7-9a4c-db16cf9b2f11", "value": "T14705F125B255C810C3BE5632CDDF40188BF8BD093A63DF2BBD9A32694A533A395475CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230892, "uuid": "2fa6d2ab-589c-482a-b776-a70b2d5b9dea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230892, "uuid": "cfa83175-851d-4285-975d-b70cfa1204a0", "value": "12288:lifB33Y4Qxfz1naYIiAPdIScj/0PHXf+ajRGsatQjGfnVbKd6aKWiZG8kqMK2t2Z:lipKaYIiR03GqQsat0Gf5O/iYhMNjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230892, "uuid": "10149a42-9b3f-45fc-be8c-d0df22b40c6b", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230892, "uuid": "763a5261-35e0-4463-b4ee-509155b47935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230892, "uuid": "190fd028-d7a4-402b-b019-ee4a6fd3740d", "value": "(0998 R1) ST PO1805140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4eccee8-f6a4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628247364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247364, "uuid": "17acee05-5acb-46ec-93cb-1c716bdc0018", "comment": "Malware payload", "value": "0a2327c8eb35d6ee76bced4c405a1e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247364, "uuid": "0d543ef8-5b39-4447-9c67-4df0275f01e8", "comment": "Malware payload", "value": "50fcaa0ac7219a10cadfce715ba25a2f30fe3939fa3d4e1c899d321e397daa0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247364, "uuid": "631e8182-e917-4bb0-bbd7-c77cf3a8ea6d", "comment": "Malware payload", "value": "8929124673c776ea86aaf0e9169209f8e9567f23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247364, "uuid": "43cc2954-45b9-40b8-ba64-bdd2c5972273", "comment": "Malware payload", "value": "2373685204276594cbf97228c03df5179af085575f0d6b1c3663922d8fa764e2207aae84c4ad9c54947fc7e2b2d66047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247364, "uuid": "695337c4-146d-4fd8-8b98-f7ad41dc6f47", "value": "T1D5953370B1A6A3E4F2E497717E2A482E8548B9210CBBF5C8CAD4713355F74874E4E2B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247364, "uuid": "6f5af32c-bd90-4f69-95d4-931dcf462752", "value": "49152:Rhp+NCo32yWpUXGCM+aSxuKu68wpA4nH4G+tUo3H77:Rf4b2ySUXG8aquKuernmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247364, "uuid": "504f7bf8-c99c-4527-83a3-955043b074f8", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247364, "uuid": "fa3544b1-4959-42cc-b15e-99fb4f191664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247364, "uuid": "ed7a72f2-3d39-48dc-97d2-ada1cddab067", "value": "0a2327c8eb35d6ee76bced4c405a1e47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7232ef39-f676-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628227414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227414, "uuid": "6a4f494a-d18f-49d6-9c00-53be441a05d0", "comment": "Malware payload (AsyncRAT)", "value": "81fbee7cf06d76951c416fcea95793b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227414, "uuid": "7be96936-8a23-4478-ba7b-b8a2ad222f47", "comment": "Malware payload (AsyncRAT)", "value": "521b4516ed8e30973f02f5749ba800aee5b4271d022ea4c783decb001d14f74d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227414, "uuid": "ac187346-7a1e-4ec0-832e-994cbcbc4a98", "comment": "Malware payload (AsyncRAT)", "value": "f02dcce402dfc271d7a41e879f7ce63522957706", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227414, "uuid": "735bbd47-a886-4e78-a2e9-11cff274777d", "comment": "Malware payload (AsyncRAT)", "value": "016153ff89d83667250f8f6ff94f5be79b7ad13154922f6754aaac4e0099317d777a1fa1cea5da02b7c84352e954161d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227414, "uuid": "ab9beca6-da80-46e5-9b19-a1a1e69f03a3", "value": "T127019E81D46D20459BE0C9EF15B84814E802F744D709642D25F26B0F6811BC2039FCAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227414, "uuid": "92520428-6175-45b4-9268-3b37c2092992", "value": "12:cje8VoMuXsn7+/9+iM9+DOOyv24+f9+vM7ITkSSsaK0d:cK81KichMpOSQfa9TPSsaHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227414, "uuid": "88fc366c-921c-4eb3-8305-5d16b0da5ae3", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227414, "uuid": "42e389cc-96d5-4934-9bcb-93eac469a6d6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227414, "uuid": "b0996ccc-c116-4673-aa7b-221b3d415ed7", "value": "HJBL269.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95c6794-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628257196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257196, "uuid": "2641fe59-6849-4242-90ef-16586e28a966", "comment": "Malware payload (SnakeKeylogger)", "value": "23c6a9b7cacf900035cfac74aeae1c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257196, "uuid": "092372ef-1954-4301-8a29-afbe6d63d2ff", "comment": "Malware payload (SnakeKeylogger)", "value": "53695f461f19fcb5440ac85f777de093824ca61c777ff1c8b77001bf7eff4a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257196, "uuid": "f74b6d50-709f-4ebc-8eba-5eb5b9e762ff", "comment": "Malware payload (SnakeKeylogger)", "value": "b81b431eaafe067c8025609fa2240308c49266eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257196, "uuid": "f4c20d85-40c9-4df7-99ce-f1f077ebf98c", "comment": "Malware payload (SnakeKeylogger)", "value": "7f160cec69c06f450b542e21a9cb9704dae57733c08b4caa57c20e625014b61b5355a8af786444cfd32b4c6e1031c22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257196, "uuid": "4f604e5c-0012-45eb-9746-6e5ac0a1ff74", "value": "T10A05CF347AEE2314E1BBE774463552404BF6F93BD717CB4E2D25508CAA73A828722F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257196, "uuid": "e0a36aa6-9548-4d88-ad85-5057c5dac602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257196, "uuid": "6ee9981b-59cc-41d1-8ec7-b6d9376bebcd", "value": "24576:9/Jb0wFVMNjIuzAXYYU6pK623EmUkXzt1v6:pJYwFShBP6pK5rUytB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257196, "uuid": "d52ff7e1-e42e-46ce-ac41-38efec694e85", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257196, "uuid": "47d88f09-68fa-4eb3-a94c-8de26c3b7e80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257196, "uuid": "24e7e2b1-4faa-4262-9195-36adf560f08c", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34a2038-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628257239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257239, "uuid": "5bab7cf4-23d1-4853-a076-5b5c394a25a8", "comment": "Malware payload (Loki)", "value": "8f452907a97d806d962315ba166f89ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257239, "uuid": "a8763372-d217-4656-93b2-99cfc85a8cbb", "comment": "Malware payload (Loki)", "value": "5463a649756bd0c22d0e604aca9a7c5f1cb886d4666c013b61077aaaa9992728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257239, "uuid": "536e28d8-14df-4d61-945d-decb51a8197e", "comment": "Malware payload (Loki)", "value": "f9f68ed3bce640f1b9c5de2c213ee6793fe8289e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257239, "uuid": "c2e7d588-820a-422d-89e1-5d3c250ffc76", "comment": "Malware payload (Loki)", "value": "b58ed7df2406fb8901fdd9edcc96cc4aa311289dfcf7041b6db502b3fec26455d6f7dc0065fb4258ef41959b09f8d7c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257239, "uuid": "700cddc5-7193-459c-b67b-46c38a9f2a44", "value": "T118A4E2D2F65EADDDED794CFB04F4A3C63C60AE5C0B0297D193A63A99937A6123C0C149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257239, "uuid": "708211b0-620e-4c58-8464-9c66a27ff335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257239, "uuid": "ddec02af-a867-450c-8d16-1c423caad1a3", "value": "6144:FQ3R6/VOA55wg6AoP8LOyKL8s61CeeDA2OBsdcNiiduTRgNjXaiaYtYY:K309O+Wg6AoPZ8DKIsWyONraiaYtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257239, "uuid": "b8b4f948-459e-4725-b14c-8a5cea9ddd18", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257239, "uuid": "5e983dc8-3462-4d86-8b99-f18a19f4dc0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257239, "uuid": "0f08392f-cbb1-44e1-badb-191c55551def", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0a7714-f690-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628238438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238438, "uuid": "b1a009d9-8378-4702-97a0-170a6f3e7f76", "comment": "Malware payload", "value": "400ef1a8d25089cfe029cf5082fe7c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238438, "uuid": "d60eaf39-359c-492c-b841-56436d2f1f90", "comment": "Malware payload", "value": "561b3cf57b33e115cabbb36756579d7fb15ae90656b826cbd286673b2eaef227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238438, "uuid": "19aa9112-393f-4ccc-a7a3-d4b8b2b7b4de", "comment": "Malware payload", "value": "ea96f87330628b292b975afdb663c6f55d143f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238438, "uuid": "6e013af5-474c-45ee-b03f-6d2340e26d81", "comment": "Malware payload", "value": "a6d237c4c5f2e2437c2f61934770d4d9350c79e964d3bcdaec11848f81b9994f95555a3607298035cf9b9a1ab8ea1bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238438, "uuid": "0d11a561-d95b-43aa-a28f-c076e5ddcb3b", "value": "T1329533AF08B5812BDCD672332BD9577D06793227322C9C90F206B5B517F57153BB12A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238438, "uuid": "a341dc8c-f788-46dd-9246-1716544ec8b2", "value": "49152:Hrt+eUPuiA7rIhsHLUOq7L3DX6foeAG2m7fmUwyXdiIWTSmYm+:pvUWiA7RUOq7LTX6fHKm7fmryfkuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628238438, "uuid": "1199ec23-5773-4454-972a-c82cc360756e", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628238438, "uuid": "6929c609-65c4-409c-a7e8-cb4233a54850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238438, "uuid": "4cbafa30-eef0-47b9-9e13-5f5ee3c69c0d", "value": "400ef1a8d25089cfe029cf5082fe7c51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2f6385-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628256719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256719, "uuid": "6a2d5d90-6590-42cf-baa3-0df19536dc77", "comment": "Malware payload (AgentTesla)", "value": "0df9a9a0f76188fcc0df1485decb49ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256719, "uuid": "d5a20ef6-9f3c-465b-a117-7fbe2baba4fd", "comment": "Malware payload (AgentTesla)", "value": "56f76a46dce436b266c15dcf4b0b849d818f06e997b65d36e3b5dab7187712b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256719, "uuid": "308a81d8-c030-4382-8fb8-ed58d6b34f1b", "comment": "Malware payload (AgentTesla)", "value": "52f96103bed23a28287a58e456a33a93f2ff57e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256719, "uuid": "c23919e8-7f4e-4da9-91b7-1642c42a5b89", "comment": "Malware payload (AgentTesla)", "value": "00ce79b61a0c69b7ac6774dee3257246abaef2650e33c481c8a873789e139411a8b9bbe29050eaa011ff1aa8723f4efa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256719, "uuid": "3b8a9a13-85e4-4abc-aae7-5f1c135c26f1", "value": "T14325D081E185EA06C59818BF1F3DF6B057FC4D9A0556C0812ED4EE473BABEFA09C25C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256719, "uuid": "2aa85fff-f2bd-4132-b4d7-0a979174bc03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256719, "uuid": "3ec7ad80-0c26-4f92-a21d-fd6ee3cce8f4", "value": "12288:MZ8050SnUrHbB7iBVyJ2UfYVnU14Ua2pehXVEXEIGw0lx9dE8SdxJD26fDwtmq1n:MZ8ayHOVATyns/Mm7G/d0xrsjAMNjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256719, "uuid": "871ea14e-015a-42c9-9b9c-bf56f74a04d5", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256719, "uuid": "d5852452-18ce-4818-87b5-fd95b58e3185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256719, "uuid": "7e578340-950c-40b7-92a6-86e91910d388", "value": "PO-38900167-2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7981a69e-f67b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628229574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229574, "uuid": "70364648-3d5f-43c9-8976-69182452730e", "comment": "Malware payload (HorusEyesRAT)", "value": "30cddd0662f0d4f5b7ccbf51eb83e8ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229574, "uuid": "a65c2c89-38a8-436c-bb4f-2655274be2d5", "comment": "Malware payload (HorusEyesRAT)", "value": "571fbb18f4fb9c36e5a991451316360fb81e5e537604b8fe7143b79fb3b926b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229574, "uuid": "1ee3c68a-d9cc-4fe1-b16c-f7decf9461cf", "comment": "Malware payload (HorusEyesRAT)", "value": "8e25cd630c84c4c2fc837af0711fc6413f656616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229574, "uuid": "419c10b6-7817-4636-8410-7caaa548ebcb", "comment": "Malware payload (HorusEyesRAT)", "value": "3ea3eaf8cacab659cf72215c44c8e86606a48c6ed0b37b5a01754dbf7d4dd52566a55be7c5f7b0f9245b7691cb9b3791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229574, "uuid": "9d258bc7-339b-4ecc-8576-7ed6c2db4754", "value": "T14FE2D008B7948601C6BE5FBD3A73470425F0E24BA923C7D92DD8F4B659AF74506323EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229574, "uuid": "cee7060e-34be-46c5-99b9-355af9917400", "value": "768:vtPUpt5VXSXZ1XjHkut9MzvbnZ4MKl8zCMWE2WtB0+Tb:vtPUDGZ1XQuwnnZ4V7TYNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229574, "uuid": "bccbcfc7-9c55-4d0e-84a8-f282a7a4ae4d", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229574, "uuid": "19c828de-b163-403d-a8a8-5bedf6ccf298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229574, "uuid": "8a97a4cc-6d31-4d97-8947-a73e5dbc2780", "value": "Stub_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3563a0-f67c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628230035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230035, "uuid": "55158d58-ae3a-44e7-a926-e493077920a0", "comment": "Malware payload (Formbook)", "value": "c1428a49557668bf9fb0a293c3f8d003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230035, "uuid": "17866811-cb23-4679-9ea0-e8f0891eba97", "comment": "Malware payload (Formbook)", "value": "5a02dd58da8c8f90dda5f85e41c201f1d2c8c5c7006d7073b636cc2d2211cc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230035, "uuid": "711121c3-cccc-4a58-893b-840841189ec4", "comment": "Malware payload (Formbook)", "value": "41a31d93e3a9f3882f024000b26ad329c0e90ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230035, "uuid": "fee1a920-4b48-4e53-8d43-2c3c9b3d9d62", "comment": "Malware payload (Formbook)", "value": "131488c4d91af799312788e848b3fd88f87bf82d6eb62efc372089a73fd7c7804b53d426e4c1f618a2fba917a33f8584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230035, "uuid": "660049b7-1824-4c69-aee8-2b5e5db86df8", "value": "T16B15CF50E641A616C59858BF5F3CFAB013FC9DCB1596C0412DD89E5B3BAEEFA09831C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230035, "uuid": "286821f8-ecc0-42d8-83f5-f5fe29724ec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230035, "uuid": "ee9c5d9b-fe6c-489c-b153-b696b01bd233", "value": "24576:LHelGsX0mavhzMi32n3K2VYxEsjsMNjv:LHzsX0mMhzF3k3EysjVhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230035, "uuid": "cf6ce3a3-e6c5-4516-9241-c5696378f28b", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230035, "uuid": "d4825a2e-4f88-4709-ad5c-f7aedea3a9d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230035, "uuid": "3d35463e-b0e0-4a92-ba31-421750d53ae1", "value": "PI_NGOIU00987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2872642-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628231441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231441, "uuid": "399f6587-89de-48d6-bba1-4fef355bd3cb", "comment": "Malware payload (Formbook)", "value": "08521f25f60c84cf0a69ee633b84ae52", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231441, "uuid": "2cdda41e-d8a8-4ea7-8957-236bb8316d35", "comment": "Malware payload (Formbook)", "value": "5a1642e79f3f7bf0d687a25b53588048a9ebaed6a7237a6f7dce35947e3063e0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231441, "uuid": "578b1e58-020c-426f-bfe5-a2712b13fe7b", "comment": "Malware payload (Formbook)", "value": "6deb2eb62fa27e1e6a2691034ed901ceec10d2f5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231441, "uuid": "f6c64525-5689-4494-a81d-f4551f677671", "comment": "Malware payload (Formbook)", "value": "63ff062eeb6a61bbfd534b7c3cf15392a0617c09fdbca8f8976f3193f6623091918f16d91ecb30966dddc12ac4cba6fe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231441, "uuid": "a0cb4036-ce7b-4a0a-b7b5-47ded298a47c", "value": "T121E423C42A751D94A3BFFE91C97C33B8F2AE9984D6E198DE1789330849E039436F41B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231441, "uuid": "5fc0a562-b732-43c6-b978-c416416a9518", "value": "12288:Ek+WJj4W6DQSIbxeHcgO0ekWHaJA2Grop8xagb1ImcwP7ImwV:7fpb6DQt0HnvMVroKxldcwP7Imo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231441, "uuid": "5cea905a-d421-4fa8-b98a-44156a484751", "value": 670510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231441, "uuid": "33ffe3c4-a286-4389-b853-eb3d853409ba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231441, "uuid": "3d4c3091-41a2-4f1f-b873-1837427b9406", "value": "ZYJY-2021010005.RXHT0021 \u79d8\u9c81\u7bb1\u5355.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bba9695-f6a4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628247080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247080, "uuid": "d6647a58-c30b-415e-a67c-b022951c6097", "comment": "Malware payload (RaccoonStealer)", "value": "7d17a86a5bf1513e56e01d7468be87db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247080, "uuid": "a77dc8a4-cfcd-472e-b8f1-8c0dd06f6dde", "comment": "Malware payload (RaccoonStealer)", "value": "5b46df5a271c4e35adf1027792e4035301ae87fe4a112f89f507b37522b541be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247080, "uuid": "31c0ee14-65b8-43a2-bf7f-5446035bcc2f", "comment": "Malware payload (RaccoonStealer)", "value": "5a6d18b801c333a2c93c99aab7e2048f12bb433a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247080, "uuid": "4da33ce3-9e29-439f-9088-9ed002f3d3ec", "comment": "Malware payload (RaccoonStealer)", "value": "010d63b1b08e2fed8d9fe3d28adc35233a0e12f94627874cf1f09c5cc3f950a4e5e1c9805f5783f21985b0dca763f18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247080, "uuid": "092fc5bf-574c-4857-a4e1-92c002e89100", "value": "T18FB402513B80D772C8951D308C74CAA86B3D6D718D64560B37B9BB6BAF342F2367630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247080, "uuid": "49d49810-4dfe-46ef-9db5-e80c7f48dc26", "value": "cc9eff21144ed22ef598d26ba22e8d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247080, "uuid": "6dd78e4a-ebf1-4f48-8e98-4af7e79df4f1", "value": "12288:HP7NeNk3cX/E7OJSUzhMzC5eQiQdIARwoOspd:HP7ANNvE7OHmzC8QdI25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247080, "uuid": "23296b85-f73e-4c48-8c02-d0cc7eb818a4", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247080, "uuid": "79cb8b76-72fa-4e24-8bb7-0231a8cc0e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247080, "uuid": "714b43d7-9085-4c03-afbc-a08fff9025e1", "value": "7d17a86a5bf1513e56e01d7468be87db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5352a09-f6d7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628269161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269161, "uuid": "03e873ca-4de8-4b73-a7c5-e1bc1660c231", "comment": "Malware payload", "value": "2752495580a979c88438dcc38907c3b8", "object_relation": "md5", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269161, "uuid": "a0c1f32f-744f-4f6d-9c4c-d334f0572dc5", "comment": "Malware payload", "value": "5e97f6fda0b360ee80bbf174a7fd063a3916c577d3e98d4b05024ef3dd304c51", "object_relation": "sha256", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269161, "uuid": "7765aecb-35bd-4795-9714-287a2fa98539", "comment": "Malware payload", "value": "d13add65fdee9c2b86925ed112d73685011e463b", "object_relation": "sha1", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269161, "uuid": "d02e6508-2dc1-4f30-9b10-55258b060cb8", "comment": "Malware payload", "value": "d6cecd76b1028b32e5ad08a3674ec662f1a8c86880acb2916a9c52df136f17f3f42f01ba5ded076bba8dfb43441df6ab", "object_relation": "sha3-384", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269161, "uuid": "e8b11b37-e5e4-43c1-a650-0dd9ebd21d9f", "value": "T1BC83126C0B8016F15AA87E6ECDC73C97A91D087D354777549EB9A328B012617CABA133", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269161, "uuid": "8441a73f-3218-46a9-be49-ba19614cab64", "value": "1536:FqBSRhkwJsEh0Z+5YVUqXdcamTFwABKte6EVLY8Kif/2j4K9iKfL/CMZPUDLnVY:FYSRhzJu3HtcRFwOKtKLYIWsK9iK/U1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628269161, "uuid": "e9ef5021-64ba-4a3b-98a3-fed5715f6dcd", "value": 86565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628269161, "uuid": "7318bebe-da2d-4077-ab0b-6e74e781987e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269161, "uuid": "e457ad76-30b5-4f6e-89fd-3fc12d61581b", "value": "Documento.PDF.js.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970e2272-f687-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628234778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234778, "uuid": "48ed7ee6-3e26-4a8b-8789-8c94f38b207a", "comment": "Malware payload (RedLineStealer)", "value": "309a0c8547f0ec7d71fadeeef4f1b2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234778, "uuid": "f82b4206-7c5b-4784-9b84-25f1d22efdc4", "comment": "Malware payload (RedLineStealer)", "value": "5f84e31da5e8d21290280fe26d09abd9e04f72e4b77260b314fad54685a447e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234778, "uuid": "9119be0c-ea18-4eb0-991b-c24e6c863d58", "comment": "Malware payload (RedLineStealer)", "value": "46df176963f970ec7e65ca43b4952962241723ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234778, "uuid": "c4fa3103-3b27-408d-a026-ad95f28a0b2c", "comment": "Malware payload (RedLineStealer)", "value": "428c9406529131faf9a37b6a82e723cdc0981a87b95b45c440abdfef940574c1be5754bc5cea3597ed5fdb090a2a0d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234778, "uuid": "bc88a940-6e9b-440b-ba1e-5d79c5404785", "value": "T175E35B2023AC4B2BE7EE4B79E430452582F9E25B2623EF5F4E4074DE2B12745A7516B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234778, "uuid": "26feb7bb-b646-4b7e-b6df-be9a4de679e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234778, "uuid": "551136be-9362-427f-a509-9da58ee5e211", "value": "3072:yJq4D2Lk9at6OqhAoDLcw9XFTb3R35dINX9rhmM5:yJq4D79YcFVdFTb3RDINN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234778, "uuid": "826bd081-3a02-4bd1-827f-e44c1db85d5b", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234778, "uuid": "3971b32f-5cbb-4e35-ac57-9713881de76b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234778, "uuid": "94fcf1e3-3297-4d94-9552-521948417ca8", "value": "309A0C8547F0EC7D71FADEEEF4F1B2E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df180f3-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628253043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253043, "uuid": "aeede162-73b5-4f8c-8d9f-826ae2d4e9cf", "comment": "Malware payload (RedLineStealer)", "value": "cf1768f91bf00688197215583111b985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253043, "uuid": "e2b4e1c6-3654-4c69-87eb-ceee64d175a1", "comment": "Malware payload (RedLineStealer)", "value": "5fc0c8bf9bac4e9321fee7fcf2f0fb6dadaeedc8d5ba6432961654f92fe5e58c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253043, "uuid": "654d7eb6-6417-45bf-98bd-5acc409a8a08", "comment": "Malware payload (RedLineStealer)", "value": "034072bd00fc1f96478326768c5ec370cf30d4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253043, "uuid": "9024171d-ec31-41ab-81a9-c555cf7befa5", "comment": "Malware payload (RedLineStealer)", "value": "dbf97ac6b48395f5c5c85ef653fe75d6e2efd328de9650dd09cf31219a82c42fdeecc025b783173820ca10e3a37cd35d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253043, "uuid": "a98a151a-f7e1-4902-b361-372b7a28fc92", "value": "T1B6C41224AA11EBB2E050BDB1481BCB698977F891C3B155C77A8933AE3F306D05A37375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253043, "uuid": "fd2fddd7-ac2f-44c3-9154-0c294f2599a2", "value": "38170c4d65ff42b014b27008b95c5de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253043, "uuid": "c19d2693-2c91-4517-9122-554414a350e2", "value": "12288:hLBzPDRze2JSs6jpcLdMdOtYOR76xHIdX8oQNsRERY/:hV3BBsFHOtY7IXvQdRY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253043, "uuid": "17fd93fb-3c9f-4fe9-8979-0ed9774ec793", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253043, "uuid": "aece26a5-fed3-486c-8861-9b7fe4ac0c71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253043, "uuid": "3792c486-4d6e-4d3f-9fd7-c017fef1938e", "value": "cf1768f91bf00688197215583111b985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca34c06d-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628256768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256768, "uuid": "8acd7584-f5a7-4ac0-bc5e-55ffbeb94ad3", "comment": "Malware payload", "value": "10a09651cdb0a28e3375505bb33c00b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256768, "uuid": "211fb7c8-eb9e-4d6c-a9db-590de4246a03", "comment": "Malware payload", "value": "60ac6dfe6cbf92960e313300091e733c0b4a2bca9f8de41f3543bc2d06ba4328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256768, "uuid": "66a0f27b-827a-49b0-a5b0-0fded6805f2f", "comment": "Malware payload", "value": "7a0538fed577f6fe84ebd84fa59300f1e7f90c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256768, "uuid": "d4e83a4e-9b3c-4929-9fa4-8438412c6487", "comment": "Malware payload", "value": "6945baf91eba1c7f8e51d04b6692855feb5e2cca71fd520a60c33f5c6c44711830ec0e02c668f0e2d3111bd9bae1a46a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256768, "uuid": "93135b5a-837c-40a3-9376-366d315867e8", "value": "T1E1E55B2439EA502AB273EFA58BE475DADA6FB7733B07645D1091038A0723E41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256768, "uuid": "0b8643b8-d278-432a-9a78-9fee2d16d051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256768, "uuid": "1565b545-a2b4-49db-bd7a-66777d1f2beb", "value": "24576:SaELZLKyR4/i5jApo7JhU5Nd0fh91MMWuGwwAkgbHUqsRWyU8jkiQk7WGfXFQMDa:SkK5EW0+Z9suJwAbsvl52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256768, "uuid": "866ccb38-dd67-4c52-a0a6-af203620463d", "value": 3148288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256768, "uuid": "2d658b59-cf3d-4053-86c8-ac12295d6bb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256768, "uuid": "2b3af25a-5455-4bab-9fa8-8b6c0f934132", "value": "FC73GQTY0090TWMNA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af32449-f673-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628226194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226194, "uuid": "0bebdca9-09af-4cb2-89c4-66298a1fd15a", "comment": "Malware payload (Mirai)", "value": "902cb6c72de5aa628daebc40f318db1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226194, "uuid": "7816d375-a25e-4320-8b51-10413f18b405", "comment": "Malware payload (Mirai)", "value": "616804cffa81dff23d629468177b2189f3c3b405b11e3227920e5b5d6b4734c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226194, "uuid": "e220a29b-5ee7-4d18-8718-b6ae494bb7e6", "comment": "Malware payload (Mirai)", "value": "baf93bcd0f2f531313df16617350ddf7c936f936", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226194, "uuid": "9dd92891-7f91-4d99-a208-de2ee5d20179", "comment": "Malware payload (Mirai)", "value": "358675b08c795226a9616f36b405e4c6ac37cf0678f3e9ead8c5a0c729ec68a22fa07b310bd87d7322dcc478867dc2c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226194, "uuid": "90066d4d-4b86-480d-90b3-52026ee8fcd5", "value": "T1CC732996B8829A22C6D4137BFA6E41CD372163E8D2DF3207AD205F6477C681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226194, "uuid": "f2016e4e-e24d-488d-b790-7ea5e0ccf03b", "value": "1536:/pXcKpBUlet3DBboJubLCNgpRTZGrkcahWMPEao4g5i9/e35w0FE:/pXcKLU1cRErkvhTskgh35F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226194, "uuid": "32024dda-e0b5-4fd0-85a1-db5e193e796e", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226194, "uuid": "35975a93-f14e-44f9-983b-07bdf3114d49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226194, "uuid": "3f2d79f6-387a-4e3f-8de6-bff4eabf3eff", "value": "902cb6c72de5aa628daebc40f318db1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bfa45f-f6c4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628261131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261131, "uuid": "9f78250d-620a-4d7e-9dab-7d485dfa03f6", "comment": "Malware payload (SnakeKeylogger)", "value": "45e98b7352c1a5dbae92cf4675b6d02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261131, "uuid": "0dd4b8e2-8a4c-4a7a-8cd5-ea57ba0a1a77", "comment": "Malware payload (SnakeKeylogger)", "value": "61887f5b404ddb5b1a39ce2bfa8641011a7c346b3389e60669bdbca8a69d6115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261131, "uuid": "cd5db29f-5a4c-4131-90eb-548e1ac0b40f", "comment": "Malware payload (SnakeKeylogger)", "value": "6cc95dcfcf193e5226bcb66da0a2059b9c42917e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261131, "uuid": "77903650-d87c-47b2-b445-ae9338cdb47a", "comment": "Malware payload (SnakeKeylogger)", "value": "9ad55940ec1a8e2228ce4b405b6d3b1c217eb2e640aa4f018cdb5f14e298110dfb0716aae70f7aab083306d1641efc55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261131, "uuid": "9b3f51fb-e934-4505-89ac-59c4e5235e1d", "value": "T1C1F4DF303AED6304E1BFEB74463651418BF6F637DB16C78E2C64605C9A73A828722F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261131, "uuid": "1491d76c-2565-4250-982e-2ac6fb5e7da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261131, "uuid": "c9212f3a-831f-442e-8cb4-36e017908034", "value": "12288:vcaQxt8pm6YcTgbgDPwFVt2NjFrYOee8irQ1lEpHMVxrGauVYVNgnXTOKh:bmo8b0wFVMNjF/aUQjEpHMVksNgXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628261131, "uuid": "0db8e01e-671f-4058-bf40-7c1d7f710e9e", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628261131, "uuid": "dcae85c5-1377-451d-b187-c9060c730cab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261131, "uuid": "687fb96c-defa-4688-9a2a-2cc1d5999e62", "value": "revised PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffd217c-f696-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628241315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241315, "uuid": "4b8e93dc-c952-4d9f-a5e5-4fffe0a933d4", "comment": "Malware payload (Formbook)", "value": "e2e4c5d869ec7bdb5dd1b8fae00f929a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241315, "uuid": "79fdada9-55b4-4516-8ac7-9f0f6cd8054b", "comment": "Malware payload (Formbook)", "value": "6193e9579a45f4b4204cee71e070e1bcf46532a5378ac3156ec7684f9a6134a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241315, "uuid": "e3552dd4-1691-41f2-b9bc-fea330136e91", "comment": "Malware payload (Formbook)", "value": "7d46fbfb63f8a24dfa27b76950e6b4c05bcc7e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241315, "uuid": "7d84d4d3-ea59-4225-ad93-4e954dff7f83", "comment": "Malware payload (Formbook)", "value": "f8b06b5b477c08dc9046e73cd5d34186333f864dd1ae5f504ed5411e9576397c3d6d8815d9bfab13d4c0f438e661d779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241315, "uuid": "f34ed5d6-ddd1-43df-ac95-83f9be7fec1c", "value": "T11005CF91E584A602C58818BF1F3DFAB057FC9D8A1556C0812ED5EE173BAEEFA09C35C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241315, "uuid": "db62e2fe-00b5-4e80-87a5-aea251e9bd0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241315, "uuid": "2309b204-6878-4193-a05b-54c1b8daee42", "value": "12288:3cMfHu9XpVsGCbuCRCfUfyj6ePm9K7YV6k96VWk+w163Nx1j8t2NjFfOleF:3SIlSCMSc+wdkcspwkNnj8MNjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628241315, "uuid": "cfb60af1-8beb-4d33-9d98-41e5528d7b56", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628241315, "uuid": "42282860-518c-4869-b154-57cd48a32ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241315, "uuid": "5da1f24a-09fd-4a48-acd4-96e3f612d4c2", "value": "SecuriteInfo.com.Trojan.MSIL.Basic.8.Gen.25330.6320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ac3707-f69e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628244764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244764, "uuid": "fcc3342b-8bce-47d9-90db-f21740685d9c", "comment": "Malware payload (RedLineStealer)", "value": "a3cd270378287770bdd9fdb2b59e5588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244764, "uuid": "36c1ffe1-23c6-4f1f-989f-55bcec498229", "comment": "Malware payload (RedLineStealer)", "value": "61cafe16ef316179718e8827d2c0d37604639050956b95d1167ce4b1ac601948", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244764, "uuid": "d4d129e3-e7ba-43ee-8516-c682ce38a08e", "comment": "Malware payload (RedLineStealer)", "value": "f4e8c44ff923bf7bb0f5a4b8c104d8d79d4b93e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244764, "uuid": "80e72243-c466-4024-b0d4-7452eded587a", "comment": "Malware payload (RedLineStealer)", "value": "26967297a79c63227772b496b36c7aa7a251654f289af2a2c706e81cd177b30a13268b91ee1c0052c86dfce358323ab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244764, "uuid": "19eba013-0ca2-4d56-bd54-e7ad4b18e96c", "value": "T14FE533B9DFE4087BCF70FC724D332136018F2D18D861D52A6A9A77882E366504E676ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244764, "uuid": "aa7dc526-16f8-4bda-a034-22894e2c318b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244764, "uuid": "8f82aff7-e3fc-43f4-b936-80e354399f5e", "value": "49152:n6sYBfAryN44VkQk6rDIoPqi2Vg1jFVZ2fM75O7qgnSxLNI:n6lt4d596nI5jWFPaY5O7qFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628244764, "uuid": "9e396cf9-accf-4825-97c0-a83d812adec8", "value": 3139280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628244764, "uuid": "9b34a2a7-4d96-4631-aced-c62e65d92e03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244764, "uuid": "7ee6c28f-00dc-46b5-b381-edd5043e56a2", "value": "a3cd270378287770bdd9fdb2b59e5588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29086ea-f66e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224194, "uuid": "62699882-b07d-4490-8991-b9ee2eab3411", "comment": "Malware payload (Mirai)", "value": "f7a27f0689d777991117b7fd885d9562", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224194, "uuid": "ac9651a2-29ce-4b06-9b08-4a8fec2b3bff", "comment": "Malware payload (Mirai)", "value": "62400d7b2d30498729d433eb7db547f1399123acd184a850912e2fbc3480f339", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224194, "uuid": "d155930a-3eef-45eb-a5b2-fc6fb60e2575", "comment": "Malware payload (Mirai)", "value": "319a3bf97334331b479a97d5a71ccc9b9dccb4e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224194, "uuid": "9351fc3d-f598-4578-adea-0ec3e83d18a6", "comment": "Malware payload (Mirai)", "value": "fac4e7e22173ae8a9a487307c9fe8ab036377235b2295c05b648e45369138e8491699b7d1be4d095eb8f33adf19960ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224194, "uuid": "a9cee38b-182f-435e-a859-8090636204cc", "value": "T147635D02B2280A47E5931AB0253F1FE057BFEAD025F0B689695FDB568635E371086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224194, "uuid": "9b8b94f9-b91c-447a-b4ca-4bb45b9aee14", "value": "768:hcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZQVK8uqFzCIsHHheKnsbmqlr4sG5Mk3:uw+fYYC1yHyau3/S9selEsvkIewDof08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224194, "uuid": "12a31a2e-5ff3-4632-8cde-3bcd9d9200d5", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224194, "uuid": "f19cb03c-0afa-4e13-aafd-8cd0bfa6a22a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224194, "uuid": "f9055c41-7ea0-4e20-a51e-60795b22ceac", "value": "f7a27f0689d777991117b7fd885d9562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7926e9be-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628257491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257491, "uuid": "9e5a2c96-d76a-47fb-87fb-3bdffdfd97e1", "comment": "Malware payload (AgentTesla)", "value": "08f35a190b8ccc9b92fd5d7a0c04b290", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257491, "uuid": "7be5fcf2-9aa9-40eb-9683-9f26763717e3", "comment": "Malware payload (AgentTesla)", "value": "63796a0b64029b82b751583696b72a929adabfe3578acf87e9f9d5abd692add5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257491, "uuid": "0c09c1b0-9415-4afa-bfdc-a174ca66116c", "comment": "Malware payload (AgentTesla)", "value": "bcaa9b92b8ec54029d556559560970d2ebb0b3a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257491, "uuid": "5a850e16-5cf9-41c9-aa59-aee38b040597", "comment": "Malware payload (AgentTesla)", "value": "b2eb98daf4ce871437ca2ae64f12c5cc1dd746e9139a39be685e3db578866cbe9ba88456cb3c74a1a95d1b4af9324d30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257491, "uuid": "6986c922-3a85-4372-8d0b-8210fa25585d", "value": "T1C115CF51E644A602C59818BF1F3DFAB053FC9D8A1556C1422ED8DE173BAFEFA0A835C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257491, "uuid": "428b5903-4730-45a8-96b8-6a54c960326a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257491, "uuid": "cf447308-bf4f-40e1-b697-83b0f2c9c280", "value": "24576:h4y1j5uF4AafqVfdynR4ogjVjNSmjQMNj8:F5h1ilSRZgrjjBh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257491, "uuid": "ddd01b2b-1c29-4fc0-a7d4-9c32a5a597fd", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257491, "uuid": "223347aa-e82f-4173-bc9b-868743764b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257491, "uuid": "e668c9a1-3638-439b-9566-6718a6209a25", "value": "SWIFT_COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224c8e69-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628226851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226851, "uuid": "531a5cf2-cf59-4fc0-b5a2-9369c8bf35eb", "comment": "Malware payload", "value": "0e51b896580b1130bbf7b54365a1f6e1", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226851, "uuid": "8f40efcf-4ed7-4aaa-a396-4707141488e2", "comment": "Malware payload", "value": "64d544229f5b60f5a4d886ded6104622d0a22207c63d70fd103f93e094a48b32", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226851, "uuid": "160fd1d6-6563-4253-84fb-d5b7f238ceeb", "comment": "Malware payload", "value": "9c481deca4f6a40731e0bf8f0bed6545384dfdba", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226851, "uuid": "5a49ee8c-3cf9-4450-8ac2-e9b1370a966c", "comment": "Malware payload", "value": "e8655c0ca2750f41fa7fa8b997a9f826efae75b24fe97b6abbdc9e03e64f95d19905ace2689ddf883d81e84ca018fb75", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226851, "uuid": "5a80dcc9-7e97-4b7d-9ad9-b5c870c4a91c", "value": "T157029D64ECA54602C2226E3DCAA747D0F833F69691500CCEA6843EB45DD1E261EE7795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226851, "uuid": "0fe2f593-0dc1-4bcf-a7e4-5b95ab6ff721", "value": "192:37XqJB5b7RChPGlGFvm5DSCUx8TP6teKKnzEDE6BhA:3jPGmm5RZT2ynzOE6nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226851, "uuid": "2aa9e2dc-c42b-484e-8006-e39e7c65ff5f", "value": 8331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226851, "uuid": "0f4e8195-b8f8-4ca2-9eea-33dbb2db1e7b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226851, "uuid": "c0898cc6-9bb2-4d09-997f-5fd537ad65a8", "value": "PAYMENT INV PROF-537263,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd6346f-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1628256824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256824, "uuid": "73d4c525-ee1d-46e3-b45d-07f2705c9532", "comment": "Malware payload (DarkComet)", "value": "a8f3f22dda294b02f410ca95116a23bf", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256824, "uuid": "466aafa0-995e-42b0-be89-96160473aba2", "comment": "Malware payload (DarkComet)", "value": "64f87a54df363755339567ae103af89b64be18546b14b22b93610e0080c3793d", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256824, "uuid": "40cb5a82-a29b-439f-92c5-ed80d195c729", "comment": "Malware payload (DarkComet)", "value": "413062e5f6a7ec6c23cb56fbb68c8984855e8a58", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256824, "uuid": "3261f2c1-45e3-4126-8941-f911eb1cd073", "comment": "Malware payload (DarkComet)", "value": "76ac0c76a856475b55c6bd46b8983d10f0e3a8ee4a1a3ea259a7926a579850d97a0baccabe7ef8f433322ba9903731b1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256824, "uuid": "f9ba36b7-a28b-4441-9db8-40481529bbe5", "value": "T1AEE658C09810C5F4B9D92D61FEC076D830E2AEEDB4ABEE498758E063256DB8DD5C4C4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256824, "uuid": "7b95d92d-6b53-40a6-b9f9-05cb61e5fdd3", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256824, "uuid": "42582203-0093-4a2e-823e-9d31c610c7f2", "value": "24576:4RmJkcoQricOIQxiZY1iaZzCvJtvH1MTZthrK5VifNCAM2CRJOon2b5Y/gGYaHH7:9JZoQrbTFZY1iaZzCvJtvHKTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256824, "uuid": "bbc64195-63fc-4197-a1bb-4ad69c5c99ce", "value": 14345520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256824, "uuid": "9c3bfe41-d211-4ed8-b615-b7fea12f5dfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256824, "uuid": "30836d7b-fc1f-48a9-9d15-5d4b5c7688a4", "value": "GHLDRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd7ff5d-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628226820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226820, "uuid": "604aed90-32dc-4410-b651-2067469d1e29", "comment": "Malware payload (RedLineStealer)", "value": "b42704e036522f996c05f3654c75d72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226820, "uuid": "73c7778d-6b98-4572-be26-8c61eafb2117", "comment": "Malware payload (RedLineStealer)", "value": "662600f382e511621992245fcbeb5d347ea6c6a904beabfebbe20b779122aa6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226820, "uuid": "dcd19cdd-fc32-441b-affc-5629bdc2a530", "comment": "Malware payload (RedLineStealer)", "value": "21c94c421d4b7bb42f7bac4ca393d085a81dc53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226820, "uuid": "94691f38-301d-4072-9b04-2ec71e356543", "comment": "Malware payload (RedLineStealer)", "value": "8a3fdf5cd5d6ec5641bfa96cd6ddff7403c679d0dbdfc42fd88a9a86bbe6e63942ab30620eddcd9d01f4e81f4fea26aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226820, "uuid": "f6012535-b375-4e94-b48d-73ad038b6783", "value": "T11155023FB6985E46C6881DB8C6D3853183E15E53AF31DA553E62B3C11EB3328DD4A389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226820, "uuid": "3873f0b8-4504-43f8-b254-56f6d0a096da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226820, "uuid": "29f20533-3e45-44fa-9bd9-82e0092c2513", "value": "24576:fFH4PhvVLOorKyaSNX3KutmENbi09lHac2JfZ/UcU+BO773:NY95FrdgGnNeKdac2JfFkQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226820, "uuid": "0e3e2896-85c4-449f-9e74-1820590233a0", "value": 1281200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226820, "uuid": "8df10663-1239-46d2-8453-19006572333f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226820, "uuid": "946b5062-37de-4a67-a5f6-a7f13aaf9240", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9de6781-f649-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628208261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208261, "uuid": "be3de8d1-ada4-437f-b73c-4cf503215865", "comment": "Malware payload", "value": "af36e389777e2b33f4c2f785203d5c77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208261, "uuid": "9a801a80-ef27-4d86-bfbf-5221c74bedcb", "comment": "Malware payload", "value": "667acbebfcc761db8007c81199fed2e3bde1d4871327857fc983320e3a691aeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208261, "uuid": "29565f81-473c-48f3-9cba-b944d2ed96da", "comment": "Malware payload", "value": "28af4bd7d6a9c7a2ebf152859c76dbb76c355bfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208261, "uuid": "af21acbf-adc0-4e08-a52c-8b15bb427a52", "comment": "Malware payload", "value": "18de4ef62fc343c8ac116e4e31dc02d01c0a7e46531100c300acc6411e57afb98118456943f61b594f758d770cea2c66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208261, "uuid": "cdd16c52-b50d-445b-814a-4d6c43f4cfdc", "value": "T1A0D1D51067E8063AFFBB0E35AC7213108774F641DD67DA5E5E84121E6D73A488A32F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208261, "uuid": "d17b3cdd-02f4-49ab-adc2-1345485cb044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208261, "uuid": "aa596990-695d-431d-9b4a-8b75590957d3", "value": "96:wgcUxeAdByG7FOBC6+2Ux8e5lYlfhemtlLvpllKbzNt:hcoeCxKC6WlYlfvlzpnK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628208261, "uuid": "6377794c-24c5-45de-8779-8d15ec16ca77", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628208261, "uuid": "6cf11b70-c171-4c1b-a8a2-07e8859c7e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208261, "uuid": "63e7d6e1-fc94-4987-aa64-c460365e2076", "value": "af36e389777e2b33f4c2f785203d5c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa4d4f9-f703-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628288014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288014, "uuid": "21ae340f-5bb1-4d8d-829b-afac95225c1c", "comment": "Malware payload", "value": "5e3e9ac6e280d8f7fa0e29707d32ce63", "object_relation": "md5", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288014, "uuid": "b9898a24-1a8f-4a72-9b06-8da2971db05e", "comment": "Malware payload", "value": "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4", "object_relation": "sha256", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288014, "uuid": "aca0d395-d877-4fbe-9b4e-a9c759b17b05", "comment": "Malware payload", "value": "6dc64e916faaf7cb26c7019e3d1e9c423550e2bd", "object_relation": "sha1", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288014, "uuid": "eefa9a7c-c644-46c8-8ce2-6d33533d8965", "comment": "Malware payload", "value": "8756512b53a947d7a427d271e3974f8446d93e9294b86f5a00b10d715811587954b9a935603db18270dab8aba0e317c8", "object_relation": "sha3-384", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288014, "uuid": "fff65598-bda8-406f-90cb-395bb31a01d6", "value": "T13AE47B3935D2C03BE2730630193C92A914BAFA728D774A5B7394576D2F788929D22F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288014, "uuid": "72d05ffe-fda6-45a0-bd1c-25c03694581a", "value": "6a4fb41bdb00ba9bffd919feb1151eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288014, "uuid": "9c864ed1-b9de-4cd7-80c8-fa38466c6502", "value": "12288:MitiD457t3atFHy19oZr+ouYrhp4Ie75jrPJNGIpx9v0N6XbV++uzTQS+ITf+o/R:MitiDK7t3atFS1cr+6pXe7LoIpXv04bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628288014, "uuid": "7fc0f65b-0475-4d81-b093-13b2c76f2e2e", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628288014, "uuid": "bc9bd451-a256-424a-9975-4d5c993d73ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288014, "uuid": "d9a53f7c-af9e-4f94-8856-d593ab7012f0", "value": "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99df162b-f696-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628241225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241225, "uuid": "8292b5d2-713e-4a03-b4ae-2719761c50a6", "comment": "Malware payload (NanoCore)", "value": "324b42789770a989bf095d1954519235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241225, "uuid": "b354170f-5350-4798-9b40-65f302f9d5ac", "comment": "Malware payload (NanoCore)", "value": "67794b522d3185f6872eb4d77782d7d22a540f55d4d4f56783d1a43d1c088dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241225, "uuid": "6476fb3d-e136-4c0f-8efd-bddd0daad691", "comment": "Malware payload (NanoCore)", "value": "943b76ab5ef5673d7d6dd6960d99ab56668c1d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628241225, "uuid": "168014e9-ab6d-42fe-a13c-eefcd9671081", "comment": "Malware payload (NanoCore)", "value": "0ca31d6359eae4840801c3a1f81f07518d861a51538f52cea42ed1148ba4dfbcc3754027aa3bd4ff93ee6282e150babc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241225, "uuid": "e048cf97-74c3-46e7-968f-9e1f3cc04d0c", "value": "T1B715CF202BFD4714E2BBE774173551008BF6F53BE612CB8E2C66505CAAB37828762F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241225, "uuid": "63a358ac-6779-4f79-88b0-f596e9160c6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241225, "uuid": "62e99d3c-aed6-4538-b38b-000ccc2ffbee", "value": "24576:0MwFVMNjTdd/jkkoiLOYxK1X6/hz060gWWQx:XwFShpZwkoQPxAI6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628241225, "uuid": "0cfda619-0d17-4e9c-9944-070f66c9d3bb", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628241225, "uuid": "3f693c7d-2364-4371-8c69-db4b08f90e9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628241225, "uuid": "cc3ea613-23f4-418b-8b7e-4ed5da9070cf", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23dd6cf-f6bd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628257989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257989, "uuid": "de891212-423a-4c21-b521-f33ef4106d54", "comment": "Malware payload", "value": "d2d3438e61d5dcd688652f3f9a67acdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257989, "uuid": "24155f92-530c-43c2-8bd5-7faf80607833", "comment": "Malware payload", "value": "67cd12a71d272aac15500b452bfc4c3228e0b7120ba75a19543257b7223b2ce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257989, "uuid": "e4ef3544-c4a8-4592-855c-70e80f095913", "comment": "Malware payload", "value": "e5ef89d044944987a23578ed102eb584f58371ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257989, "uuid": "55bf5307-c061-4f75-83c6-86dd844c4fd1", "comment": "Malware payload", "value": "15a40818bea5117316e5b838818f7807f65edb078bd04f0e9a4938dc0c5628ad08fcb826db021226e311a1e7f477507a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257989, "uuid": "99eb10fb-ea56-4c06-90e0-71c36c2d0fd7", "value": "T18A95F1C1EBE44175D1B10BB18D711DB0593BBC542A7AA89E1248F51F4FBFA82D82A337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257989, "uuid": "0fe333aa-7909-435a-884e-2f4a8fc792c9", "value": "c0368754e508c9f92c16810ccc9c68cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257989, "uuid": "ff82f648-3d21-486e-9d6f-3e63f12e4044", "value": "24576:XLRorZQmsbyIISwoMmJcCW+WCwcWiNFBtTMA2gdOjBpdo6AOldmf4kQ8Xi3Up5s7:X1OF9IIFEcelj7AA2dBpdoXumLrfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257989, "uuid": "8be01ad5-dd50-4070-9774-5ecd666d8682", "value": 1908736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257989, "uuid": "518b499f-2a68-486a-a55c-3b21a3dd01c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257989, "uuid": "9d89d555-397a-4b06-9c8b-42ff8ea6014e", "value": "d2d3438e61d5dcd688652f3f9a67acdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74237439-f695-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628240732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240732, "uuid": "fd8ca61e-b592-4cef-b1b0-265315367647", "comment": "Malware payload (NanoCore)", "value": "d4d72f611b1df74bc0ad34a9b3836164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240732, "uuid": "b8ecc3b7-b77c-4d3e-848d-10afb9885f9c", "comment": "Malware payload (NanoCore)", "value": "682d7aeda734735723e17803cdd711d0a5aa79e43c61a8d9d1137bee47ef2abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240732, "uuid": "f030a57a-062e-4a17-93e3-ab847c40e669", "comment": "Malware payload (NanoCore)", "value": "d479e2258f6fbf27c4ce5a98859190e865a68382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628240732, "uuid": "a9e666ff-1a83-410b-97b1-46561f03a74a", "comment": "Malware payload (NanoCore)", "value": "86eeedc1b73a21a3d7e2d69ee53b94c63cbe81d96bea969fec18cd32b8c5ca1f473895e73da4cadc9c6047046fd49802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240732, "uuid": "7effc4e6-eb14-4d95-9a6f-ff60f65c6131", "value": "T161658E2439FA901AF173EF659AD4759ADA6FFB733B07A45D1091038A0723A81EDC143E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240732, "uuid": "08ce36a9-7670-4ec8-86f0-13fbe75590c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240732, "uuid": "9bb3920a-739c-4c22-becb-acf6ee7e0f68", "value": "12288:+osiK76zNMbbnMk/MB7sPjxatiKe7EpnwLZKjqcuhxTCPn+WAjmX4LKhJqMMiKBE:jA4kswgs24Q6+co4Bf1hVkaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628240732, "uuid": "55366411-95c4-47f4-b799-d1fb12220d81", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628240732, "uuid": "af0b0454-5c9b-4d13-b10f-49141a57ce38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628240732, "uuid": "3dfdadd2-e1f6-43a8-8684-f66b7c2171b9", "value": "Remittance Form Payu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a017950-f68c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628236903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236903, "uuid": "3c491e4d-517f-4af4-866d-ab6758ee43f0", "comment": "Malware payload (RedLineStealer)", "value": "d1d5a2fde3e57dfab18fe8ba80237543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236903, "uuid": "89390059-dc9a-4bf0-a7f7-b90c009594e7", "comment": "Malware payload (RedLineStealer)", "value": "6aac7c267ba0d37bb147e139781dbcb197f10c96e281b4cf7dfc261b64dc0b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236903, "uuid": "2824ab62-f7ed-4bfd-beed-47645c05af05", "comment": "Malware payload (RedLineStealer)", "value": "32d080c034cd2173904b0f517112780d431503f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236903, "uuid": "522d759a-a84f-4aab-be01-606e864e5ab2", "comment": "Malware payload (RedLineStealer)", "value": "c459daa5ecfa6c3b2aeca72dd4a8409a573172bbf9bf8839a246f0d90bcfd7c950d95d258b51b67e578dbbf7162df9db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236903, "uuid": "cc8d8115-57b4-4450-bc3c-6ea2bfbee10f", "value": "T14E84352864BFC01984E3EEA52DDCA8FBD99A55E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236903, "uuid": "76e8201c-118a-4897-92ed-1f0ca5536f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236903, "uuid": "47b11fe3-757f-467e-9e9a-1bdc9e57d4a2", "value": "6144:BhUfR1GdSPEg2ky6UJR7cz/CcY7rw9we7x:BhsR1GdSPEXkyDJR7cz/CcY7rw+eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628236903, "uuid": "26d78074-3201-44a5-8d0b-90149516b1bf", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628236903, "uuid": "7f6c8563-f9f6-4d3f-8545-6d9e4e97d7aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236903, "uuid": "af0ff550-220d-4bf3-8a1b-3faeea196376", "value": "D1D5A2FDE3E57DFAB18FE8BA80237543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330d79bb-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1628231603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231603, "uuid": "31a4d452-8bc5-4840-8f6d-22a6d56ae397", "comment": "Malware payload (ZLoader)", "value": "aac2b6314988e0aea824fe0a53b917c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231603, "uuid": "6d639c8b-5661-4f78-94a2-6eb85f54f993", "comment": "Malware payload (ZLoader)", "value": "6c8e5f1670515c6a9d3cdcafe6d9a782a87f0f085095558cc0116ea73281c059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231603, "uuid": "1a4f260a-404f-45ed-8fa0-88d24712e859", "comment": "Malware payload (ZLoader)", "value": "17c0d629b7a2f940e7a69f1120582cf89f70355a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231603, "uuid": "9c1ae71f-b15b-4126-97ce-a86c1a964832", "comment": "Malware payload (ZLoader)", "value": "62f4de59ef28c19e7e0ba83f4cea41cf311cc0955d26934fbe736cc25db7325db70f4b413e3b705f73b491947b090733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231603, "uuid": "2c2ce6bd-2106-4496-aa75-e3950389df1e", "value": "T1E0F37C0B63F82066E4B5937459F202C35932BD715B3882EF128E997E1E336E0B631B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231603, "uuid": "c1e47347-c360-46f0-9c73-7c476423ce90", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231603, "uuid": "0caa6318-2edf-4f2d-83d2-76e39b74d61b", "value": "3072:4ahKyd2n31d5GWp1icKAArDZz4N9GhbkrNEkbTX2rv:4ahO1p0yN90QEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231603, "uuid": "4103fec2-126b-4a2f-9ab5-4205493b014b", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231603, "uuid": "b7f73ba4-e2b8-4f18-b149-60b3959adb29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231603, "uuid": "0e17847c-5e9c-42dc-b953-daa8f39607f2", "value": "aac2b6314988e0aea824fe0a53b917c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba2540d-f68a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ShurkStealer)", "timestamp": 1628236020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236020, "uuid": "c8b8cbd9-df9d-4820-87ac-67eed160e8fc", "comment": "Malware payload (ShurkStealer)", "value": "a89b5a1a3c1a93488c80c0068fa16109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236020, "uuid": "464f3c25-5a21-4198-aa6e-5f5ab49b4151", "comment": "Malware payload (ShurkStealer)", "value": "6cdefe842611b0f9fea4571bc07ff0de77740f440115852436f4afd1324e981a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236020, "uuid": "b250b6ce-4c29-48a6-a830-dea9e8f35cbf", "comment": "Malware payload (ShurkStealer)", "value": "adeb69a80fe2bf50fd4ce269cc061a92b7ea7314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236020, "uuid": "bc6e42d7-7a73-4213-b8ce-d1b376ae5bb9", "comment": "Malware payload (ShurkStealer)", "value": "f476e40209be715b63b296b2b39f057935be0e8431931402fe4b38034e824457941fd861cd19dbe2e11e47d2050f1158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false }, { "name": "ShurkStealer", "colour": "#D21E0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236020, "uuid": "14f909ed-3611-49ce-98a8-a11acb8a94a2", "value": "T130A4BF12E5B1C171D517A47007BCDF7289BEBA300A6199FBA3C41D6D4E311D2A73AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236020, "uuid": "6b6dee15-e052-4316-b945-2ac212e9b3f9", "value": "f78ec1580e5cf11dc31a5258bb19ce5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236020, "uuid": "42744591-6dfa-4a7c-b4c0-000dc9e355e8", "value": "12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSPZpJDalpS6Xq2EVHfdm:7WTkqKfrTko77i3CXEigVVSPUlpSy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628236020, "uuid": "a3bd8047-9d9d-4684-90cb-af7a021d9f56", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628236020, "uuid": "b8282b9d-b71c-4352-85d5-c50cfa90478a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236020, "uuid": "95fe5acc-f735-4adb-b0a7-ab9f51ce85e9", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2fcbfe-f6e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628273768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273768, "uuid": "7d707d7f-d8ce-4674-a2c7-0506fb6c5292", "comment": "Malware payload", "value": "a845dafc3b8b49cb7a690cbe086853cb", "object_relation": "md5", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273768, "uuid": "aa1da6ad-24ee-4d5d-b74b-574dd7611856", "comment": "Malware payload", "value": "6d5de7e73803f09fbb98782c071f1882b5bfb681631801f55bc162efbc0b1d03", "object_relation": "sha256", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273768, "uuid": "83d9beac-f51a-4ba9-8e86-8bed5a0251f5", "comment": "Malware payload", "value": "4d71ffb1f97211963a7cad89059333ffc55c21a5", "object_relation": "sha1", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273768, "uuid": "4dc2babb-4919-487e-8277-7694c1b12c20", "comment": "Malware payload", "value": "3e559f686dc7ad04059b2ad141f03ac1c9e36fc7ac8db91692b3ec5ec1384a5296d59a3a46486ffa257147380785eb5a", "object_relation": "sha3-384", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273768, "uuid": "c0a87328-ac88-40a8-a5cf-aeecdddd2de8", "value": "T113440217C71312E5EC7DAE7050A0B20F7F32374A9774DD7382228A55AC93B52B4B91AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273768, "uuid": "ae93a596-70e2-462c-b4ed-32b6cf5d5323", "value": "c5a628f46d759fc3242f38061efe6410", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273768, "uuid": "825db20f-b03b-4bba-a558-30be0e5fdfd7", "value": "6144:RdzSBLCFiWO4JjxpJOARAaStn3bo2bJQXTQVIh:ru9cnxpYAOpn3bo2xVIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628273768, "uuid": "e07144d4-a06e-4f7c-aba4-3ad87848e9be", "value": 259488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628273768, "uuid": "25211649-fb96-46a4-9c76-33017f75fe1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273768, "uuid": "9cbccaeb-1023-4aa0-9882-788c5ca0ae28", "value": "dmap.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bace73-f69d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628244392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244392, "uuid": "6ead9e0f-4c55-4a8d-b7f5-e642dd4b8271", "comment": "Malware payload", "value": "3e7aec043c752f105913cc0951d25b5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244392, "uuid": "fb95e195-d27f-4d6a-bcd9-017ffe908176", "comment": "Malware payload", "value": "6ee57fb0cc1add48debdf3c6c012641b5b3f229d0731cc2ff4023c5e7ea728b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244392, "uuid": "d326cb80-f73d-46c8-95fe-d97448be20b7", "comment": "Malware payload", "value": "323a9de8841628fff7ee6f778f1e5f338891c605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244392, "uuid": "1b8f6767-710b-4d14-98e5-ab21b029340c", "comment": "Malware payload", "value": "e84d304defdc1376fb525c8fed8cd1a8032fe9c41165ee9dbc88623266f5082e1da0cf09b3264f8b81be0ba6497ebf8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244392, "uuid": "b64f8102-a201-41f0-af90-938ff189c2c5", "value": "T1304502315AA2FCC9D77A1E70A9A41D151C2C7E93A3A0455CE6C435DF22BA344DF3E2B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244392, "uuid": "68e06f3f-a666-4e98-b75b-40b6d4a2663b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244392, "uuid": "48b187c6-34be-4bc1-b097-967f16cb4908", "value": "24576:PlpGWEvmPPyERDS2j110IVFyWZyJzYy0sIJY+j7xy:PiO7X+syJDGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628244392, "uuid": "0d7e868a-546f-47c3-b04c-3cb827a3f127", "value": 1170616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628244392, "uuid": "8ade0144-a2fb-45c2-9e7e-42127bbc67d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244392, "uuid": "cabe81b4-0173-45a2-a7d6-bb8f46563bd2", "value": "AlphaControlOneTimeRemoteConnection.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551c328e-f6a5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628247552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247552, "uuid": "5c84447a-b708-48f9-a7fb-aa62b60a77ef", "comment": "Malware payload (Gozi)", "value": "a99146b239d8f7be6e7281460eb625ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247552, "uuid": "716175fb-4811-46a6-88d8-4bbed4292928", "comment": "Malware payload (Gozi)", "value": "702dc8fde667d79575a192cee0075d75b6c2266138896e529cdc08fdaaea440c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247552, "uuid": "28076fdb-5e0d-4f99-b108-debfef098815", "comment": "Malware payload (Gozi)", "value": "7ac0e23d8c1e6ade2d7eedf2bdcbf431967aa726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247552, "uuid": "ee6907bd-b288-47ba-bdfe-fb79b9aaee60", "comment": "Malware payload (Gozi)", "value": "4825732915796ccbaa2e79732057041db228ec64bd70da6958c06965d95404da4d4e9939bcc467f41fa4c02a4aaf4a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "SHurkSteal", "colour": "#EEEB69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247552, "uuid": "3bfb74ff-92d1-4666-ac57-2abee940c9ee", "value": "T1C1A4BF12E5B1C171D517A47007BCDF7289BEBA300A6199FBA3C41D6D4E311D2A73AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247552, "uuid": "3d0d925c-d7f5-423e-b3dd-1f8e63a6a085", "value": "f78ec1580e5cf11dc31a5258bb19ce5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247552, "uuid": "1846c65d-bfba-4322-8646-7cecaafce700", "value": "12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSPVpJDalpS6Xq2EVvfdm:7WTkqKfrTko77i3CXEigVVSPwlpSy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247552, "uuid": "a7676fd0-72f3-4909-861c-7a887ad4a0e0", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247552, "uuid": "a523b735-df6e-4012-9c36-55adff2a2e31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247552, "uuid": "6e97f414-c987-4af8-9399-1d9c5d7964b6", "value": "702dc8fde667d79575a192cee0075d75b6c2266138896e529cdc08fdaaea440c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa91776-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628256795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256795, "uuid": "1504196e-98d3-4822-a677-08b379a1cff2", "comment": "Malware payload (AgentTesla)", "value": "72d3fb6a5e154ffcd0e7a616c7fb4757", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256795, "uuid": "88dd9469-6d9e-411d-a459-e51ccb13e49c", "comment": "Malware payload (AgentTesla)", "value": "70ee06cd66b7d44ee847205461ac43ca346b2515a791d8e0fb3a60474861eea1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256795, "uuid": "cb426862-f649-4dc3-b413-ea057d694282", "comment": "Malware payload (AgentTesla)", "value": "012ab3dbdf7d9abc63cf7005058bc79e67c794a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256795, "uuid": "08baaffe-7603-4db1-9647-a7ffc8e963d7", "comment": "Malware payload (AgentTesla)", "value": "e95445bf901d6e1f888d56755623de9346dd19d529f8cb5e93d63a7360262a097d8ebcb4bd1334e7a68d88e383da4645", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256795, "uuid": "3e0efd61-859d-4367-9f88-12b23b0492c0", "value": "T1AE05DF3076FE6314E1BBEB70463591404BFAF53BD722CB8E2C64549C9A73A828712F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256795, "uuid": "ca12bf14-79b8-45bc-a47b-70a0b3ac925e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256795, "uuid": "4cc8fb7c-de90-46eb-8d3e-23c33608db78", "value": "24576:aWN4b0wFVMNjC1GL2+tn2BpqrCbrW6iJxb3ZoIqseb1K9o:34YwFShC1+2ICbrW6WxzaAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256795, "uuid": "d8351ab7-bbb2-4795-9164-d6d8d0f6721a", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256795, "uuid": "2d3f5e66-5b58-4fa4-898d-73d05ca2a4fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256795, "uuid": "796394e8-9227-491e-98e5-9694deb46f8b", "value": "eMailShip Consignment #960597804_awb dhl doc(s).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efe6110-f68f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628238173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238173, "uuid": "583fd39b-c6e3-410f-ba20-8b473b680b79", "comment": "Malware payload (RedLineStealer)", "value": "eff39b1c1a574f99a08211284293a3da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238173, "uuid": "b7ca08cf-9a15-4482-9575-1c1fe6e9a96a", "comment": "Malware payload (RedLineStealer)", "value": "7332c0a22bffbb024052e842388e8a34d5d82d88ed0187ea16ddc810bf352604", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238173, "uuid": "dcc2ed4f-8631-4e81-b586-48ecbdae83a6", "comment": "Malware payload (RedLineStealer)", "value": "2ccaebbd3d898b7fffbff87bd5f21c72fc11789a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238173, "uuid": "3c6d3316-2eef-4e4a-8e33-57468a981eaf", "comment": "Malware payload (RedLineStealer)", "value": "56a103cc47dfeebf4dafaab95433dfad43a654d401b0d6422c0185ce2ebf9dd0dcb85cb8e6175cbcf78b567cd0d4031a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238173, "uuid": "9104a9cd-9f72-41b3-b02d-9bb1e36233a8", "value": "T142E533C31B015D46D6779A307853877B3AE36F022A6422F1F7A4763A8A37273EE1E514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238173, "uuid": "ef805ab2-ef74-4892-8164-99c736ed9f16", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238173, "uuid": "051408d9-c0ce-42f0-9e9a-969c6148e664", "value": "49152:ssvTsoeIzL1amvA3iJxJuUkdPAPJvKxTqqXKBEKcU7/1ZCwrmGnCHNtTomtfx:ssvTfiiF/QPARvKxTkxcUr7rmOSMUfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628238173, "uuid": "4f060a53-3696-411f-8465-7fd7aab5e146", "value": 3267792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628238173, "uuid": "2534d91f-e7a9-4a73-9cc1-08e9b726e09a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238173, "uuid": "21e16f09-3e22-48c8-921d-a59cf9b3638e", "value": "eff39b1c1a574f99a08211284293a3da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0319bf37-f67c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628229805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229805, "uuid": "82716c70-7e82-43a7-b145-564f5aa9dd4d", "comment": "Malware payload (Formbook)", "value": "7d00a24f9fab1b955425fb32179eae06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229805, "uuid": "ed0afb57-d6a7-44db-98d5-a4b847384592", "comment": "Malware payload (Formbook)", "value": "74c7003daae4332200908731127b6a5252417bcb89ed610532bf577d503c7465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229805, "uuid": "58fd2286-17ef-4a96-adab-24cc424d6cd2", "comment": "Malware payload (Formbook)", "value": "af244f87ea871bcdadd6a979a492e3fbb32be67a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229805, "uuid": "a4c5c4aa-2133-4d51-a8ce-7c8c20974644", "comment": "Malware payload (Formbook)", "value": "3ed236dfc590ee1b388473cc670800aca5d7269b12b771e3955d82d333c21cf255735291dad5b2a1aa7ec37db6e1e329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229805, "uuid": "707d05d8-fe04-4301-9f4e-28e423a7f719", "value": "T18215CF50E640E616C59819BF1F7CFA7013FC9D8A0596C0412ED9AE573B9FEFA09832C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229805, "uuid": "60d2a655-65eb-4019-8d60-ff2a46eaa845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229805, "uuid": "1bc425e0-5869-4e2f-9769-7992390723c3", "value": "12288:8VMcWx9OELy3tq0WkhFCEgYc5PR2+CQFqrWK0o7nXY1yDF2ltu1jst2NjFPMOH9F:iQxIQ0hp8ZPCWK3IcJ2vWjsMNj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229805, "uuid": "2fcb6b60-a577-4769-bbd6-31c4b0e60951", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229805, "uuid": "352a5ed1-4acb-4ffa-a763-107f4f0b113a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229805, "uuid": "e6191627-ef14-4b80-8de4-63bacd79132c", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631b685b-f686-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628234261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234261, "uuid": "313ba356-fde7-4ae8-ae79-64ee83691f01", "comment": "Malware payload (RemcosRAT)", "value": "91377a06d6d8ca487ae04d7dedd25faf", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234261, "uuid": "b8d133ca-09d1-4dea-b135-f032c473ba11", "comment": "Malware payload (RemcosRAT)", "value": "756f9b558a3bedf13017b0e8b5214d6d074778ee2696935c883eb0248b98fb39", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234261, "uuid": "577fae84-89fc-481f-b510-5a8cb8d20e05", "comment": "Malware payload (RemcosRAT)", "value": "e2fb1f34af82feaa483df8fd579736f755d3b4ed", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234261, "uuid": "7327eb48-215a-4cab-91ca-468876c53c4b", "comment": "Malware payload (RemcosRAT)", "value": "726babaae9a52f5ee2581d03182fa447f1c37c24d8f650c0dd5f738cb6da4eb7860e5136a0f38300a6ab3b1f33c12dcc", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234261, "uuid": "897376fb-0d7a-4dc3-bbfb-2fe46ffe983c", "value": "T154E45C16B77A8076C54289B80E3DCFE92C2FBD529D54344B6AE4BE4E5733983352620F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234261, "uuid": "8477d49e-9384-43f4-bbca-a3cdce3a4db3", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234261, "uuid": "b4f77deb-e972-4506-b059-20b574a018de", "value": "12288:YLJ8IaEF3CbhMemzpeVhpEj7c0DFtIGnuok:YLJRaElQMePyNtIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234261, "uuid": "fda57783-40fc-48f7-8364-f391e9463144", "value": 720616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234261, "uuid": "28e74700-53e0-4751-a915-b49f5c799514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234261, "uuid": "07e4bfac-b335-4fe7-8712-bfe1f76170cb", "value": "756f9b558a3bedf13017b0e8b5214d6d074778ee2696935c883eb0248b98fb39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9da9df-f691-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628238837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238837, "uuid": "6251ba4e-3016-4ade-9f38-5d2e79b23c46", "comment": "Malware payload (SnakeKeylogger)", "value": "5962290fd4e8734eb9a4122acee443a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238837, "uuid": "66a9f1fd-9248-4b91-acda-e9dccc25b22f", "comment": "Malware payload (SnakeKeylogger)", "value": "75fa7d0d8a34712c2510bfa863a1b33b25030098891ca1b2b24b31852c955377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238837, "uuid": "d05c201c-bc99-4d98-979e-86e6a2e8fd68", "comment": "Malware payload (SnakeKeylogger)", "value": "3d9146d1bd81d68178090761b7b5b5aef402fd4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628238837, "uuid": "51fd9b5d-e1df-44ac-822c-eac5b48c8533", "comment": "Malware payload (SnakeKeylogger)", "value": "1239c4efa46116b91b110d929126740d9a9dc85b4d4bff62281c467cc26ae2974acebc7692f27a91a6559ccd877fb8b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238837, "uuid": "29a0c2e7-ce55-4858-b946-58202bb0aaef", "value": "T1FEC45A2439EA501AF1B3FFA95BE474A6DA6FBF733702945D10A023864723A42DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238837, "uuid": "386da80c-c8a9-458c-aab6-b5e48ef06a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238837, "uuid": "f686a192-69c6-40a0-8794-c06613e952e4", "value": "12288:7RgFKZPRyZaJJwMbEsFuBYkYK//3tM82mt01uqGnCdDRUaH:72KB/E20OtRCaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628238837, "uuid": "878e572f-39f6-4c2f-b4ee-1ae5b97c7316", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628238837, "uuid": "6ad7eba0-5d53-48bd-a42c-fe5f92583456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628238837, "uuid": "7c0d3101-074b-4acd-89fa-1d2a8d8eb307", "value": "4KLT0900000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450067a6-f683-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628232922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232922, "uuid": "ba28a417-de88-4f32-a2f1-4f7cb195d3d3", "comment": "Malware payload (AveMariaRAT)", "value": "6efdfe2151fc4bba037b8744471cff1a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232922, "uuid": "7a6b2275-939a-4356-ab01-63b17135f797", "comment": "Malware payload (AveMariaRAT)", "value": "76ae36788678908972c009c0e0980ddd9f90d4c651fb7247ec120eaca9563611", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232922, "uuid": "6aa2bbb6-d287-4fc2-9730-adb349923945", "comment": "Malware payload (AveMariaRAT)", "value": "9ef3162d58ef229767bc9378caf0763fe7435497", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232922, "uuid": "d8bd83f9-6a74-414e-a900-644f39f3aec8", "comment": "Malware payload (AveMariaRAT)", "value": "bd4299aac4871fe8daf439589bdffa9fd04a33ef5586f4868513af95a2ef34c9143b1bded339dbdd4e8f3f11e20ab19b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232922, "uuid": "c05e6c8e-9e17-4b1c-9729-b61df443214c", "value": "T1A305CF91A2CC9213C19C197B0F6AE6710FB8BE391165C1462ED87DCB3AFFFA646C1581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232922, "uuid": "aacc6792-bc45-4a30-a52d-44df1eb2dd77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232922, "uuid": "4379bb1f-5622-4e7e-ae8b-312d06fa9ded", "value": "12288:7d7NkjnVNh1OVe/3HY+oKE4/2XjAG6mT7napIMa2Rd1jAt2NjFfUB:7dxWVNh1OEfHym2XjRrCXRLjAMNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628232922, "uuid": "666e09cc-edb1-44a5-8f90-d0cd3890dba4", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628232922, "uuid": "5c27c175-d1bb-4c7d-b7ab-f477b70f6bbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232922, "uuid": "ead22cf7-3660-4e2a-a451-ec28fbdcaf72", "value": "THANH NGUYEN TECHNOLOGY (VIETNAM) - INQUIRY LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1deaed6-f6c0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628259331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259331, "uuid": "a0dabc77-2e19-4911-83cd-68f448ce1be7", "comment": "Malware payload (RedLineStealer)", "value": "d7bc45fff58cb389488de40d74cbc0f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259331, "uuid": "50903f5a-fdf4-4ded-8d72-889eee4a6078", "comment": "Malware payload (RedLineStealer)", "value": "76ca4a8afe19ab46e2f7f364fb76a166ce62efc7cf191f0f1be5ffff7f443f1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259331, "uuid": "f0471d60-6369-4398-b205-7a8c4e347595", "comment": "Malware payload (RedLineStealer)", "value": "b0b89bafc46e9d646f60a42948fca2ed8f844d5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259331, "uuid": "d0003965-4268-4786-8121-8be733cee150", "comment": "Malware payload (RedLineStealer)", "value": "fa9fb7cd559d0f4df2811a5331bdd975e7d1329b562f4ad10d794d7fb83b9aaae858cf44f724164d5a566894f86dc42c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259331, "uuid": "85249114-46f4-49c6-9663-7370c893dab7", "value": "T1F705C0427184DD99E4272AF1147FC46023F87D9E8625D60E3FC3FA2A95E7312219BB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259331, "uuid": "3e15ad85-e774-4f3c-94b9-773385ff9b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259331, "uuid": "78169522-15ff-49e9-b75e-7ce07ed4e5bd", "value": "24576:e5oWwI2TjZmKun/LduBmDeP1rNfMNjcd8:uoO2nZmKu/gmQNUhcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628259331, "uuid": "97cca1f8-29c1-4bac-8781-03e5d5ba6308", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628259331, "uuid": "336c4038-af8f-42f4-bd56-acab9a6f712e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259331, "uuid": "4f77b218-4449-405d-8b49-7cfcbe18f14e", "value": "DOCUSIGN88200129348883223.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70695de4-f676-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628227411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227411, "uuid": "82702e41-ddb9-427e-8393-b206d2c520e1", "comment": "Malware payload (AsyncRAT)", "value": "8770a139841ed7773d8e890173c474e1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227411, "uuid": "e1418a33-1628-4033-a029-71ede5490e2e", "comment": "Malware payload (AsyncRAT)", "value": "770b8f1bd72d9e4a5ba43cc735e35a13a04a539722a34037fb533f966b615c4e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227411, "uuid": "5ae2bb3b-0d28-4967-946c-f1083d4542c6", "comment": "Malware payload (AsyncRAT)", "value": "632e9968d27e6092bec9cb7fe218140dd9f30dd7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227411, "uuid": "d0c9bad9-cb55-41a7-ac9c-7cfb6ac29c4f", "comment": "Malware payload (AsyncRAT)", "value": "6d690681777a1e4913fe3b697f61c98ed7148adc4d7f7a693ef1dfb1882da4a7e519f43f61ba3ef996bd51e5e1d441f4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227411, "uuid": "fe0b49c6-ddf5-46a4-8684-737e560e18b0", "value": "T1FA019E15449D624A57E0C7EF05B44C2AEC02A7591708A42D24F59B0F741AAA283EFCAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227411, "uuid": "ea166b9d-0a93-4959-8379-37f0d7b460b2", "value": "12:bKEGhPIo5SAy4UGjMnZt+/9+iM9+DOOyv24b9+vM7ITkSSsapMr:buJy4fuAhMpOS9a9TPSsapC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227411, "uuid": "0ccf54b7-51dd-4742-b358-f5b751927852", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227411, "uuid": "a3a5c61a-a115-4e20-9ccd-b562485662a0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227411, "uuid": "ba2ebc9f-f7fe-4141-8f63-24c7d93da647", "value": "EYGM626.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71632f3-f67e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628231073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231073, "uuid": "81755d3b-2294-4a6f-8756-147d5bab5cac", "comment": "Malware payload (AgentTesla)", "value": "e0862470e5965e76ab37702c30096853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231073, "uuid": "beab1dc9-499c-4f6d-aa13-39331085a5bc", "comment": "Malware payload (AgentTesla)", "value": "7808a0341cfc13c07706366afcda3f3433d068ff1e8a9971a57a4700c691ac95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231073, "uuid": "cf1e8257-f4bf-4647-9df9-bfedc4e837e0", "comment": "Malware payload (AgentTesla)", "value": "4a9c6effe737a2d29db1c9e111a6bbe3cec55551", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231073, "uuid": "90940a5c-6ecd-422d-8efb-59c9110efa21", "comment": "Malware payload (AgentTesla)", "value": "9cfff3188f5371a242167b4fafb4cc3767b2314eebc1608426b6e293516095b56ca042ec230282604179d77983c8060a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231073, "uuid": "0d2f6bd3-383e-448c-936f-798d190896ce", "value": "T13EC53317F417924AC4ED8EB339D184B91E0732E8360A5DAFB9389943D04D2F5FAB64B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231073, "uuid": "ea8d7043-e00a-461b-ad44-11072b3bbe6b", "value": "49152:8OVhYV2GtvibBDK45LQ7X3Jrnq/hkmOYKPAbaLNAnVGz2YZ0cJ:8AYvibBD/50z5TahZOMMNAnVGzPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231073, "uuid": "af46d347-399a-4156-b0ca-50e6ca3c96c2", "value": 2696113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231073, "uuid": "5cbe42dd-c65b-43cf-8bfd-41ca2ae7e932", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231073, "uuid": "8bb09026-0b7e-4297-8be0-60b52cd296e9", "value": "RFQ-2201847.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304a1729-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628229022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229022, "uuid": "88c94b98-cc01-4f20-bdde-2a5aa66b6641", "comment": "Malware payload (Formbook)", "value": "465f28ec62439d3213d557636d48c8ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229022, "uuid": "ec5a276d-9417-45fe-a8bd-07ac6522172c", "comment": "Malware payload (Formbook)", "value": "78570fca1e6c0c1744c98077775fbb04d77e9acd34f80cb357f084ae14b97b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229022, "uuid": "c3610b7d-340f-4fa0-91e9-f418adc87325", "comment": "Malware payload (Formbook)", "value": "d20920fb0edeb53922134f29326a7fb623b8fceb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229022, "uuid": "526d9478-b1fd-4fc5-8b78-3fb9e500ca32", "comment": "Malware payload (Formbook)", "value": "881685106995cbf0c1b24829e4751112f2ea2072b34d0eddfe025502a957f04c4a91659a5d5af4dea06ce75a65df8318", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229022, "uuid": "a7dbec11-e2b7-4eff-a8b7-d5a1c8d837da", "value": "T128056C2229EB114DF3B39BB50FC4F8BF46AAF673561EB0B639421B964322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229022, "uuid": "0dcabe98-96d2-4712-b038-78fff9e14b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229022, "uuid": "26fccd4a-0788-4337-8082-465166dc7005", "value": "12288:HWjR3A5ZEoR65AXwgFvuSSrIqs3J20rFN4+yMoEFyvzpe/ZnFybt0ZdilySMCp:MoR6qg1sVSgNFsc/ZFssilcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229022, "uuid": "0f24095c-cd12-46cc-a5a1-316f33269f3f", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229022, "uuid": "7248df38-a4ba-453e-81be-c4fe76daf632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229022, "uuid": "abb882ac-0944-4b51-b290-f6e4d6976841", "value": "465f28ec62439d3213d557636d48c8ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5270f251-f6c4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628260862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260862, "uuid": "838e48f0-1751-4c9f-a634-2260baae07b4", "comment": "Malware payload (AgentTesla)", "value": "660335e4cc214263c93549181cb3f5e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260862, "uuid": "cef40825-771c-4045-b4f0-00c475fef381", "comment": "Malware payload (AgentTesla)", "value": "791adf1bdb23fe964f1cedceedc569bc33ba990c97c52c6ba99191e8c0a5ce42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260862, "uuid": "b7814733-42a6-422f-8289-36666bc40a2d", "comment": "Malware payload (AgentTesla)", "value": "e96c9a7f0809348c3055eb0fb222db6e667a4dc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260862, "uuid": "e2d8b027-dfe4-4f6f-9784-e392a6462305", "comment": "Malware payload (AgentTesla)", "value": "3c5f1112c2735717d80e7e55c7ee1acb2c75177f60a253d8a0c4af3f2f1621be09745625fc67410f562f3ef206da487c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260862, "uuid": "dea3c3d1-b274-4aac-8458-a95ee2b084c1", "value": "T165458B983654B29EC8A7AF3589645D50EAA1BC77430BD74B606730DCDA3E69BCF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260862, "uuid": "2548bc9e-14bd-446e-b164-7242e72d81dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260862, "uuid": "c4292c80-92a3-43d2-943b-bbb13918ce6d", "value": "24576:HXKySpqa8wFVMNjFtnKwezIQs11O2Fm25ttmZ6l5:3bwFSh7KzeVFm25t15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628260862, "uuid": "5d81ef84-cc74-4289-be58-c3ee816d6c01", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628260862, "uuid": "b22a36e8-f332-45b4-aefb-da98111cbdc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260862, "uuid": "657d9cd4-1bea-4333-b807-311d33b8581d", "value": "660335e4cc214263c93549181cb3f5e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091aa3b7-f706-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628289085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628289085, "uuid": "16868691-263e-47cc-9e2c-b2c689ecc94e", "comment": "Malware payload", "value": "a1e27da54295650569ad51d1202b67a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628289085, "uuid": "0e5ba82f-2dbe-4682-b888-42371e30179d", "comment": "Malware payload", "value": "79e927386ecc69a10e9e61043f30fce3216cbdedf6d13cfdf01938318f7a41fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628289085, "uuid": "1feb6b4f-3b96-4537-8637-221fe04780ac", "comment": "Malware payload", "value": "56b5f0277237bd0be0d5ef1a4d251c93649ff057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628289085, "uuid": "166a577b-3623-4098-ae10-82845e2d1641", "comment": "Malware payload", "value": "18055a27c07154790a480a6fd90d22308d797345973664489e74da4c11b6996b951cad98ef182b0a6d6c8f1d3231e165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628289085, "uuid": "b81f7c6e-29d7-43e6-b258-ca21c9a7bb75", "value": "T110A482137F1ADC9AC07506F515A2C3B4A7329D542821C387BBE4FE77FBB26229D4A244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628289085, "uuid": "3497ec50-70d6-4cd7-b998-0add6879c70f", "value": "9c29ffb7139cae82dfca54eee2ad77c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628289085, "uuid": "35a7eaf7-9fdf-4956-b3d0-b01f9aec1f7c", "value": "1536:hTzMIlYfZNy0yf9pgBRJKZsUvlGx5naOBtWRs:hTgNZ80kDaAsXYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628289085, "uuid": "ce4a52f1-fe68-40f9-b8f4-6d7ad7145db3", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628289085, "uuid": "da998c6a-28be-4cd6-bd99-0d27304a78ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628289085, "uuid": "d3ea2ade-4f24-4283-ae18-20add6e9fbe9", "value": "r_unpack_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4797cd9b-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628252683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252683, "uuid": "7e12df55-b673-443b-98b4-7d5e0c824f3b", "comment": "Malware payload", "value": "70fcecb4fd1d0acbe7100b3997456fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252683, "uuid": "cd0ab5f3-de7a-4bc6-89ec-5146e5f3a790", "comment": "Malware payload", "value": "7d707014985dc627d9bde0394a3e8945b7e2e1ae8301bb87e4ab5598672d37d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252683, "uuid": "65758588-3461-48d1-ab59-1c61f70aeb50", "comment": "Malware payload", "value": "2937f542496737216c481f7f3a887b07b5bfa55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252683, "uuid": "15950fb7-45bc-46bf-9da0-c3714ba64ba6", "comment": "Malware payload", "value": "9a73b61b4895432403c91b63691463c2e03fcb6d4d13a45012eceb614afab76bf4bf44fdee9ad0a371d3a4274639702a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252683, "uuid": "734a5b5b-6c6e-4c01-93d0-d4ae788c9648", "value": "T188142A0973A45F22E0BE4BFA5C72921047B5AD56593ED35D0DE280EE6F72F808A12F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252683, "uuid": "087ad90b-0aa1-4926-a7b0-f5e50bc4aac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252683, "uuid": "c40cf701-8892-465c-9293-67f29321c4ed", "value": "3072:2qkghNWHKnYVpJBKvCzZpatl3QxP61p/JULwIjXaNKZRoW5vj/jh46kE:2qXmlpr6nnIj6KZRosLbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252683, "uuid": "f5e52fe3-ab15-42d7-b08f-db4815265ec5", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252683, "uuid": "f12a07eb-7504-4888-bdf2-78fb3dfa7f2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252683, "uuid": "ea91e6c8-8ac7-442b-9e9d-6c94a0452b1a", "value": "70fcecb4fd1d0acbe7100b3997456fd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585f72a1-f6e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275904, "uuid": "ece2d5f2-a77f-42f5-acc0-296f4192c250", "comment": "Malware payload (Mirai)", "value": "ab50df403d091310d8a6ad1ee0ebfa5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275904, "uuid": "966eb0ff-5076-4799-9086-d6e5d289de98", "comment": "Malware payload (Mirai)", "value": "7e0cb5bd857cc06f97261a107a3314d1c596e60e6d0c9259cf99c60e9479ad0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275904, "uuid": "f08bf2c9-181f-4a1b-84fa-3bcf02e441b4", "comment": "Malware payload (Mirai)", "value": "e168ab71c740edd22f56c058a8ca395c55934490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275904, "uuid": "b1f7406f-1d74-4053-8ca6-1eb56a123189", "comment": "Malware payload (Mirai)", "value": "91cdb6145ce0ee1ef4cb53d63d6c33097e8a34a864b07039d3c95518ba1c5fc2cfbc51589207a8bf18381d6d4798fe44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275904, "uuid": "df878a00-9124-4b74-a1a9-a758526d197d", "value": "T17F63F7753945F2ACD6E54078F4436EE51E620A243EDC91E36083143BFF71B88B62DE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275904, "uuid": "463f3856-4a4a-4157-bfda-0c28bfe97013", "value": "1536:KsaoLLt+0unRziK9KTHIZVBIVCCfy0K9Ugf:RLLt+0unRT9run", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275904, "uuid": "ea132dd9-c6dc-46ec-b1fc-aa3c5de488f7", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275904, "uuid": "b853ed3d-fb1c-4926-ba48-a3344ec8b1f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275904, "uuid": "c6653c64-e3d2-4cb9-b96b-411b87d38382", "value": "ab50df403d091310d8a6ad1ee0ebfa5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f86bc1-f677-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628228016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228016, "uuid": "5bc1a3b8-0130-4162-9d72-25de7306d29c", "comment": "Malware payload", "value": "51830661de8f8f0df5ad2f3a4d08dd07", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228016, "uuid": "2a6add26-25a8-431b-a558-0fb2495dad43", "comment": "Malware payload", "value": "7e62bd36429598bdd23020c500778dd7e8daa2374f451617dd141a2a43912e1b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228016, "uuid": "211a00a7-45fe-4750-babb-1462d559ee2f", "comment": "Malware payload", "value": "99f9ed52be97d0fac43706f5bc150e5e0e79ecf1", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228016, "uuid": "8080caca-da7a-4811-a29b-6bc26f8b9ea6", "comment": "Malware payload", "value": "061f15dd5cc9324d71c1a32a273fa4b3de53bd01096df65e8566265da73f05e127d5ee9b6b55095075d1bf37e672e72a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228016, "uuid": "31316e32-41f2-487d-b1b6-e46b84e90088", "value": "T1A7D42332F6BDAC55F97F2C78A654AF88E6055B7B02A2E00C3E2D9C4637E11D3564F109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228016, "uuid": "007e20c6-2bc3-474c-a501-ce6d8f17c2e5", "value": "12288:9plMouB1pxUJ+UiO0rCZeXuISER0lHZvMxqfegSfQu0GP/oeGX7AQg:9S1TqisZe+Iz6HVferUeGX7Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228016, "uuid": "92eccb1a-7ea7-4a39-b005-78247bfe9479", "value": 620966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228016, "uuid": "b1e9f493-aacd-46d1-bedd-0ef750b762ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228016, "uuid": "dbcdc932-b4d1-475a-af56-ae2f743122a1", "value": "imp_inf_1240018.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025e83bc-f686-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628234099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234099, "uuid": "8d2d2c85-8e35-4e74-9862-3d599b2b7604", "comment": "Malware payload (RemcosRAT)", "value": "b6cdc9d8356051d82360cdde2d04d504", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234099, "uuid": "a8c4f3ab-624e-40c3-a678-634d22a8800e", "comment": "Malware payload (RemcosRAT)", "value": "7e6b40371751970ec5b3b17f02a89ac6ff1b7f9ec20210144fd75f992c3af21e", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234099, "uuid": "a34bff05-9542-4437-8dd1-2da33e7c896c", "comment": "Malware payload (RemcosRAT)", "value": "4b9a55d4c852a955d35e22e4141b1a754e0a6fc3", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234099, "uuid": "acc7b8c9-6da4-4ce9-ab9f-f2be05d62573", "comment": "Malware payload (RemcosRAT)", "value": "c77b181367fdad654b9812af2e2857c0da5f23d0c230d83cac0000f4674956e0ad01d9b675348e3ad37057dbb6457720", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234099, "uuid": "e398e174-a7f0-4a95-93cf-70382811c27d", "value": "T1CE057DE4FD513E36CD9A4D365D1B86A944DCAE3C182698D21BFEFC489F785B22C21183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234099, "uuid": "cd296256-9d5a-4d7f-9e61-1e93586ced87", "value": "9c955bfbaffe3626e1c455c4ade5d1b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234099, "uuid": "ed981b12-b0aa-453f-9987-0c3130acd384", "value": "12288:oakOZMeySruMg5l/NRD3yU5PAH29cOqYT9DeEFr/UtbYy8GkAQKxDOddpAf:HZvySqMIlVRDn1AHCfpVlFrqu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234099, "uuid": "931cf41d-e39c-4d62-9e8e-29640e98aedc", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234099, "uuid": "e800a47a-eb35-46d9-89de-0bb47c7270dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234099, "uuid": "651fa3de-a5c9-463b-920d-e7be598bd849", "value": "7e6b40371751970ec5b3b17f02a89ac6ff1b7f9ec20210144fd75f992c3af21e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9efb62-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628257498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257498, "uuid": "90899561-b9e0-49c9-b1ef-3d69f3aa7abd", "comment": "Malware payload (AsyncRAT)", "value": "1dcdc387f9c69617373992a18e0f32fb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257498, "uuid": "6de88f89-c9a1-43a5-a728-d66b8ee6556c", "comment": "Malware payload (AsyncRAT)", "value": "7f551e6a36a2dc54fd7de27d7fee9e553a8177a37ffbb2ef3033b9492e681ab6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257498, "uuid": "bff5d6f7-4f06-4d2e-b631-96da0029eed4", "comment": "Malware payload (AsyncRAT)", "value": "d7582ebd273987dee2a7df4600f6f804b68f1013", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257498, "uuid": "e369fa12-76c8-4ab0-b64a-741299213678", "comment": "Malware payload (AsyncRAT)", "value": "7b62bc10f6eb347b214af086bb10f4523a98cdadeefcc0226c989a60fa611811d77ab47e00bcc619d1defc36c04356a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257498, "uuid": "b2084714-f30b-4272-bea1-0afdf14c5d4d", "value": "T1ACF48C90EE41A6C6C198187F1FBDE67013EE5D8E955280813EC4BD173BBAEF68D825C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257498, "uuid": "45149a69-82e8-4e31-ae38-aaea1ed0f38d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257498, "uuid": "78de63a8-0fcf-465a-8461-c03380b98758", "value": "12288:GrcFCreihL6N22QpK8yris9TFcRQD/hdpg79HESs1j8t2NjFMZUB:GoFkeu62vCrN90a/hTayj8MNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257498, "uuid": "4a450a55-0c3c-4e23-aa03-6ede73a614fa", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257498, "uuid": "f557d8a0-d639-4488-85b1-2a718c107cab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257498, "uuid": "528f7047-384d-4eda-b036-373383994e82", "value": "Machinery for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb46a2a-f6e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628276180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628276180, "uuid": "e477b719-f3e3-4bce-8e4d-65d6e80bba4e", "comment": "Malware payload (CobaltStrike)", "value": "c47ad106639801ac97d4d676dbc700ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628276180, "uuid": "478e15c1-c01f-4af7-9c9a-badbafc480fa", "comment": "Malware payload (CobaltStrike)", "value": "7f8f6685f7a93e134ea22dfc002505e12e68f37ca9dce13e0ecee894aab15bb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628276180, "uuid": "84871fed-0ad3-4a7e-8849-ebfdfb2d688f", "comment": "Malware payload (CobaltStrike)", "value": "c5e5d63fd7965c949f91a6774c4d540e15e2ee81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628276180, "uuid": "a20dad7b-14a3-44a6-b5bb-8a86d61a3b2f", "comment": "Malware payload (CobaltStrike)", "value": "2ec9896e97d2b0cf21516097745edb350efd000dd855fe075067de4736e3b82fe5b7d4ce047667975345dd08ec7c542f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628276180, "uuid": "0b69ed83-6bc1-4dbb-b5f5-551e66082075", "value": "T128523935EB4378F2FD1A497014EBB6BFAEB3E1238C104C92CF94DD4158278B6881665D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628276180, "uuid": "537c648e-21a6-47f1-b7f9-78f7aa40e2ee", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628276180, "uuid": "a7693d0d-8083-4503-9600-14777e5b7e55", "value": "384:AH+kGKqbOCdWIVBff+xzbIMPPPyfCXAn:AH+kqRVpfUPPafiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628276180, "uuid": "13cefab1-0c4c-47b1-baad-992b11beb427", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628276180, "uuid": "cbe42516-1f04-44b2-8add-f4c13f4568f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628276180, "uuid": "0c6e8310-96ea-4d07-97bf-464d56ea4f5f", "value": "c47ad106639801ac97d4d676dbc700ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b52d652-f67d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628230275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230275, "uuid": "0f0dde5b-5665-4a10-82e2-ef90ebdb675b", "comment": "Malware payload (Formbook)", "value": "46d25e193b0fa8c66294eae90d6ba0a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230275, "uuid": "7d4fc404-e5ed-4666-8fe1-abe80afd22e9", "comment": "Malware payload (Formbook)", "value": "8211def9e38f6488cc96851d5c572b9607e3dca6e33bd375ca99435f964ef94c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230275, "uuid": "e7beca8a-d64a-4bbe-8f07-8678b47f2d4a", "comment": "Malware payload (Formbook)", "value": "ba916e712b87e72613ec43255eb1f4031f034e87", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230275, "uuid": "45db3ad0-b767-442c-8be7-32205c9bb38f", "comment": "Malware payload (Formbook)", "value": "deea870fe30d81245d27e01cfe181452950d2ad80503f357e6eb1274ed0f04b270fdb7036eca4363c7fb168a87a89660", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230275, "uuid": "de7b50fe-f147-4924-9de3-775457d7ac81", "value": "T15BD423C249053D06DCD863649E2E8F18C8B2A69715DBF5DBC79BD4EFDB1A48B1C3A012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230275, "uuid": "10205c97-ce1b-429c-88ec-df7413fd134e", "value": "12288:WrIpdkwHs7NSC7idzgtXQkZ7PRR/SgSwHwg9s:W0LkwHspSZgp5b/SgSwHf9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230275, "uuid": "3a0ad926-db94-4407-984c-96d08b5e5922", "value": 612250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230275, "uuid": "b1c5e213-0da8-48d1-8649-51f7e3af08a5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230275, "uuid": "99236486-c5ee-43ad-b5e6-f77045518a89", "value": "SLB SOA format.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6aa5be4-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628252977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252977, "uuid": "83f2c52f-a651-41be-be5b-867d784100c8", "comment": "Malware payload (Formbook)", "value": "0144a7d3ea564aa29856fc657c53c96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252977, "uuid": "a5611cc1-3c7d-40a8-b869-6cc8aa26af56", "comment": "Malware payload (Formbook)", "value": "835cf0393c0d695629ae18ef8e41b28a75dc0df98d8572f77394ddc5b8e0ec16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252977, "uuid": "efaa388b-96bc-4886-82ab-e522d70ab1e1", "comment": "Malware payload (Formbook)", "value": "a88464df35f022a1f22ac8b07d4b0faea177ea53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252977, "uuid": "83bcb502-eb53-43a8-b98a-d0ae64296de6", "comment": "Malware payload (Formbook)", "value": "64fa056ee969d10853ad1e819e8800fbc140812c511b01cd30cc24d42ccd951b1b3403225c8c9f4daf9cb1af37ccf6dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252977, "uuid": "cf1eba70-c536-4002-806d-a2f54dc9a044", "value": "T16B05CE247AED1314E5BBF774463652004BFAF53BD723CB8E2C65509C9AB3A828712F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252977, "uuid": "03966d86-760c-4e83-bb53-d4f2966d31c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252977, "uuid": "65a240c0-2ff2-4ffa-ae43-311d36dcb574", "value": "12288:1caQxt8r8ZIPbgDPwFVt2NjFl58l+NI7mwvXk92aQyMFSE5xTpSsBVkC7ojwI0jE:UZeb0wFVMNjbCl+CdJxFrxTpZkC2F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252977, "uuid": "20b15806-d6e5-4ec9-939d-4f7a11f5c45a", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252977, "uuid": "619d28aa-2ea1-4030-adc1-698e6f284de3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252977, "uuid": "a7ff43e2-a51c-4b6c-83a4-bfe1524d4c71", "value": "0144a7d3ea564aa29856fc657c53c96b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6cb90e-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628227005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227005, "uuid": "a4a095b5-e29a-4ffb-9e6a-c753d33966fb", "comment": "Malware payload (Formbook)", "value": "a3b279c78ce92388983da57305043399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227005, "uuid": "a7605beb-a5a3-4e8f-910a-a090bf13d4cd", "comment": "Malware payload (Formbook)", "value": "83806181eaf99abe4f92d4f5846837c73053239ec7412072913834e33721673c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227005, "uuid": "b8cd380a-bfcb-41cb-9c65-f6735afba599", "comment": "Malware payload (Formbook)", "value": "29693b399b7c6f10bd9ac9d70dba8ce692d79b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227005, "uuid": "3310d55d-85a7-477b-8a0f-4aa75246dad5", "comment": "Malware payload (Formbook)", "value": "cc857f69e9b7e8b1951b7922797c4d8ce3bbe074f8ecd8f67c7d4b99d325f18218c69b606fae9b43dda21ddcfd9eb1e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227005, "uuid": "3ea47087-2fde-4767-9f79-063425414f54", "value": "T16915BF0AFB887EE9D25D0E36E527145843F6C2675A33F39F38DA6AD414123968E4F423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227005, "uuid": "d58b3c36-632b-40c2-a347-17f0c7987207", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227005, "uuid": "63436397-b816-4877-a0a8-2217810c5b0b", "value": "12288:81fswW7MnMFmNeTvM7QeFIsAjucAnJm38BoJOudGv2p0OrMqWce4c:81fsJAnlNCM59c0JvtukORXWcep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227005, "uuid": "e82bb377-8eab-4e02-b28b-726daab01ea2", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227005, "uuid": "df8a76c9-1e28-4972-874c-fe0c41689fe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227005, "uuid": "162f417a-1ff3-4e74-a783-050e67d05d19", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5c117b-f67b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628229684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229684, "uuid": "b4b409bf-4480-40c5-8af8-824be0d74aa8", "comment": "Malware payload (AZORult)", "value": "214d5c0db05686d0cf118722211c5181", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229684, "uuid": "9fe3e139-5c8a-4129-bd2c-da27a0897ef4", "comment": "Malware payload (AZORult)", "value": "83cb58129b191762bfe025ddd9d336dab5e7300f9a2781367cdfb4985a574da1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229684, "uuid": "3e507cba-7503-46d5-a2b3-dc1082632db7", "comment": "Malware payload (AZORult)", "value": "bfce846921b0af6193559ae21764105bb4ce09d7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229684, "uuid": "06915fca-bb33-4ed9-86c0-4c7bd14763ee", "comment": "Malware payload (AZORult)", "value": "dc3e2bf5ad9b666fa1f840a3d44c1e37aaf62f0a2397ccda1f8dee20f7e6beb2c7064a6560465b17430bbe34285492d5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229684, "uuid": "347031db-9b06-45b3-a864-9026898c88b6", "value": "T172C47C2B15E14A17E87CC2BC1954A26BF238DEC6B1DDD686ECC73C87D635B4215802BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229684, "uuid": "0becb6ed-a734-4f08-9f55-4000fb1fa8f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229684, "uuid": "a6311ff8-8def-4f20-a380-46d6f5baa95a", "value": "6144:qSmpC3t042kJNSf9ypSzW8rVp3E1rU5MNTnnhCxp0//54KJuwbjRI7n2+XTBo+kq:qfW8rfwUiNTnnUxo/5ew6b2gTBo+AKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229684, "uuid": "0bb2a15e-bc8d-4235-af53-f2aee55e8dc2", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229684, "uuid": "6bb3bbc3-1a44-4984-b207-9fac3a0cf642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229684, "uuid": "c7fa8f8d-96a1-4149-ab04-0484473dba2a", "value": "OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5beb63a6-f686-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628234249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234249, "uuid": "cca3eb4c-e097-4184-96cb-9a8c4f7eeb1c", "comment": "Malware payload (BitRAT)", "value": "04355cca6d3de6fe333c927ef0c9ab35", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234249, "uuid": "a9381e97-848e-4e1f-ab31-4aaad39725e0", "comment": "Malware payload (BitRAT)", "value": "8458809792ef932a851fd186808634fc27074d692cf851cdaf8f1f6a6cb98f0b", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234249, "uuid": "17255678-2e1f-4f32-acdc-778072c8e62e", "comment": "Malware payload (BitRAT)", "value": "961a315675fb7336c93c2ff7a206f1d43498a486", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234249, "uuid": "17ccdb8c-8703-46fe-8995-df1cfc4f0be8", "comment": "Malware payload (BitRAT)", "value": "f1fb90a2913cb3fb57153059916e9324cfa25f0c57bf6cb6e2851f7e689e1aa2ab65859c6e4dceb3ba30d7e8bb503522", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234249, "uuid": "0425799b-0bc5-4be9-b146-0768dd4bbee0", "value": "T1DE6533F691128127FB5CDABCE9162F251912859393BDB3A63C8FA427CE38356BC41C71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234249, "uuid": "a156adc7-83c8-4cef-910b-05873f162e2d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234249, "uuid": "6935b27f-389b-47f5-9f69-91280c78cf7d", "value": "24576:GJmQ3QWWrDXNmFyC2SadnEHgeJhDIZyHvoUdEdNH4Nh564YI63PJpurzLA1:GqrD9TC2SVACoUe91JxpurzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234249, "uuid": "9346484b-6d9c-4e91-9764-b8690e435b6f", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234249, "uuid": "6a6c9f19-2236-4d29-8a61-8c4b53ac8c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234249, "uuid": "3ef07e16-9fa6-4a26-8c45-4f08a7b417be", "value": "8458809792ef932a851fd186808634fc27074d692cf851cdaf8f1f6a6cb98f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4f7ffe-f677-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628228050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228050, "uuid": "653c354f-b167-4e16-9bfe-2ce26724334a", "comment": "Malware payload", "value": "c8766fc5fb2ff8ff1455ebce86926fb7", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228050, "uuid": "86117b47-b67f-45de-94ea-8234fad5f470", "comment": "Malware payload", "value": "87188912cba10a75e8cdbbb1b6fecb511fc644c85f47548a4b2481ea577f480e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228050, "uuid": "6329ba31-6ea5-4b02-87bd-ad2209794879", "comment": "Malware payload", "value": "8dffc18710fb6e852072b7d06cbf0c23c8fa56d6", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228050, "uuid": "7088a145-7608-4c5a-a706-ad1a009be00d", "comment": "Malware payload", "value": "c2ad081a8af7ce9fe1d79f3922611cae7efa499c08817044bfabeee538efe5a328b60e14a5d544895d4e008165a454a6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228050, "uuid": "0b0f5b2b-712d-4b02-9e5b-ffe00f0dc4d3", "value": "T1C8D42332F6BDAC55F97F2C78A654AF88E6055B7B02A2E00C3E2D9C4637E11D3564F109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228050, "uuid": "42789ea0-b97e-4933-87f6-64ce13c165d5", "value": "12288:7plMouB1pxUJ+UiO0rCZeXuISER0lHZvMxqfegSfQu0GP/oeGX7AQg:7S1TqisZe+Iz6HVferUeGX7Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228050, "uuid": "0ebce70d-1c02-492d-b53f-e806ec0b6a58", "value": 620966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228050, "uuid": "c195ff98-e4f3-4cb5-ac9d-71a24d360370", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228050, "uuid": "44d4b0d9-b35a-416d-a066-c3700827aded", "value": "paym_err-1289680.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f962daec-f6b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628256417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256417, "uuid": "240f2b7b-dddf-4f3e-b40d-d0a1ac0ce247", "comment": "Malware payload", "value": "327b6cfaffb40e5b118c4d7e963e9ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256417, "uuid": "9393a347-7899-45b7-a2ac-15b6d3873250", "comment": "Malware payload", "value": "88287ceda83d7fea2b9933e278f0250afa58d50c93f8ba5d86d5ed8ace37c851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256417, "uuid": "02c8ca17-31ed-4e15-9cd6-e6a6beaadaff", "comment": "Malware payload", "value": "76fb2c9f04cc5a9bf6530a0b3b231af763d280fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256417, "uuid": "4625bb1b-96d9-40d0-892b-cb41e9c2f549", "comment": "Malware payload", "value": "c5303080d5a356807528afc38efddd9d2cf2b86b6f52d6f3d8845dcd9749590e3bc18be63f0468b0a352f6519254c13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256417, "uuid": "389a1ea7-675d-4c7e-aee1-05b3846b3767", "value": "T18335D71E49469DA6FE4E26F3A2740A444B70DADFEA30A52EB36013DBB35D60F5C441E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256417, "uuid": "83cd6fcf-5cc1-4a9e-acd8-211e46e36eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256417, "uuid": "4e5551ee-2cdd-4580-9745-0711bb637b6c", "value": "12288:KkuLpzXPSsfCk5+4Ccbz/MwemE+G3FoE+XiuYu71kNv:KkGJFZUhO/MwvE7h+XM59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256417, "uuid": "2def366d-42d1-4459-a0e0-8f3d968a2b57", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256417, "uuid": "020b6561-de50-4778-8b44-589899ba5715", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256417, "uuid": "89aa4b86-810f-4ea5-a5d7-0f3cc4f45b86", "value": "ASM9WQK4L9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a344ff-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1628226913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226913, "uuid": "725a43d9-e3bc-4fa5-9e67-762bcc85d6cf", "comment": "Malware payload (a310Logger)", "value": "2a52adef8906a92fa4b4feb96c1b8c26", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226913, "uuid": "b4b489b6-f417-46f2-944d-2d708799dfcd", "comment": "Malware payload (a310Logger)", "value": "8940eb56fcbcf0b9e9f1ca34b9e2671bf9f0494eed2b00254cc916378337c0bd", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226913, "uuid": "bdb69a1b-9e96-435b-a7be-f50952b2acab", "comment": "Malware payload (a310Logger)", "value": "5bc7a3c740295e6e0a0c2455be73c5c6669a8171", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226913, "uuid": "92b4ae33-7f96-4a17-8381-9efb7acd588b", "comment": "Malware payload (a310Logger)", "value": "47c9f5b56d2108caf6f47d0aa2161424708bf8872007853566a0b2ac16d5cfcedc54d7cf862bf71a3a34e7cd32d9298e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226913, "uuid": "ce6de093-d440-4ab6-a69a-e83834921d3e", "value": "T1F2F42341FAACB652C6E9ADBFC7C22B354C726C211F83852CACD59D91B8B77C59240707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226913, "uuid": "13a5aade-296c-4e79-ae23-cab0eb440d4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226913, "uuid": "c0ab78b7-2193-4271-bbe5-a764c56ba48c", "value": "12288:aPtYLDXEk6PT0/ZxSnw7NGUNIXIo6RPuxR51ee0PRNuU1:AtYLDUk6Pwkw5dkIo6RjzPv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226913, "uuid": "78a958f5-8c57-4e74-ba75-d8fed6fd9f55", "value": 724976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226913, "uuid": "7fed46e9-574c-40c6-b05b-e02400c682b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226913, "uuid": "2c54fe9d-db43-49c0-940a-85fd4fe8d853", "value": "New_01103511078952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bcaa79-f710-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628293532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293532, "uuid": "c20534f1-6217-48f3-a5a9-08177397c11d", "comment": "Malware payload (Loki)", "value": "2334fc354009039bdc7d1074caca6cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293532, "uuid": "2fd7dfa9-8162-4f1b-b5db-78b982784866", "comment": "Malware payload (Loki)", "value": "8ac26e912d6ff25e84eb455af2f7104765e6dd23dbc8d68c752bb19d5ae2251d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293532, "uuid": "06f372db-96f7-459d-9be4-42bbca9dde71", "comment": "Malware payload (Loki)", "value": "f2d09cf31401aa1744a8ab83676a26b96ed95dc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293532, "uuid": "2e56cd07-abe1-4323-b5a3-4e66f026e8fa", "comment": "Malware payload (Loki)", "value": "f80769ece51d0940ed4c2b5e0001987b49cdf496d4a26e72adc1fcd7c0ad017ab03859d99624cd8c369b16ebd62a7d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293532, "uuid": "b3c23287-8712-48fd-86fc-de9a82ed7e86", "value": "T165D4D075671BA704DC3887FC2C58D1512BFAE01E926ED6383F9890BC6CB27BC5AE0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293532, "uuid": "f8e8e0eb-32af-48da-8d11-c6c2e42d5ed7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293532, "uuid": "891de8fd-6b98-4d8b-a62c-4c3349b85039", "value": "12288:T8JrZAg5P1xOaunHulSVpLHZl+Su99oUeh0m3t8Z3v9syaUVKnp:T8JHxOapuel0UM0m3s9zahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628293532, "uuid": "6c1cea6e-2b2c-480d-9697-71cee0c4e14a", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628293532, "uuid": "c4520137-f6d6-4ce1-95d2-6d1574012235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293532, "uuid": "56ca67a5-5a47-43d6-8815-a4ec87da7aab", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943a4595-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628257536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257536, "uuid": "29827b4c-9d73-4183-9ae9-2340d77134fc", "comment": "Malware payload (SnakeKeylogger)", "value": "0cc54059df919adf56c89840d45913d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257536, "uuid": "a98ad585-b8c8-4db8-9631-4962c35cc665", "comment": "Malware payload (SnakeKeylogger)", "value": "8aef837b5c800bc83eb1e42820f53e14c957c45a6a8c5749ff1340b99ccf01bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257536, "uuid": "04a2ea43-b5cf-4a30-b6e7-a716d1d948c0", "comment": "Malware payload (SnakeKeylogger)", "value": "f76ac64c7322410f74974c5db51ca8f4bf28dd27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257536, "uuid": "d8a3bf12-0aa7-4319-ac9e-728897e1f83c", "comment": "Malware payload (SnakeKeylogger)", "value": "b9b312350bd6f9ccd3e07dc638e8198be0089181eb1431102b0e232a688b76e6a1520e2520242e2a0a12510b0c6644d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257536, "uuid": "158288a7-5b08-4fe3-9936-f7c555566d02", "value": "T150F4BF94E581A607C59828BF1F3CF6B017EC9C9B1586C0812ED4DE577B9BEFA09831C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257536, "uuid": "4c755f3a-ced7-4864-9f9d-cb0a015f49b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257536, "uuid": "11d3af5e-da64-464d-9601-311c5f4b208c", "value": "12288:PsSTNI0ldInmSWiHgkWYT9IJOa0kBukCfLpiok61jct2NjFOhJqOOUBd:EUld2drbWg97a0oOXjcMNjUhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257536, "uuid": "26a7940a-1ed9-4403-83fc-a9e174f35d03", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257536, "uuid": "f7b0f557-4f91-44ca-a49e-6673827e3e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257536, "uuid": "32087ca9-c31c-4526-ae72-8683303f498c", "value": "Referans iin orijinal nakliye belgeleri.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46821f6e-f6a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628247957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247957, "uuid": "e398cc9a-9b99-4ccf-82d6-3883beeb6f69", "comment": "Malware payload", "value": "a7d4b8b814282744abdae3cce3423de6", "object_relation": "md5", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247957, "uuid": "ddf9c287-c676-4d87-92ba-d8d5ad043559", "comment": "Malware payload", "value": "8af15f38c7f3cb32667a240a832fa428cf3070caec3ec39816e31fbcf357f400", "object_relation": "sha256", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247957, "uuid": "b56c6447-28de-49f8-a727-287cbf841d80", "comment": "Malware payload", "value": "c6e3c5648678b9871aba2c3e8b21ecf5707a6bc9", "object_relation": "sha1", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247957, "uuid": "1d2bea3c-4f79-477b-a000-cb994ff46e22", "comment": "Malware payload", "value": "1ec4db28e61daf9440b98018a7a47ed412fc35d14e9b341c716c66c4ff42ad375a172fa64f4a6836ba3cfac6185e16b1", "object_relation": "sha3-384", "Tag": [ { "name": "193.56.146.99", "colour": "#181A09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247957, "uuid": "8ef26805-73d6-43ec-a9b7-aa61fb25299d", "value": "T13624E0E7CD2D41C681DE3A317EE159288084B52F7DB3612A81E1B37FCDA2335B9961E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247957, "uuid": "1b70c4bc-4d0b-47f3-b398-46a616333b2d", "value": "3072:pbMQWb3zlyf1YeUHF1eqYHsI9wdunl83rEAOcPiUw8G0o1O1M9cx/:qD7YYeUveJsI9NnKQcqUwpX1+sc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247957, "uuid": "213a3d59-a1cf-4612-8cb0-792a0875f908", "value": 209988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247957, "uuid": "3f19e802-e2ba-4e5e-8e30-2c8ecf90557a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247957, "uuid": "21edba7d-e434-4a0a-9ecb-0ce76d404f09", "value": "JaAp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867089c6-f6c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628260519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260519, "uuid": "8d79b7fa-53ce-4ef4-80bc-a5cdfbd51c15", "comment": "Malware payload (AgentTesla)", "value": "9d0ca02001c3a1ac584e4a9ecdad8b61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260519, "uuid": "56e45182-ded8-4d10-984f-bf824bdf7dba", "comment": "Malware payload (AgentTesla)", "value": "8d98402a8c3888c29a4fe8941ad7070111d5b2914efb4b450770c837dde3a2a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260519, "uuid": "44838a32-110a-485f-bd59-22ba2eeb3553", "comment": "Malware payload (AgentTesla)", "value": "dc02dbb480de54adc52e6a3579697e45318556b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260519, "uuid": "4945d0dd-bda9-4444-9e27-3753a1725b82", "comment": "Malware payload (AgentTesla)", "value": "b5b58ea1c45662a6e134fb1af275a9b773bbf13bf5fbc25071e1ae5816da446c187a7c2eda61887d966d0c4d8f4fafa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260519, "uuid": "af40fa14-992a-4105-88ed-a5bac3f88dfc", "value": "T16D55123FFAC00E47C3A34E3101A5965E551DBC0AA9F385A99B11FB65A0F83F01667A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260519, "uuid": "e13de4e1-53b7-4f9f-8a91-55c533f63ec0", "value": "24576:0v3BGLOils69NjtR8Nv31s2f3jFeuMeMMa96miNjK121LzVaTj:EBGtls4NM31sXu3MMIxup5an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628260519, "uuid": "a8fd1192-0dd7-4221-bb39-757f312e59c6", "value": 1300200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628260519, "uuid": "6d8c02f9-a889-43b4-8079-13ae00d9938a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260519, "uuid": "99fdb353-2816-42f3-bade-19ddb4e86777", "value": "Doc_0001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdc4a5d-f686-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628234255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234255, "uuid": "2aa7b3ce-9383-4506-b036-cee28701cb38", "comment": "Malware payload (BitRAT)", "value": "d7ad4cf42e2f520b0ef1ef910eb9186b", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234255, "uuid": "4a5abff5-918b-4915-81f1-4f89bb733d01", "comment": "Malware payload (BitRAT)", "value": "8e09a7c18a858ec70aaa9c69788e8b9e7dffa134cf3bb868c28229e7bf4b9e9e", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234255, "uuid": "39edf0f3-de23-41f1-b7f6-4428ba3527eb", "comment": "Malware payload (BitRAT)", "value": "33a097621828dfc287753aa33d954ef755978c3d", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234255, "uuid": "50d77978-b4c3-4101-b949-b0eaa309dccf", "comment": "Malware payload (BitRAT)", "value": "b2d64bd73011ca1b16e77c0d5c354c3ab089b5e7c8fba1f0f41e732bf95e7494d02caaa95efba8790a772564def0eeef", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234255, "uuid": "2a8714a3-4d36-41ea-8e51-29403cc6b266", "value": "T1A616CF02FA41C562D2670130EA6E77BA017CF5F14B3085C3B3946A6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234255, "uuid": "17c542d2-571a-427c-a69f-3cb02ef36674", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234255, "uuid": "a95163a4-362f-4782-8a4e-d5dc7d62d780", "value": "49152:HXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VIg:HXrEeZzdhjuV/gd1VzsGUqNKTHvQeeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234255, "uuid": "b8921e67-64fb-475a-a03c-e5e099e11182", "value": 4221440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234255, "uuid": "4d975bab-faff-4af2-a78a-025adc88d25d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234255, "uuid": "1805d001-7d16-4405-b78a-fad8246282d8", "value": "8e09a7c18a858ec70aaa9c69788e8b9e7dffa134cf3bb868c28229e7bf4b9e9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02529a3-f6c0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628259328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259328, "uuid": "58e1f828-c381-4d33-9fe9-51be74b051a3", "comment": "Malware payload", "value": "d7ac55e47163e462300fcc148e77da48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259328, "uuid": "b8d24d14-a60f-43c4-bada-88c9143a9994", "comment": "Malware payload", "value": "90212ab9890dbb3d87e853b4acd13f8de7e97dae68b5354a22f0e552456c3ba6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259328, "uuid": "399d7881-6e23-4327-9935-b7695d361332", "comment": "Malware payload", "value": "9aa82cd07e9cbac2a05b1a252776ea7e04e6d2dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259328, "uuid": "5e8c83fc-4e69-4c77-9b93-41e18a7cf83f", "comment": "Malware payload", "value": "3d01bc0378ac5c3eeccee52e5a98421169f006f0c880df4e2eddf8922bc042edf8042ea8329072956a04df3acd111727", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259328, "uuid": "3b29567e-e4f5-4abe-8615-a4c0c7e968bc", "value": "T1D7D195F7418B4A6A0768986C373D5DCAD2FFFE355B10C69C0107A49ABA0B22E7DC485D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259328, "uuid": "c3ed6587-bdef-4d1c-a620-9fd9c7142d5f", "value": "192:o9DpybIclVnu765uB3FRC4c4r1GoKIovIROEILIRgveVenT:o9DpybfVnRonRC4c4r1GoKVvSfOSgvga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628259328, "uuid": "cf2f199b-d91f-4777-9cf7-6fdefdf4140b", "value": 6438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628259328, "uuid": "47499388-6f23-4095-ae3e-a403bdc9dc70", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259328, "uuid": "8f478d64-6cc2-403e-9499-4a8ee530c024", "value": "07-692903.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883b038e-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628256657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256657, "uuid": "4e556397-5fd8-4abc-a786-673e231fbede", "comment": "Malware payload (SnakeKeylogger)", "value": "7969c647ed1c0c449a512c88ccaa22b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256657, "uuid": "2529cc5a-0892-469e-9967-4e32f9f50d65", "comment": "Malware payload (SnakeKeylogger)", "value": "90d00d97833d65bb0bea7fa86afb3d311a66069c80acaf18ca32055ad6b307f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256657, "uuid": "cb9944f5-033b-4f67-8adc-d2cf59883306", "comment": "Malware payload (SnakeKeylogger)", "value": "e84c5574e52045ceb7fb4f70380ae6b44d7bc189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256657, "uuid": "cb91669a-9102-49d8-8067-3d24f3419602", "comment": "Malware payload (SnakeKeylogger)", "value": "321c379b17b5d2cdce9b0c83df71a91b7f04cb80b1f137808db6018ff2e0af27b45134dd0f19b5e2256e99e89ae9b1b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256657, "uuid": "badc44ad-a1e5-4e1b-96e0-39d950c593c9", "value": "T11705BF24AAEC6714E6BFA7368A7550414AFAFD2BD612C65D2CF0349CDAB37820710F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256657, "uuid": "a43cc030-89ae-4abd-8ef2-76afb5f3c5de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256657, "uuid": "a614a45a-8143-4754-bc96-00df09d8578b", "value": "24576:xgwFJMNj6iRk6N3/2MN7SosjQsUTeFVd:xgwFehS6NeMFSoss1Te/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256657, "uuid": "b37c8c31-fc89-4fc0-afa0-c3ccc74ad0ca", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256657, "uuid": "1070fc0b-a35e-4df7-9d1a-c8d66636aee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256657, "uuid": "2f529aa3-5ff4-4609-b0e8-a4af6d92b75f", "value": "Po 08062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781cb699-f67b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628229572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229572, "uuid": "eb1d3840-9dfc-421b-8a5f-9f62ab5d742e", "comment": "Malware payload (HorusEyesRAT)", "value": "797fa385548a88e55ae5a1f67026bc0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229572, "uuid": "a3387d4c-1c87-439f-bc75-66094ea01d8f", "comment": "Malware payload (HorusEyesRAT)", "value": "915caf575fdbc904c0d5a3755135545f76b81bf633cdac3c98b85bd0ab76dfb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229572, "uuid": "59f7acdc-5b73-47b5-8522-91e209136809", "comment": "Malware payload (HorusEyesRAT)", "value": "9f582bf5e46fbbb86af37830a594d10f402d7907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229572, "uuid": "e1d91d70-7594-4dc4-9031-0de77e827fa0", "comment": "Malware payload (HorusEyesRAT)", "value": "6a891113cc1a93238c37936c25f5860d20147b33c8b6a63e794b2d0bb0b83ea792173b63baad1ed641adac2459b165bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229572, "uuid": "b9fab6c4-2abc-45ac-bbf3-9d261f1956eb", "value": "T117F2D045B3658E29C96DAB7C39730B0049B5D10B5A03EB5A3DDCF0C69AAF35103127EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229572, "uuid": "34fbecfe-c3ed-4dbc-8a68-39151591c975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229572, "uuid": "9f50b6ac-a1af-491e-8815-94d5cad4c363", "value": "768:73nP5Cp20VXSXZ1XjHkut9wIuyTD0GU/yCSlqFmHyWtO0+xT:73nP5CbGZ1XQu7fuAD0GDCSkjhzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229572, "uuid": "d885b1c2-c50b-42b4-86d6-ee16198466b7", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229572, "uuid": "cf681237-7293-4b68-85eb-2a6e07d36f77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229572, "uuid": "f401f325-48c1-4a9d-885a-95a5bf416c17", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89a1009-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628257194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257194, "uuid": "ce66d82f-52c8-4386-bbe9-d512d120a05a", "comment": "Malware payload (Loki)", "value": "e60c1bc83635a8480e1970205944b7a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257194, "uuid": "6975de0d-0267-4db9-9624-3f1473302309", "comment": "Malware payload (Loki)", "value": "917af44057dfe75238e0c9ad9c131610f29c0ac1641c631c5b01bb6ae5dfe46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257194, "uuid": "784c04a0-83eb-43c7-af55-42fe1a4d0843", "comment": "Malware payload (Loki)", "value": "583890ea81b7180acc4caf95de8b71371e04885d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257194, "uuid": "2395ce6e-a1cd-41f0-b5a1-de2e030c674c", "comment": "Malware payload (Loki)", "value": "31091f79dd5efd2589b480a47197b6b59bd1d13a52765a5685b2b13460da4684406f89ba8e0750764696b52563430c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257194, "uuid": "9255800e-5dec-4034-9cb8-9b84510e7a48", "value": "T1CAF4BE2076FEA304E1BFE734063551014BF6F53BD72ACB8E2C65649C9A73A828712F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257194, "uuid": "d59ecb34-ba33-4b4d-a077-8002ffbcb2bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257194, "uuid": "7a1add04-da2b-4612-b60f-62dd405f2f8b", "value": "12288:McaQxt8/QxC4CnDbgDPwFVt2NjFktvUvyYc7MBaxUO7gksCTY2nh3b3HbhQyUl6D:LxHCDb0wFVMNjrvyYc/3qCksh3b16Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257194, "uuid": "ea4cf653-ca7c-4250-b9e1-82f68b4eb186", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257194, "uuid": "0abb4a64-0a35-4f29-b28c-43258bb1b932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257194, "uuid": "56b2738f-b350-4477-b962-687af612bb87", "value": "fizetes igazolasa_20210806.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1984c5d1-f670-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628224688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224688, "uuid": "e4f8b10e-7e5b-4998-8d17-da1711ecedac", "comment": "Malware payload (SnakeKeylogger)", "value": "69a03583630ba79a127d8fe4bab1afc9", "object_relation": "md5", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224688, "uuid": "fa6f3476-fb26-4341-b203-a4ea13bf2239", "comment": "Malware payload (SnakeKeylogger)", "value": "91e9ec6695d6f3e92e0260c5a52ad1c79ee168ccd4375a1b89082203348245e1", "object_relation": "sha256", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224688, "uuid": "4640f32d-ad92-4684-8420-3c60064e1248", "comment": "Malware payload (SnakeKeylogger)", "value": "0fcc70b74ec50e2ad34338b5cc10daf0a2fbeae3", "object_relation": "sha1", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224688, "uuid": "ee9e9ef3-8717-4bbd-8c52-5091ffd0b2a2", "comment": "Malware payload (SnakeKeylogger)", "value": "4b6b0cad1c9c6eca7d4d3b7769a9d4df430f60309dc365d2910ff2c84d459658fa9a05d84fa75357a91845b6f9aca808", "object_relation": "sha3-384", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224688, "uuid": "5e333275-9811-46c1-8b11-5ff21e4d63a9", "value": "T17A54F1853EE31F52F68ACB713D76DBB885329C981E6042576133670D10E73C78B2AB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224688, "uuid": "8d4c194a-f33b-4aad-8905-7ffc98c31a38", "value": "577b8945b527503cab8c479ade2a7e53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224688, "uuid": "c1f174fd-0683-4aef-93fc-a1e3ab50133a", "value": "6144:wmYz8G1xLEsRqszUSYAyqBTYkybIcuNfcmxSxg9eDzYCdOzsQ/KCD:Y4GLzfYsTXcmxSxg9eD8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224688, "uuid": "8c1d1f58-6c2d-4ddf-bdd4-cba76f80e280", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224688, "uuid": "a7dd50ac-e873-4a65-97cb-090023e912b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224688, "uuid": "6e6a64f8-6d6c-4caa-a819-1bff792fb6ba", "value": "41879375720210805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad332d04-f681-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628232238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232238, "uuid": "d768d4e4-8e6b-40ea-bd9a-a20e1eaac185", "comment": "Malware payload (SnakeKeylogger)", "value": "e61687195c0feaa2ee803aca7ebeb84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232238, "uuid": "666a9e37-4ccf-434b-b91d-ce483d83fba7", "comment": "Malware payload (SnakeKeylogger)", "value": "92790a0411d50a0f721d15ea0b69eed610fa892ff992ad3ebad5713770063411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232238, "uuid": "8b3897a4-8fb9-4957-9a80-4c50689ba902", "comment": "Malware payload (SnakeKeylogger)", "value": "d06910b6d8ef33e6748344da1309de61a166a500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232238, "uuid": "bacd9225-ac7a-4dac-9f47-a1dfe2f91ddb", "comment": "Malware payload (SnakeKeylogger)", "value": "49fcb0f8f63c6ced1e0fe4fab29aeeec1247eedcb742deafe26dcc9a48ee2758273341b29a6385ba19aa7ec9d3b5fcd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232238, "uuid": "fff1e9b2-244c-46c5-96ae-0c1628e8a54c", "value": "T16535022A22047B24F47D2B778DB48095A3F9F9096B23D56F3DE070D98DF3B6406A2617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232238, "uuid": "19f1d9e5-76d7-4b23-b223-95bd2ecbdbdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232238, "uuid": "02582aa4-7b3f-4fd9-8794-6884521dc3f7", "value": "24576:RVRgVw++qb4c9/ayhcHtxNvMTnVwYCMNj1z:RvgVw++c4Q/ayG7NvM7Vwyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628232238, "uuid": "be764cbe-5838-4124-b279-1a8a89f54d92", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628232238, "uuid": "aa553300-68cd-49fa-95c8-6bb732098fd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232238, "uuid": "ba5b8284-e876-46ed-8995-a7b421c9288f", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a3f561-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628231787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231787, "uuid": "7796c051-8714-498c-ad0b-f033287fd787", "comment": "Malware payload (RaccoonStealer)", "value": "b4353555ac0451a3d53b9a5697bfc8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231787, "uuid": "a6a66e69-4d13-4d80-b3fc-c4d1c8308d4f", "comment": "Malware payload (RaccoonStealer)", "value": "93d4d046663b350bf32334655dffb6c722a7090be0fcef8c637f73eec1bb81f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231787, "uuid": "5a0a5827-6202-421a-a8e7-c9a15c641fec", "comment": "Malware payload (RaccoonStealer)", "value": "04153fb57f791b2d337328af0a59c80c9a382530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231787, "uuid": "8072b435-1ba1-4d64-9ee5-b8d60c4afec3", "comment": "Malware payload (RaccoonStealer)", "value": "7b5e08daff9811c54368db18b44517eb2258e80bca8b15fe3975073820816c6d093e5c949e8b10e8a44576aabdffba40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231787, "uuid": "046041c4-2ffe-4ef6-8512-40f984cb2a1c", "value": "T1A5A41221B901CD77D4117AF16876C782AD6BFCA4DB2446277A68239F6F703C1BA32319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231787, "uuid": "3135976c-10b9-4db1-b7b0-123918881eb7", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231787, "uuid": "c2b747ec-2287-41e5-b265-9724e1f008fb", "value": "12288:sjliiS3J7N203dsU2uxj9MfMJhYPF1rIJxvTR5YL:z5V3SYj9MfMnqFBCxPYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231787, "uuid": "c6e91f55-7a16-485d-9e1e-79ef341d2d6d", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231787, "uuid": "c76da2c4-8f09-44b4-8fb7-7fa856d56c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231787, "uuid": "5c2e7e09-bc84-41b3-8312-6564054862bf", "value": "b4353555ac0451a3d53b9a5697bfc8c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b978056-f6a0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628245361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245361, "uuid": "9ad0fb5b-4c9b-4f59-a7a5-8ae9688250a2", "comment": "Malware payload", "value": "4c87dfe6bbe2554236aeab7945ef25c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245361, "uuid": "92caa7b1-e4ec-47a4-a249-3085c00e54af", "comment": "Malware payload", "value": "944598fbd332706cd67e2b278897e07a565dac696009863724120b5bbd2b485d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245361, "uuid": "dfeefa1f-eacb-4d94-a428-058bfd0d2051", "comment": "Malware payload", "value": "fa0cbb8a0c6cb01cbf384e93f59d62617fb130ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245361, "uuid": "9dfdf988-256f-4bdd-be29-68b521abe801", "comment": "Malware payload", "value": "68b807b4d8f01ea94263ed94a1088a0fd75e2fce5c963bf16a2f62d2c7664a4e23ccf28441ef0d636cec47a9ed110ded", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245361, "uuid": "39cbc4f3-42be-4d06-9647-86769ac74aff", "value": "T17073F93C1E4BD520B57988DC862BB6214F62F0DB237884617AF5B092646C2EFDD12DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245361, "uuid": "a7a3c429-b798-4fed-97a6-d5fb3347ba1c", "value": "768:BtseoS5UyLN4WPUibV/i9PSginrJNy3nh06tbeBUKlX1ROTR1zhlA+o9z9q696Mz:D5rNbpK9PGnrvy3nhcdWd7+BZI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628245361, "uuid": "2a465f94-09c5-4970-8b95-45ff84f011fb", "value": 75856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628245361, "uuid": "8ea1fc00-cd0f-443e-a080-50321285471f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245361, "uuid": "6548f078-57bf-442d-a4d0-81f3ae78d638", "value": "944598fbd332706cd67e2b278897e07a565dac696009863724120b5bbd2b485d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5408abf-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628256733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256733, "uuid": "ea8cf802-fcb9-43fd-a5a5-2c720a319f36", "comment": "Malware payload (SnakeKeylogger)", "value": "a3675296307135c80fc1e165d189919b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256733, "uuid": "865183a3-0cdb-4e4b-9fcb-c3ad01ff802d", "comment": "Malware payload (SnakeKeylogger)", "value": "94aadc2aaf34a412aeae31d815fc4d22cb6f14707915d020f6cb31fda4beb31d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256733, "uuid": "631a5a49-fbaf-4da7-9c85-cea7bcf21984", "comment": "Malware payload (SnakeKeylogger)", "value": "d4956a422b902d486295e0cfad56e1928faa061b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256733, "uuid": "c0cb0609-9cbe-4508-a4d2-773c8b28d0bd", "comment": "Malware payload (SnakeKeylogger)", "value": "599a7b560fd927d88d8c48f87eed6d4b1aded574893466f2b0253ef344ecd07c1c728a675570598eccb75c0ceff76733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256733, "uuid": "db148f00-6a40-4d32-8d65-4c2449325d44", "value": "T15405BE90E695A612C58829BF1F3DFAB017FC9C961556C1413EC4AE173BAEEF60AC31C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256733, "uuid": "4c7f2e64-9553-4ee1-aea7-14a0ae510c57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256733, "uuid": "6012a9f2-ba7b-4350-9148-971656b1feb5", "value": "12288:8sWBwx0ir3Xc29sKRHcoIUrO6ZGJ/VGDhxr6Q1njjit2NjFPOl2K:8rVIn5OoIrX/8Dhxz1jjiMNj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256733, "uuid": "ca92f754-5b8b-4354-bd3c-dd10ce9f5538", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256733, "uuid": "248e8777-1722-488c-b1af-1a93809a1c84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256733, "uuid": "7e679c3f-101d-46b3-8be7-45fdc22d1392", "value": "Request for quotation & offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2628715f-f68d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1628237165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237165, "uuid": "d0f6d7ee-a4c9-460b-908f-7e231c9d9e72", "comment": "Malware payload (DCRat)", "value": "0c0f5b5b1bd02d01f5bf6a5f4dcba2f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237165, "uuid": "19661618-e41d-451b-b875-ce3e7709e681", "comment": "Malware payload (DCRat)", "value": "9550c84ed4f760fd806bca85f64f00f877d676eeae5a1982c4bf815dd7d29ee5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237165, "uuid": "d7923684-644c-43e8-9da1-75440e074b9b", "comment": "Malware payload (DCRat)", "value": "d44acc5f1a32f020cb3d475dda11f5e09bfe108c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237165, "uuid": "f7c769cb-7f03-4d53-b202-93d4eee0f643", "comment": "Malware payload (DCRat)", "value": "0dfafc180be0d07dcf7a17874997a58718e5328d1d7ccbee23f90b01dae3e0b9f9403244a4673f876d903229d02f7b3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237165, "uuid": "32a819d5-cdd0-4225-a924-da425190d89b", "value": "T107E43B242AF95825F1BF9F79D5F078AA8B7AB5637753DA4E009103860A13B41DDC0B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237165, "uuid": "df25e9e9-41fa-4a48-97c3-530cd271c58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237165, "uuid": "26f9bc12-bb2b-4dfc-8a7a-ba7244bfcad7", "value": "12288:nqnOLBf13qmcUP9v5DOGK87MPV8yKHDq0ra9R1Pf0:n+OVbhDxK828dG3X0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628237165, "uuid": "f66a472c-b770-4807-a0b4-cd88ff71bf63", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628237165, "uuid": "7d289e04-a68e-436e-9b8a-d2d19e2ab081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237165, "uuid": "19600274-d067-4f13-8a38-85ad4ac4effc", "value": "0c0f5b5b1bd02d01f5bf6a5f4dcba2f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faf09cd-f67c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628229880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229880, "uuid": "66211ea8-66e3-409b-b312-75a0f097a3a9", "comment": "Malware payload", "value": "7ecfb2d386cd1b5aa25c89f626d3aa67", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229880, "uuid": "9a01f1f0-f28d-4b47-a08a-32ab1bedfcbf", "comment": "Malware payload", "value": "95c68f4d8447306156dd35859d46315b30ffc425d16621232d515920dcaea08d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229880, "uuid": "4c912ec1-0f46-48e6-a79e-62cadabd2d4c", "comment": "Malware payload", "value": "623f2aa73701b795cdfedb91c8b9c3edde5f3fa5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229880, "uuid": "8ec59b39-04f8-4b4e-b3b7-8664f465aec8", "comment": "Malware payload", "value": "2853832a97707be7ff57b9e683bd42dbf0d5b92e40fa8481c47c247b5126eb6f1a4bfc1c9df91802138484ede3f0dfb7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229880, "uuid": "00b4e620-35f8-43a2-bec5-c2059343bd9a", "value": "T168F2D013C50A5E27FA29DBF97F9308F9E702534AB261B6CD75989C8FCF61B01450D298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229880, "uuid": "20d9d83b-6011-41ad-92fa-5bfc5b10834f", "value": "768:o7Ky5fUBV/a3SIUt56qt+NCgOB+rbCWyv/:o7vOz/733gzGJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229880, "uuid": "aa85f29c-0478-4b26-88fd-fb135cc17fc6", "value": 37401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229880, "uuid": "c747e7ae-0d42-47f1-805a-1e7b67b92df1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229880, "uuid": "ab811adc-f217-4e1d-aa73-fb066ade1d54", "value": "a. Summary - MED016.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690b7124-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252310, "uuid": "42856068-61aa-4666-a73c-aa830b67ba58", "comment": "Malware payload (PlugX)", "value": "5a9d40558e6c795e24935b9040354e6a", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252310, "uuid": "cc7a64cb-4530-4ad4-b61f-6fb0531a2e2a", "comment": "Malware payload (PlugX)", "value": "98d17731ce6eba2772c94fbe5b740cbd83b5d5b0da6809c265ff3dc0da391163", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252310, "uuid": "66047cff-d583-4013-a57c-315905c5c344", "comment": "Malware payload (PlugX)", "value": "52b07a8c5d3163299a0844d802258ccc62b16dff", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252310, "uuid": "07fa0760-90c6-49e6-a695-0d9796847b96", "comment": "Malware payload (PlugX)", "value": "7e39a293c93babc42461b6131f221ae4efed7e20ebb6576006868c7f58018edffd632f197ee4f6b7111d6f9c56b4e48f", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252310, "uuid": "b896c78f-5d6e-4c60-8316-0df90b996b82", "value": "T1B2835B05B2C09274D8BF567918B99E02077E7E62CFA0CEDB7B84414D9A745D0AE30F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252310, "uuid": "82fa7727-2ace-43fa-adc0-3f9daddb7849", "value": "361e59a865bbcb1308341fab28e0c514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252310, "uuid": "792e1878-4a96-4e7a-8060-565ed7a596f5", "value": "1536:1uW5Btptp0/wW/TDc3Jpp0hOAKfG38RRc8p58rsWjcdIF4P:cWwwWwpuXGHp5DI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252310, "uuid": "998ecf56-4926-4b3f-9463-9f7925035e74", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252310, "uuid": "53902678-311c-4d90-8d97-c494e1a381f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252310, "uuid": "8d75c4fa-63ff-453e-beb5-84e60be2f447", "value": "98d17731ce6eba2772c94fbe5b740cbd83b5d5b0da6809c265ff3dc0da391163.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79a0245-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628257676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257676, "uuid": "c3fe462e-b2c1-4321-a66b-d9b568936f07", "comment": "Malware payload (RaccoonStealer)", "value": "50498327cb17d9c49e236d4fe1037c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257676, "uuid": "ee20d35e-10e8-4f9c-83cf-8f11bff8bf59", "comment": "Malware payload (RaccoonStealer)", "value": "998d9923dfa63cba2e704673bd57d9fc6673cab69a059feb35dff7be2f908148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257676, "uuid": "21a0d7af-cba9-43b4-a40d-b7f640308c0a", "comment": "Malware payload (RaccoonStealer)", "value": "510b9eb89829de4ef3909114c78be447c1dd32ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257676, "uuid": "c9516bf4-628d-4509-8f86-bf3cc8501f64", "comment": "Malware payload (RaccoonStealer)", "value": "dec9ab8434eb5060f79f1f43dd5f46425492a5afee23bda91e06a37bc36c92b7a79b5f65e1591c55ed9f0cfbd4e36d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257676, "uuid": "e2f9d99c-2f49-4e44-92ef-a2b3fc88c2db", "value": "T197A402207750CCB2E35178B4C85AC660AA6EF875CA749513BBD91FAE3E323D05339356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257676, "uuid": "da061bb5-58f6-4c81-82e6-5d1ebb24238f", "value": "6e092ebe345a2b0046ff156913a93de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257676, "uuid": "48e878a6-c81e-484d-9b0c-09f896d6c26f", "value": "6144:zhGZCFSVGez9Su7WSiszJEbo4MBai80enjLKUbx6oAVGUaeX6rRgUxJg:EBb917W3mEbo4MBatHTEo4GKcR5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257676, "uuid": "a66c66cb-b122-447d-9c35-7f93c83d40f9", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257676, "uuid": "eb99d7b6-d79f-4118-a620-2b1d5835806b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257676, "uuid": "1056aa02-ba6f-4ada-bc8e-87182a6a6abb", "value": "50498327cb17d9c49e236d4fe1037c2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc455100-f703-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628288098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288098, "uuid": "f965ad52-77c4-457c-903b-d41518e5157c", "comment": "Malware payload", "value": "bd5acbbfc5c2c8b284ec389207af5759", "object_relation": "md5", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288098, "uuid": "565dd602-160f-42eb-94be-7035ae0849cb", "comment": "Malware payload", "value": "9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473", "object_relation": "sha256", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288098, "uuid": "953e188b-d764-4fc8-a1b7-504ec89c2830", "comment": "Malware payload", "value": "c71b6cd6a46494e9132da20a6bacfe0b870a460e", "object_relation": "sha1", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288098, "uuid": "40d3c183-1f78-43b9-b991-7f2bcec139c3", "comment": "Malware payload", "value": "8cd09c393b96e222a417af7fdf60ecd5dd94649350197fb49c60640b9b7b22aa0b29420fa7ea9aa9968b0813957d2b50", "object_relation": "sha3-384", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288098, "uuid": "2e03e09c-7bbe-4b4b-b79d-b959bc67412e", "value": "T1B3E47B2975E1C03AD2B319301E3CABA500BEF9614D734E4B2398572D6E78D928D26F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288098, "uuid": "d405166b-4579-4d5a-8a8b-0114619d47fd", "value": "34a9ab58f1729530088ab6d5639a7282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288098, "uuid": "1ac8f35a-46af-4fb8-80be-7e0af6d504b2", "value": "12288:XyYRp4jlsiiMfEyICdcaTTpZqLKdVlU1I7brdo40NzTDiTrSu0IOgeXfP5JzP:iYcjLiMfDICDTzGxMbrIDiTr50COfRJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628288098, "uuid": "35eedfa8-66d1-49af-970d-04fd583e2ead", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628288098, "uuid": "d00cc779-95ed-483d-b32e-a728e9feda1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288098, "uuid": "1a885213-114a-4407-afb3-b44d003835c5", "value": "9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35f9c61-f67e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628231013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231013, "uuid": "bf539bb6-fac9-4032-b4ee-8826e827ea88", "comment": "Malware payload (Formbook)", "value": "f7e4da015c11e085e6f4e48b3dc2176d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231013, "uuid": "a97a0485-4d78-4ed7-8f09-0e15b4084b22", "comment": "Malware payload (Formbook)", "value": "9c667699c6643d42dd1264b3657141bf3b23b56f47e527e33ae83030d937cb5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231013, "uuid": "c4955f39-d688-471b-9169-362f85c0ec23", "comment": "Malware payload (Formbook)", "value": "d52c29c80fb82f4774b7624d8a1d429aae69e8f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231013, "uuid": "9bc33b80-d888-4075-af8e-d59e79046e90", "comment": "Malware payload (Formbook)", "value": "f34377742d5741e2257dbbbec7374b122e8e159bed3260e845e081e2c5efdea920315f6e5de67d1ffaaef4d07ca52aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231013, "uuid": "ee08b493-27a4-4af8-b860-9154cdbcff96", "value": "T12905E0157285C811D3BF6636CDDB40084BBCF9413A63EF2BB9DE326D4A4236299466CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231013, "uuid": "ae0483a6-b95e-497c-a7b8-0f2a493bf9a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231013, "uuid": "db858db1-d2e4-4c30-94a6-299c7818388c", "value": "12288:HSeTwrmpRw3viRidw1G3lZBpqNFevbOEykaGKNR70ZJUt2NjFr:HSwJUf8E5pKFGbOEy70LUMNjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231013, "uuid": "02f919a3-a6d3-4d87-a973-6c654111cf37", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231013, "uuid": "5b0da80a-0a69-4b63-b623-771c35fd1a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231013, "uuid": "e8d6a050-93ef-494b-960a-b3567845234e", "value": "f7e4da015c11e085e6f4e48b3dc2176d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94065ba2-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628252811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252811, "uuid": "0babdfc9-d082-4813-9b3c-bec46b44d3f9", "comment": "Malware payload", "value": "9f160499b4c84bd5b5b1e9bb86f1a810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252811, "uuid": "8f6990d0-1752-4d4c-94a5-cbe4ff6bc2c1", "comment": "Malware payload", "value": "9c7a473c55639baded58207c9f8441de9fa24b8ad510f9413ab2e2a1f49bd3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252811, "uuid": "3f0810bb-a9a6-4668-833d-f2315985bdf4", "comment": "Malware payload", "value": "17ff6a72465d49edf13329b160b6e71d9213e15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252811, "uuid": "79e867b7-facc-47df-b741-2430cfea8b49", "comment": "Malware payload", "value": "b76179232c60792bba7cd4a54e84d623c7836a3480eb25e1d902a464be46bd2f532651f38348776deb32ffc06b0bde82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252811, "uuid": "50114ce8-dabf-4f4a-9469-0571dc036e09", "value": "T121C3595B43BCC124E173CB766C779D08B66B2F144464E20EA6CBB13A4BFE589DC9740A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252811, "uuid": "32a6317c-e31b-416d-aee8-bf3c546a20ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252811, "uuid": "9c643a68-80a3-4294-a56f-d008d1344690", "value": "768:XtVq0OqaEPNFfRM+VPauKPflOTXydcocIexeN7nqcmqeuHWxMh7wYc22w3ndUeVY:XtV9OqTNPzvTX+ZexeDHWMOudbVJUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252811, "uuid": "d43218bb-2db0-431f-af04-351e84c94117", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252811, "uuid": "fa709b34-b918-4d1b-90db-ef38a66f244b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252811, "uuid": "113f091f-9802-44d6-a48d-f2d96918bc3d", "value": "9f160499b4c84bd5b5b1e9bb86f1a810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befe98f2-f6c0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628259326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259326, "uuid": "00ab091c-6e14-4ae6-ac90-4067cd061419", "comment": "Malware payload (RedLineStealer)", "value": "a77955e0f0f440eedcfec3462761af61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259326, "uuid": "f962e88c-03e6-4669-8788-e143b6b62d0c", "comment": "Malware payload (RedLineStealer)", "value": "9d7af200526719c06e4a2da2de6ea31d111b7bab4f49d9bdbea4e3ab7313f1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259326, "uuid": "3ee1f32e-827f-4ac5-bbe7-60160f9b29cc", "comment": "Malware payload (RedLineStealer)", "value": "dfd68797fe0ea4b0544b8ea80c0b6e09f64f86b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628259326, "uuid": "c96060ec-8d67-41d5-8dcf-d9718a8c9302", "comment": "Malware payload (RedLineStealer)", "value": "e7afc0c2b00ea7c6f08528944aa927d7eaa6fca40d69e186062f8505ab0d1bfbcc011634d1db29a78fe452701247821b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259326, "uuid": "d2244b4a-a26f-41ba-bd74-d7dcc0768dbb", "value": "T17805C0417144DD99E0276EF1187FC06023F8BD9E9225DA0D3F83BA2B95E7712219BB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259326, "uuid": "523a9f2e-21d2-4328-9fc0-8e9a6671e5dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259326, "uuid": "4464997c-beee-414a-9573-5731a2ef867d", "value": "12288:eCTHKA3SI6tijtmYyxE1v4DvNMLxmJMpxSsCKXMF+st2NjFbSiyyjK:8AtAYyDFMLxmJiSsCp+sMNjpd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628259326, "uuid": "8fd67f3d-fc0c-4134-aa70-1c71996eee0a", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628259326, "uuid": "3880b9c7-4964-420a-a3c9-ecc2204b399c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628259326, "uuid": "147fbaa2-bc60-4b85-b905-ca0e224396a4", "value": "DOCU_SIGN09984090103540087PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bcbcc9-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628257193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257193, "uuid": "d720e916-231a-4061-b0fb-f7fbb5d682f9", "comment": "Malware payload (GuLoader)", "value": "aff12f438c2f001d1de6537a4f5dabc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257193, "uuid": "a93508f4-c567-4ce1-9ae6-98b065632348", "comment": "Malware payload (GuLoader)", "value": "9e6cbdf027504241b57b420f6577a040d6d0a35f7df929c549182b32fc853b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257193, "uuid": "1bade40c-8879-4e7b-89af-03d3ea5678d7", "comment": "Malware payload (GuLoader)", "value": "d47e4667e2cb0d3fdabcb4442564ae096b8decab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257193, "uuid": "d77423c8-18f8-4d70-b31d-c95268e9212b", "comment": "Malware payload (GuLoader)", "value": "ad1ad9951cc9d7d1d459155aece215ad7f4c9512a7a9924285639f70685b07e2de16bd672d7fc76e6c452a673d4fb543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257193, "uuid": "72c3faa8-d26c-4eb8-976d-df9771843187", "value": "T158C318B0F5F3A49AF215CB3E1337516BCAF378A3590E502EA4249369883598D93E4636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257193, "uuid": "25f89fe0-bad6-49b3-8998-2a7c845fa6f7", "value": "b947ef57db12504396f2fb768b954d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257193, "uuid": "a84ed75d-3e4b-417c-a49a-232032b3da12", "value": "1536:7hZqFdM9asMHTvnUEX0yvsTtCrGFVOOSV:FwFduPMHTxX0ysCtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257193, "uuid": "174d75f1-7a73-431f-baaf-dc9ac5318809", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257193, "uuid": "2f555817-6423-4e13-8d5b-3455e5de0258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257193, "uuid": "5533c884-777d-429f-a5de-95763431eb31", "value": "Purchase Order No. XDK-201103-004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fcb3df-f6f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628280834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280834, "uuid": "e59eff17-e9bb-4b97-9d51-0def03b4cc6a", "comment": "Malware payload (Mirai)", "value": "e4540251cebfcc2fd691d55f74ff2f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Necro", "colour": "#A58F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280834, "uuid": "149b5392-353f-42b1-88ef-af1147366c06", "comment": "Malware payload (Mirai)", "value": "9fc24dbeef3103dc4abf8f1e411957503879d9ff2d50194d2a5e621633ea8a85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Necro", "colour": "#A58F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280834, "uuid": "ebcd5dd6-048e-481e-a14e-6198b8f9df33", "comment": "Malware payload (Mirai)", "value": "cf5abc05f3bce03e72b73ae682424ffea630a37a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Necro", "colour": "#A58F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628280834, "uuid": "bdbf0a20-36e3-4ea1-9847-923ce083cb30", "comment": "Malware payload (Mirai)", "value": "dd246cbe6c66c2066102c8dda75131c1a944273bd5dc4539e65b1c4f0ce808f9368f797c8d71304c6c4944681b490209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Necro", "colour": "#A58F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280834, "uuid": "f1678c5a-bd71-4a59-9cae-27ff425f781f", "value": "T14FB3172BB6E6CDF5C083B2B80ECB83D59060F0F46B22641F76456766392D1D89F5A723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280834, "uuid": "e625b2b7-439c-4ca5-9101-43b5b2d9ccb0", "value": "1536:LmmDIFlBX4Rf7/DNMeq/pjbC9nFb09b9Q2bBioQysk4zTB0:jDIld45/D7q/FC9nK9ba2b/QyQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628280834, "uuid": "496b33e0-1c64-44e2-bca9-14484b815974", "value": 107704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628280834, "uuid": "65983c40-e025-4d70-b176-954357ff2750", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628280834, "uuid": "feb8bf83-fd49-40ed-9d1b-a94dbda9c1b1", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14e2003-f68d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628237506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237506, "uuid": "46828092-4424-48a2-845b-8b39f4eceb9e", "comment": "Malware payload (AgentTesla)", "value": "401755313838fc4777cfbb6d8994051b", "object_relation": "md5", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237506, "uuid": "f365bae0-dabb-437f-b4a7-7f27ac59a728", "comment": "Malware payload (AgentTesla)", "value": "a0178c8bba7e0fc8de29b2f1dcc4d75af87ca685470d6ecd09450f6c4aacd9bd", "object_relation": "sha256", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237506, "uuid": "a2a6a09a-ab54-4e33-b4a6-371d8a1c0a92", "comment": "Malware payload (AgentTesla)", "value": "a861d6320c602081f316d047017ce046862b2c3f", "object_relation": "sha1", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237506, "uuid": "9ae1246f-3c76-4716-a45e-4618c846a31b", "comment": "Malware payload (AgentTesla)", "value": "869eb748e7f34e324ebcb3d71e01fd2c34af93e475415bebb50ef2a2c87de21db9461394d06f1311a70b0508a6d79c25", "object_relation": "sha3-384", "Tag": [ { "name": "80.241.141.156", "colour": "#94719F", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237506, "uuid": "fed26c4e-9c84-47cd-822d-e803393f4a15", "value": "T10B8423D00736FFA188CD236D07715EC203C921F681EF67A86D9635E4EEA6D90E1DB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237506, "uuid": "1a969462-ec62-4689-8150-d3d2ed7f8b61", "value": "12288:zhis5dpSDRZObETtY4lMvU8RzN8EuO35u5tkV1tz:zkEdp+FptMvZB8TK5uMVzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628237506, "uuid": "9e3c6aaf-cabb-4696-acae-7f0c6abf56de", "value": 393366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628237506, "uuid": "b4ce105b-12eb-4bf7-bdc6-69914ad8d27c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237506, "uuid": "a215a8cd-d97d-4f0c-84a2-d0d616240db3", "value": "Richiesta di prezzo per il cliente 003666748.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6716398-f6d7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628269217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269217, "uuid": "5fbfe704-90c8-4658-8bfa-6d2ede128756", "comment": "Malware payload", "value": "395e1870e74401d41d1a6b709d39f53f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269217, "uuid": "6b19ed9b-ec23-4103-ad18-3d541a2930ae", "comment": "Malware payload", "value": "a183659739697afae7abb37a3946c1ffdb66500c5ae3bc9b874c7f2e6ab7d753", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269217, "uuid": "fb8a39a8-645a-4c2a-899e-26f034101977", "comment": "Malware payload", "value": "e5eb857e1564204997c1de1049d452a0bf6c8421", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628269217, "uuid": "27fda0e0-14ac-43f5-a4dd-e59dcae2e9cd", "comment": "Malware payload", "value": "b537f8829a36bc7fb842015ee1399592aa638aa7c7392feb83a81f5f3ab292c3436a144d90fc1d7e3efab8a8bfae9fab", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269217, "uuid": "9b9e940b-b968-414d-a906-8aea3cafd4a7", "value": "T14EF2F131EA7EF1FB5E8952CDD638E819ED437AD301A3CCF59CAD651825C845C3E4A094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269217, "uuid": "dcec2695-1731-4007-bea4-08419650bb84", "value": "768:hpjCL7+Y1wZon8sc/FmycVIrkMES3f51TzZ8F8ToTAJMg:Pje6Yeq8scBjrZJfnzy8TMIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628269217, "uuid": "938dc778-6a82-46bd-97c6-d71a8d366bfd", "value": 37298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628269217, "uuid": "5bb9a66e-bc4b-481b-be7e-a000fc97e002", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628269217, "uuid": "e50ddcf2-c22c-4f48-a830-d818ecba25c9", "value": "wshrat_2nd_stage.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a2858e-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628229029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229029, "uuid": "2c53a07e-51a2-46ea-af54-d4599062d19b", "comment": "Malware payload (Formbook)", "value": "5d860ce35ccd53ddfd764e26d09ec5cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229029, "uuid": "47292394-f8f9-40a8-baab-2f975a0323c7", "comment": "Malware payload (Formbook)", "value": "a2e424247fbdda5f64d71340576e59efd380a71bdfcecc3da9a0e16968c4e709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229029, "uuid": "a23e1712-1720-4281-9f2e-7578b849c461", "comment": "Malware payload (Formbook)", "value": "0c98e508f5115ff9ef88bcf91851143c24b15c7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229029, "uuid": "af9da6d0-ab6d-41eb-8d5f-1569c91968c1", "comment": "Malware payload (Formbook)", "value": "56c20160111c870597513fafe700de98b2f877ef3415f8e3a869872b670c8f0039527faeeb7702e43a8a36bab3c5a313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229029, "uuid": "dac9588a-df3c-45f3-8b12-6d6387076ab4", "value": "T1B305CF91E684A616C58818BF1F3DFAB013FC9D8A1556C0812DD8EE573BAEEF609C35C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229029, "uuid": "4e9d3d1a-3baa-4294-ba2c-dadfbf94c1b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229029, "uuid": "03deef98-2687-4abc-ba6c-4bf5d0dcc254", "value": "24576:Tb2Vj3Fu9zJSfQJPFXG4n2QpDOj8MNjq:uhEoOE6fxOjlhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229029, "uuid": "b82f0db4-2880-4e7c-8605-ac2b20149ca6", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229029, "uuid": "ee87ba41-da7d-4dfc-a8f0-5776bc7e3580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229029, "uuid": "862cbba7-c66c-42f7-a111-25112f813fb4", "value": "5d860ce35ccd53ddfd764e26d09ec5cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b5ca6d-f670-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628224674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224674, "uuid": "2c15d050-2178-442d-b2ea-5a745ec481c1", "comment": "Malware payload (SnakeKeylogger)", "value": "534af96a98bf2d8fa455f72a3043245e", "object_relation": "md5", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224674, "uuid": "7d91ab9a-40cb-411b-b75f-003355450e75", "comment": "Malware payload (SnakeKeylogger)", "value": "a2f62b1c79f392229c8439c59eecbdb7c9aae8ea8ac051c47a63faf39023f7e3", "object_relation": "sha256", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224674, "uuid": "8ba0061a-d541-4ff1-bda6-4a19d065235a", "comment": "Malware payload (SnakeKeylogger)", "value": "0ce1e3728fa5f548df440a160144bf8533c1778c", "object_relation": "sha1", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224674, "uuid": "93e8fe41-d242-49ed-8286-a0642d496161", "comment": "Malware payload (SnakeKeylogger)", "value": "8e931165f8eb63eab6c1d68c19bfe60eea0a2c6e766b14947f16500b5d5feb25c64d5665247c41e7fbdc8d88ff53aae1", "object_relation": "sha3-384", "Tag": [ { "name": "185.222.58.106", "colour": "#0E03BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224674, "uuid": "cc4a9e72-af1c-4ad9-85b9-a66fd098cecc", "value": "T1D33423F52E27019CA72A2688C099FF9E3F51E7FF1855CD8CA59F52B7402721AC3352A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224674, "uuid": "4b0d1400-b7f2-430a-8b7a-8a65508a9abb", "value": "6144:GKmpwnZgq/KwP8L3bOb4YXsEReb/CFNoASqgr3MN3orKJMDMcAG:GFQZgq/b8L3+4XEkbaf7rgLAo24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224674, "uuid": "758cfc6f-56e9-4844-af51-282260790f2f", "value": 249751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224674, "uuid": "a8791a74-5a4b-4d4f-b0df-713f4ca9edd4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224674, "uuid": "fb164dcf-9971-488b-aacf-f6adf78d3736", "value": "41879375720210805.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f63f357-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628228966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228966, "uuid": "d57071a8-56b6-4478-b723-fee319d247c1", "comment": "Malware payload (SnakeKeylogger)", "value": "e17e788c2463a07bbf5f7b6151f6484b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228966, "uuid": "220b2b4b-f3c5-4459-87f9-7cc91c7b3c7c", "comment": "Malware payload (SnakeKeylogger)", "value": "a30745a67d0137df8a75b1357510706cb9751932bda0b598345b0d0402dd9e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228966, "uuid": "dbffc46c-fa21-410c-b8e8-aa1279a7ee3e", "comment": "Malware payload (SnakeKeylogger)", "value": "eb16375950577f41da62fd6e29716d85471ee25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228966, "uuid": "e60e08f5-8b2b-469b-91af-61313bb8d6bb", "comment": "Malware payload (SnakeKeylogger)", "value": "525f4e10851bfb3606ec6ebcb18aecd13171295d22911ca17d8420763fed5a6f91e078db5390c353d665d0f9b0a0446e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228966, "uuid": "0de599a7-fd2c-4958-95d9-d1e7c5d44066", "value": "T10435C013A66E8FB2D86D7D3F054F009D4389A69B68E0D38B744D4BA23615CC9778CCE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228966, "uuid": "d49ce6f5-337b-43d0-ad2c-be3e7bb714c5", "value": "12288:Zy50jwcEc6tgGujMLFubuS0Bis9JC2cxgEIRMf:808cEc6tE4I2CvaMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228966, "uuid": "183fae6b-d383-41e0-928b-0fa74c4ad13f", "value": 1104737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228966, "uuid": "62c51f0a-2e64-41d9-ab2c-b265f58d4ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228966, "uuid": "26cf2179-fce8-46b9-8fa8-d80a56f5ca42", "value": "e17e788c2463a07bbf5f7b6151f6484b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e67e83-f666-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628220740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628220740, "uuid": "4a696216-f528-4f3d-8646-8929ff546570", "comment": "Malware payload (AZORult)", "value": "ad78e093751100e854f713c6f95e5dd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628220740, "uuid": "cd273c5c-d0fb-476a-94cd-f9e805b05f8b", "comment": "Malware payload (AZORult)", "value": "a3a84046f1f21bdedb4a483ccc0fc2fa82a131e459fcf6d2f87c3cac3afb4e74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628220740, "uuid": "875e2be1-2b2d-467c-8c3e-9887ad4b5b07", "comment": "Malware payload (AZORult)", "value": "779c573851259e2e905f8ab69d6481a53b3dfe0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628220740, "uuid": "f0d3f584-a2e1-460e-b0bb-4baf4cdad740", "comment": "Malware payload (AZORult)", "value": "eb1fc43271b50fb044d190bee9aa0bc887e910012caf0fefaed8fb63a4cab5d454395eeece543a3083e4af24441e786d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628220740, "uuid": "d84256f1-49f5-4476-82a2-ea88c0d38b64", "value": "T12584F00633949B11C9444AB5D0E3592A13F3E58B12BBE74A7E5942D60F923FCDC4EF89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628220740, "uuid": "caa4823f-9d18-4bab-bb5b-e74362448d94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628220740, "uuid": "bec430bc-7fdf-4150-9e74-3c51b6728349", "value": "6144:BhuFDlnWmQ5R2O2JAKHv1pMrUZ4JoruxOIIg3J9QUA/TBKik0Z2hQptyFf:AlqEO2qKNyrl0Qbkk0GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628220740, "uuid": "88969da4-da7b-4088-98a0-cbfe87047edd", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628220740, "uuid": "b62e6708-5544-4ce0-8ebe-2eaead816b47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628220740, "uuid": "91e20414-3470-4427-8381-6391bf165f74", "value": "ad78e093751100e854f713c6f95e5dd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adc0574-f6c6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628261601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261601, "uuid": "a7bc9e6c-c822-4046-be3e-1d17c82985fd", "comment": "Malware payload (AgentTesla)", "value": "b87802f432b8b8de6cce15128ba30007", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261601, "uuid": "faaa6a34-5c05-4ceb-8060-64e44922fd62", "comment": "Malware payload (AgentTesla)", "value": "a51412351320c2876dc38780b18441bbc160c6a0fa21bda69330eeaef1fb6ca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261601, "uuid": "4ac0703f-6cac-40e5-bc66-c93942621175", "comment": "Malware payload (AgentTesla)", "value": "a63dd8c4e01a12b67d753f016c74fee9c1563bf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628261601, "uuid": "39b210f3-04ba-4965-b75c-0468676d6ab7", "comment": "Malware payload (AgentTesla)", "value": "c2f8ff91dbd4d6fc4ff1b0aa69a322490b6641cdde7e70507201166db24819e09a2671e19c2672ef3cf13edd28cf2ba4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261601, "uuid": "db3c2330-5ff2-4cf1-8a44-30df4347863e", "value": "T14664BF50AB030897C67C5237D257966FA3E08BB6E231C8AF7B4713C6A94D5462EF93C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261601, "uuid": "45171119-5819-4ac3-9a41-ccae69bffa6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261601, "uuid": "da5b31ca-1117-4082-b8cf-82b4893be8c1", "value": "6144:8A1ijDCGvBowm8sokmuSmxH4mp4U4x56MA6JrFenPTG8kLQO0HFXxx2b:8XCsB/m19WjA+ibYQO0Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628261601, "uuid": "f4ac1342-00f5-4323-97e3-abb222610cdc", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628261601, "uuid": "4a0743cf-f3d8-467f-b208-2781fbf91509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628261601, "uuid": "8b481f4f-f2df-4e8c-b9d7-fbe09efed413", "value": "PickUp Notice_HKGB88932410.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301dab97-f6c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1628262952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262952, "uuid": "5b73957e-ee5a-4bf7-9ff7-f8b3e0232632", "comment": "Malware payload (QuasarRAT)", "value": "1914a2c8d1589d346dec86208bbbee37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262952, "uuid": "2d0effd7-9b9a-42f5-bb1b-7b76b5b4b34c", "comment": "Malware payload (QuasarRAT)", "value": "a725bb8800499239e18eb3973b4c4371214e8da4efb12108ac42957a3819572b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262952, "uuid": "31b53ec1-1fa8-44df-ab76-702092b5caaa", "comment": "Malware payload (QuasarRAT)", "value": "c9f854cb866fc0dfa54ad4438fb1e3479a9a384e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628262952, "uuid": "51dde750-cc9e-4c00-9322-755773bc6249", "comment": "Malware payload (QuasarRAT)", "value": "2901e767b0a0ae2771b67e56f040938194d539390e37646c41e7403c5300e384d27dc3e87c16c3796d4346a37a9a7a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262952, "uuid": "707b43c4-4ea7-484c-b915-7b3c2ec00c54", "value": "T1FBB46B4023F8862BE57E5779E83115205BF9F40BB26BFB5F4541B0E92CA67069E40BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262952, "uuid": "e7dc916c-81f9-4db8-a0aa-9d65e633be0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262952, "uuid": "bac82f62-6e75-4a51-b57a-c408d0ca0c2c", "value": "6144:RTEgdc0Y3XAGbgiIN2RSBytYsf4q2gRslboscE6Ob8F9SAO+uKaE6lcTR3S:RTEgdfYvbgeeAb5sqpAx+uKadlcdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628262952, "uuid": "20d34c33-dd05-4f63-a95f-d4b790385580", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628262952, "uuid": "f472f326-5fe9-4807-89e4-ce8d8b4a9c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628262952, "uuid": "3105d993-1710-426e-82e9-21c3c548a009", "value": "1914a2c8d1589d346dec86208bbbee37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda5250d-f66f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224588, "uuid": "d5898c8a-bcc0-4bd8-844a-7e9f763c79a5", "comment": "Malware payload (Mirai)", "value": "4a0c5656d26d687457e862c2380e8cae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224588, "uuid": "117df2c8-539c-48b5-8ae1-d686f862848e", "comment": "Malware payload (Mirai)", "value": "a73af22662e16d8fb8c88830eb6470e7c010ffd42e1e67382cabf33f9644a5e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224588, "uuid": "77ef7397-5eb2-4d15-8c28-380edf746087", "comment": "Malware payload (Mirai)", "value": "faa1ccb61813c164530d3b65229aa530df1cfcb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224588, "uuid": "2955bf3d-b794-4402-90da-a81cb1232c2b", "comment": "Malware payload (Mirai)", "value": "8b10e0822bdd18f548ea384ae6dfce418f9c93d33c3fc6f81b2e078fc3ebdfd4136cadea9f2928c9b8f4fed97334474c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224588, "uuid": "c82eb79f-08b2-4b7b-8cf5-11dbbbbc8f82", "value": "T1D9330861B8936A1BC6D0237ABAAE558D332063E8D2CF3217CD601B147BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224588, "uuid": "dbfc81bb-d2a7-4ce9-bacb-c4f8176fcdc3", "value": "1536:VvmyehDi86b9vUwmkaqXD5n8w6Ioh+kWsj:VvmyehmYhw6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224588, "uuid": "ac7b8c2c-895c-47c4-b786-1a1027d1a59a", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224588, "uuid": "772293ff-a33f-48f9-bfbb-eff83d616a78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224588, "uuid": "d8796c02-71e5-4231-96fd-885efd62a851", "value": "4a0c5656d26d687457e862c2380e8cae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d725b8c7-f6e0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628273110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273110, "uuid": "df40a9b8-1eb5-4b87-ae70-28280c6e9de4", "comment": "Malware payload (Loki)", "value": "1fbed96200a87f404ca00d11c42bf161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273110, "uuid": "1303cee7-52ad-4349-98f3-4d46637b1a94", "comment": "Malware payload (Loki)", "value": "a77d42e5cf03fce86d5fcc844840ab9f8db3f562791348ae5bca2aaba0d3f54d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273110, "uuid": "07980afa-7dca-4c25-a535-972213fa8e6b", "comment": "Malware payload (Loki)", "value": "b16be0a4feac4399d70450a2547e4d79a697cf31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628273110, "uuid": "cc5f6e72-3189-4583-a887-912a6b877c6e", "comment": "Malware payload (Loki)", "value": "0b953f848106ad2625b26397ff3e1e50c359f737238d603b8912ab8e744aeae776c62a58c5433d71cbae25fecba55504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273110, "uuid": "2c686341-6e42-4d93-a406-0374f38fb5aa", "value": "T105C48C2625D15907E53CCD3C1892916AF138EFC2B5CDD68BECC73D47D53AB8226806AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273110, "uuid": "2076156b-11f7-47ec-a992-be00744621ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273110, "uuid": "37af4f53-0f01-4b0e-aa43-b8102983ba52", "value": "6144:5vQ1ZlJEAdNv0ClLmZC/k6V1m1YAOfRt69uGMg6hKPz2DQwT8jF5eWWW9qXeYySb:OrgF6VgYAEclMg372DZTAX3WqqXeYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628273110, "uuid": "0c850818-af45-4b8a-8e07-30e3f6825ba3", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628273110, "uuid": "d9404302-0439-40d5-9952-33537de52c15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628273110, "uuid": "3a8a29e9-4028-49d9-91e5-9a3ee423785d", "value": "Factura.TGU0000207262.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31a98aa-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628253320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253320, "uuid": "1fe307ef-eb2a-42b4-a7a4-c79bbd1445d4", "comment": "Malware payload (CoinMiner)", "value": "9d2b7f6d1092a893cbb324d43dff6ed4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253320, "uuid": "42597a96-01c6-456d-ba60-570390898081", "comment": "Malware payload (CoinMiner)", "value": "a7da0ebdcac5311451a6717982a3f1e9b2bf4d91722a9ace6b2e03f6831a483d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253320, "uuid": "c516e3db-83a4-4be8-8af4-1cf4f517e089", "comment": "Malware payload (CoinMiner)", "value": "80d311184e631df63af60868c43ca122d8183362", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253320, "uuid": "b892ee14-3b99-4171-a8b5-e3321bad2cb5", "comment": "Malware payload (CoinMiner)", "value": "26f26cbd450139d248b63746f8e5be0bf0209e006e1ce75493c098323bb6f77860e3e741853277ec2349f9ba2753dbdf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253320, "uuid": "4dba033f-9974-4f8c-a6c4-0afc1e0b14ac", "value": "T19EE433C0A2C86F68C4C19014DB8E2D807AC2A19D5D7AD7C3A4A9CD087E959377FF990F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253320, "uuid": "c275d014-693a-4973-afbb-e10de0fe5479", "value": "12288:dxQxLmd1jxQEzqI+JXrq6dIpssz+vy1Q6bM26/rbXwHa4c:5JOaxQbq6SsszXG6Yzp4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253320, "uuid": "7c3e9ecc-a1be-4840-9e87-6ec42141c3c4", "value": 697059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253320, "uuid": "481cfa71-14ed-4bb1-9e8b-69bedd3b4d5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253320, "uuid": "1cdb73c3-465c-4eff-9d97-dd86115dfcb3", "value": "Qoutation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185ce821-f6eb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628277515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277515, "uuid": "451fa30c-eec3-4ab7-9f8f-bf944a2668ed", "comment": "Malware payload (Mirai)", "value": "43a2269bcc372da6ba9155c9ae66010d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277515, "uuid": "4369ebf1-db15-4540-8289-6db9f0f8a281", "comment": "Malware payload (Mirai)", "value": "a88f655290797794e49eb6c36becdececaae09a4348ccc21a02cb053c08978c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277515, "uuid": "9fd67877-c6a4-49ab-89cb-8f18804d1ce0", "comment": "Malware payload (Mirai)", "value": "689508e136811a5952c34517cf272879d5029f92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277515, "uuid": "1ec836c6-f61f-4139-b561-70be8934c284", "comment": "Malware payload (Mirai)", "value": "93f0453ca567f2e0a1edcd1b9830fa3a12f8e95cbc089fcd8383ea05a453c336b0caf16eb883e44d5a0e5bbe99f1bfb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277515, "uuid": "3044dda1-c0d5-432b-934b-5ad67fca33f4", "value": "T11EE2E1CC2A8998EFCD08577366F48BAF74D13803BB2E57501A2CB1CD0D6222F5495C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277515, "uuid": "bdbf6c5d-e798-4941-a8ce-565aa7412c71", "value": "768:wT3NcwRIGsLNDUhh8B8swvebZluXUneZqNAb28kadE1MD:wzKwORdtSFe9luXUeZZ28bOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628277515, "uuid": "bbc8b714-cca6-47ac-9b40-7f6c4bdd7dc5", "value": 31200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628277515, "uuid": "e1c04e42-aa9d-4de1-b20d-87b34e3166f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277515, "uuid": "ea2277cd-2f8f-49d1-9228-f43ed95427cd", "value": "43a2269bcc372da6ba9155c9ae66010d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5facbd8-f66f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224575, "uuid": "7c8024c6-8897-483f-a59f-6b9b3615357f", "comment": "Malware payload (Mirai)", "value": "e050d2fbc1ab53cda18ce7976227087e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224575, "uuid": "2b644f0b-072f-4f7b-b0d8-1f95713cb375", "comment": "Malware payload (Mirai)", "value": "a8a1fbaa62ecac9917135858c6e8dd1f1b8865cffbe2f21036ab881bab67625a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224575, "uuid": "9724c61e-b625-4b41-8ac6-90156afc26f5", "comment": "Malware payload (Mirai)", "value": "84c20fad6082203577b75e877185d645ab9856a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224575, "uuid": "8199fcec-e946-436e-9e33-2f0ae75e31e2", "comment": "Malware payload (Mirai)", "value": "56563105b7337b147e329c269b92c759da47ba85226d6bb5a8fb37a1be8138c0e0247de4d474de99e54655e205185e67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224575, "uuid": "b7042f9b-d60b-44fb-9794-046d578593db", "value": "T10393A51A7E258FBCF79D863507B78E22965837C62AF1C141E19CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224575, "uuid": "8f3df538-d478-45f0-bc3e-2d39f3543144", "value": "1536:AKzqmzfphPukFhyx2XgHgQeFrhHDDK163ZrrkY2QPUc:AKqYhueXWgQeF1H6163ZrrkzIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224575, "uuid": "67244c64-80ad-4a8b-ba19-90ca5c7df238", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224575, "uuid": "2aab6e6b-3f27-4653-9ff8-f7fa6012178b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224575, "uuid": "df3d95fc-a375-42b3-9f8d-47cb2027de9c", "value": "e050d2fbc1ab53cda18ce7976227087e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107b4e19-f6ef-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628279219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279219, "uuid": "257dc621-75b7-45d8-b404-1b1b27498a19", "comment": "Malware payload", "value": "73ce182d783b6b29452897134fcfd483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279219, "uuid": "cfc755b7-faec-44e1-b783-bb04ebb9c096", "comment": "Malware payload", "value": "aa46ec291334b68e6c96fed8f2b88ce521dd87ff7535a5465537e7d2c36d1539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279219, "uuid": "787629f0-c869-45a9-b678-0bc3c2bfba0c", "comment": "Malware payload", "value": "35ed16d019c0cac49e59b872515c76e7cef7f436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279219, "uuid": "b9a17551-d405-4797-a3dd-0876153b571d", "comment": "Malware payload", "value": "4acd7d1e1032db4920e5826ad5ca27410506d250c6a2602faaad54abdfd0ea0079a6bbc83bb1c4231f21ad7b334d20e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279219, "uuid": "608e4133-7a49-47ae-9480-15f06d9b2ac4", "value": "T1A9A4F156B1E40298CBB942F6C5921742E73174761B65B3DB1BB853B62B2B8C68F3C3D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279219, "uuid": "c2f2be77-0299-4143-9335-74b976c49d2d", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279219, "uuid": "ecd16f51-1eb6-4947-a317-cb657a7045eb", "value": "12288:gbjDhu9TIJeSsJSIX7rNU6wt0p4fPEIRlY:O1eTIoRXnpwipgPjRlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628279219, "uuid": "726c245f-6d2d-462e-b192-3ec81e8957fd", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628279219, "uuid": "770714c4-53e4-4d5b-8ec0-30b162746e4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279219, "uuid": "5b347cb6-0966-4b43-954c-4a65319a3ac8", "value": "Vape Client + Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e08ad4d-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252318, "uuid": "588a80c1-b9b0-4aa4-8177-a0d7c2053a6f", "comment": "Malware payload (PlugX)", "value": "298ffd927761973df68be4b4fba85272", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252318, "uuid": "6cf9fbc2-d8c6-4726-ac86-a91a91cc6b18", "comment": "Malware payload (PlugX)", "value": "ac21a70e58a63e64246359af637b68b44e851f6d781e32dcb2ce06efc23d3ea8", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252318, "uuid": "04a8bb8b-4d1d-46fa-8fbc-fb7ea4bc451d", "comment": "Malware payload (PlugX)", "value": "f7b700048a10f89c31bc78ee8a40d8e2e47e2252", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252318, "uuid": "2909210c-5252-462e-8681-2b8b0ff05894", "comment": "Malware payload (PlugX)", "value": "d0242e4528cd465f37160d683187859c2ad2273c0480acdaf0d48c97314d22a120785f31df0cd1f6a1697df92d42f65f", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252318, "uuid": "c38c8558-6730-432f-879e-266cdb785ca5", "value": "T17C835B05B2C09274D8BF567918B99E02077E7E62CFA0CEDB7B84414D9A745D0AE30F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252318, "uuid": "c1b35ace-0af6-480d-be42-cd96c0a70a58", "value": "361e59a865bbcb1308341fab28e0c514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252318, "uuid": "3f7e283f-5e2c-4758-a16b-0ff3aa21be8f", "value": "1536:1uW5Btptp0/wW/TDc3Jpp0hOAKfG38RRc8p58rsWjcdIF4P:cWwwWwpuXGHp5DI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252318, "uuid": "fb854aba-72c8-438b-a803-24473444fb4e", "value": 82939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252318, "uuid": "b3dcbd13-038e-42dc-acc0-f19f2a7840b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252318, "uuid": "f09dabdb-81da-4e6c-9157-ce21b7c36d49", "value": "ac21a70e58a63e64246359af637b68b44e851f6d781e32dcb2ce06efc23d3ea8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2123630e-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628253048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253048, "uuid": "304f0505-89f2-4439-9f3d-f81eb26dfca8", "comment": "Malware payload (RaccoonStealer)", "value": "b514a135e651cce25616a05190998c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253048, "uuid": "deec8d35-09e4-4569-8773-2a587aead111", "comment": "Malware payload (RaccoonStealer)", "value": "ad6241f710aaf56d3275da0b06cca0d90989c0626e96bccd98a211d461dec9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253048, "uuid": "e5e9ef2d-3c8d-4c8d-b395-1e645e7162d6", "comment": "Malware payload (RaccoonStealer)", "value": "aae9e8ae05738633885e1ac1fb499d490c65c1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253048, "uuid": "538aa0ec-d1fe-4f2b-b887-36211fa4e8b5", "comment": "Malware payload (RaccoonStealer)", "value": "99f7cd4fb6259b2822323f108ec42b7595eba780bf54eccb829038119c4cb4a14bd097ad7c1c2603e0658a57aa4084de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253048, "uuid": "12741a91-3bda-4932-b34d-f941d026e84a", "value": "T1D0A41200FE51DD72E163B0706C66C7949A5BF9A1D9128217BBDB6A9E3F303D05B38319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253048, "uuid": "6a98cb8c-94b0-4f1d-b526-3ca36f55d09a", "value": "38170c4d65ff42b014b27008b95c5de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253048, "uuid": "b4d33d1d-bb7e-42fe-96f4-a2bbad191feb", "value": "12288:qwrTlklaqC8oZ22Za425zWeLVw4BUyRiY:qwrT4HI22Za4x2Vw4BUJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253048, "uuid": "0800b509-13d7-4cf7-8a4b-57702548afae", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253048, "uuid": "9f0a56d1-9a37-4c8d-a31c-8169856d7233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253048, "uuid": "2d0577e8-daad-4202-8bac-ae51cc5d9022", "value": "b514a135e651cce25616a05190998c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03cbf97-f67e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628231008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231008, "uuid": "6ec3756d-b6a3-466c-93ed-d21015067d2b", "comment": "Malware payload (AgentTesla)", "value": "5abc47059f05e8050a119814bf32a869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231008, "uuid": "7fb13703-7f00-415e-b923-4ca1a85f7903", "comment": "Malware payload (AgentTesla)", "value": "b11276bad56047581b872ec6d0444a1ca1a6f69d30148388962237dbab0a4ec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231008, "uuid": "35016ebe-4d73-47f0-bf5d-831648bf47d8", "comment": "Malware payload (AgentTesla)", "value": "d6520da53a4b838670da0051620112c7a88766a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231008, "uuid": "5936ca1a-0de8-4b59-9181-57969a95a5b0", "comment": "Malware payload (AgentTesla)", "value": "7c67ee55d9718f5bfe082efb77c69e6bc7d511c6e8d4030ff98d44e0f8dd701a26773a97e8a8d2a01ccdbe5b81ebc735", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231008, "uuid": "2ee9c9de-c186-48b1-b529-11b1b6dfd1c6", "value": "T1FDD42310D6C9776267DFFFF2498C85AE172226F00CCACCA595511E0B6CE4249ECB9F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231008, "uuid": "27a54db0-143b-402a-85af-0ec776af6b2e", "value": "12288:HehfXONkBcgORN+HvazCZ+PszVAzJGz4Jz5YexeB/s4hYAk/2U/ZD:sfeNkBcgORN1C4IAzJ3JM9thXehD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231008, "uuid": "a9b7f0c6-889b-465b-bc38-9bda409b265c", "value": 630361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231008, "uuid": "e142b57b-487b-465a-b92f-2a1ac9b566cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231008, "uuid": "12616667-27d7-48dd-8aee-7912943b4fbb", "value": "Scan copy 02186 pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35627b9-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628256756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256756, "uuid": "77af9470-e6a4-4634-bd4b-c2db6c1b84a1", "comment": "Malware payload (AgentTesla)", "value": "37fbea5d8032b742de9c689bc15034b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256756, "uuid": "87f7a372-831a-4630-b273-2ffdc1acf429", "comment": "Malware payload (AgentTesla)", "value": "b15d344bbd7da01d707a4811f5a083661a90bf8ef743498145feee4d8cd7b583", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256756, "uuid": "3101790b-ce1e-4611-8d4d-93fa401bd523", "comment": "Malware payload (AgentTesla)", "value": "5553d85f4450e0a47ae862b7d2873ee865524bfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256756, "uuid": "4764ca45-5de9-4395-99f1-c16f8835d288", "comment": "Malware payload (AgentTesla)", "value": "378fb356b48158c3a170636bc0ca28520393ccd4577e62ffdbce98d6c83c7170026a7e730d29b922947526038dd7ddd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256756, "uuid": "3574a316-4142-41c8-882c-3de5b878ed64", "value": "T1FC05DF247AFE1704E1BBEB70563591408BF6F53BD713C78E2C25509CAA73A828722F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256756, "uuid": "fd12a87a-d52e-4209-a7a2-508014716abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256756, "uuid": "065a461a-02b3-4c94-a19b-e7978e2cbb5e", "value": "24576:XKKb0wFVMNjy2QrnqjEqJsiazXjSVDssfT1:aKYwFShy22ULJYWVDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256756, "uuid": "1e9149fa-88fc-41e7-acb7-bd1b4c9bcbe9", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256756, "uuid": "fbb027eb-ed15-434d-98f5-15d8a91b1057", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256756, "uuid": "52f85817-ad1d-45f7-acaf-adc9d5b34fa9", "value": "h3bWi0GpaLF2OeX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906bbe2e-f6fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628285877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285877, "uuid": "7f0fdca8-787a-4951-9c12-268bf90f6447", "comment": "Malware payload (DanaBot)", "value": "c4a94a97195545a59bf8c8a22fa8dd6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285877, "uuid": "df00e57f-a876-45df-af78-43fa6f84706f", "comment": "Malware payload (DanaBot)", "value": "b1bcbf1efe10f8ea0f6133f664602c918c4a30d06f662c872791f990164054e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285877, "uuid": "f36f2472-29d3-4aca-a9db-72f1c0194cb9", "comment": "Malware payload (DanaBot)", "value": "ef833aae1b7d1226e0b2b4b0b45982c4abd02b50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628285877, "uuid": "1862aec1-cce6-4b2d-8a67-fe6697214dc6", "comment": "Malware payload (DanaBot)", "value": "53c6c56989a201e9db3837d3f233c7c10bd7ddefe7efaff91774eb326725aeda569b425797de0b1aa5f5f24d6a8d7f6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285877, "uuid": "7c1078c6-9a1d-4110-9367-78e79fcfd9bf", "value": "T1193523205300FCB6E6D6B4B048A6CB52476BFD51C97789437B8266EE3B352F16A7430E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285877, "uuid": "2b11c8e7-fa7c-4e71-9349-679cfacb61c6", "value": "00a47d6be4445a02dce374ef34dd9b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285877, "uuid": "a2cfd3fe-ec15-4945-bce5-dcebe5f146ad", "value": "24576:dVHvztQ/IgZuYYQCMECo0REcj0OhHz5M31SxKiEqbtlnlPjgdLY:nPhQvZuY9b7oIQOhHS3mK7ETlcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628285877, "uuid": "acf5312c-9b9b-4817-81e2-8023d282ab07", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628285877, "uuid": "b75903e9-8586-4318-804a-76c538ae442d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628285877, "uuid": "b1f0d038-fac7-42ce-8be9-50d46d0613d4", "value": "c4a94a97195545a59bf8c8a22fa8dd6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c544f055-f674-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628226695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226695, "uuid": "76ff1a66-3607-4b25-a3be-854cf2e53812", "comment": "Malware payload", "value": "e1746eb88e16006ada8fcea569e47373", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226695, "uuid": "9f98ce86-0036-4e62-b4e4-d78628bded0d", "comment": "Malware payload", "value": "b1e542752d5c1a59c5efa28cd63de4235b394bdd700c3e3fb6daf71e10de7d72", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226695, "uuid": "d20db642-75f0-4ea0-8da6-dc5456a12c9f", "comment": "Malware payload", "value": "0a9894a452805d4b7fcd47b7e31079b432221d5b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226695, "uuid": "7cb12d04-c05d-4336-94b9-0048ff7118d2", "comment": "Malware payload", "value": "6c31eb9c0291ec71b43b4a94a340ba65d992fd2fc49de58c2e40c53cd92989342dbf5a851aba09a5ef276772a48ac636", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226695, "uuid": "5b9154d1-c368-4632-8e41-670a7d4c45a5", "value": "T1C9956A05BE8E8161DC1146388966D371E3627C641F6D85EBF29ABB2E6F331D0AD36313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226695, "uuid": "e1678cfa-7235-4435-8abc-1dd770ee8e8f", "value": "49152:xHkGY5AelMDbWmnGnrijpsj8kU4UUU3UUUtvFOpLhhs6564m:3Y5A/b3nuijpeLU4UUU3UUUtvFOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226695, "uuid": "2f54dd73-2005-4047-ad09-3c7e97da91f0", "value": 2010624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226695, "uuid": "71f0371c-3a67-45fa-8491-5767fc393c3d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226695, "uuid": "61c4a2ca-a732-4abb-8fa5-93bda4c7d869", "value": "minha-conta-10082021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d0ad09-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628227019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227019, "uuid": "f10ecf42-4c83-4039-98c6-caeb0b663e3f", "comment": "Malware payload", "value": "1a2bf201e7997d6a54af0d16d360c496", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227019, "uuid": "73603221-c5ed-4b8e-9466-ed80021c244d", "comment": "Malware payload", "value": "b2cb5ef3ce2f1948e8895732b29dafbb220a7a3d1a7d8516d8189306c3149b11", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227019, "uuid": "11323908-205d-4386-9c0f-1f187b7f220e", "comment": "Malware payload", "value": "b71d3839ac7d8d89f5306595fc72987dc344ce2d", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628227019, "uuid": "92b3aec9-a710-4851-ba43-381ffb6da92f", "comment": "Malware payload", "value": "74ae13dd38f6d8d11cd0b059baa0df4e844392de77cd317083266471df5d831557835ac2bf2a7cc0ed65e2d2fefdbfa3", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227019, "uuid": "0de6bd8c-dea2-47f9-8c52-674e2d34c84d", "value": "T17C02BFDD9708222ACC1B4F3E42EE20CE8984B99085E129AE3409A3D50CD36F61E1735A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227019, "uuid": "413b2523-bdf5-4471-8488-025d054bbd9b", "value": "192:37XqoF2tQjDFxvvSgyIEjCDH43sFN2sh+9gWik:3lYqVxvvSMGCDH4um23k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628227019, "uuid": "48be096c-7791-4668-83a8-edaf3c6d4c5b", "value": 8383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628227019, "uuid": "b0b24ef2-a68e-44fb-b80d-afb37ff838cb", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628227019, "uuid": "83d9d1a6-b685-4056-96c6-c865b152166b", "value": "e-Invoice~990121.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b8a39f-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628231284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231284, "uuid": "9ce72b90-c818-4f07-9bab-390eab459ecb", "comment": "Malware payload (Formbook)", "value": "8cb50079161ea060a5c8560b9716fa43", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231284, "uuid": "057fa9b1-d321-433a-90f9-9e147cf8f902", "comment": "Malware payload (Formbook)", "value": "b2d70cc060417df5286e4f2ea07d60e925b79dfaac91dd03651ce6639b0309a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231284, "uuid": "5e48541b-5b21-4e95-84e8-683a0d8b49cf", "comment": "Malware payload (Formbook)", "value": "45f2c9c7f84d7c9b29c8967abfaa32eb537b4a7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231284, "uuid": "4892ad95-4bcc-4b6a-87dc-fdb524a35d96", "comment": "Malware payload (Formbook)", "value": "ce052f85a35f93fff67a6e4bf638d7dafef31196183a465a6e6b84fc69ff89ca0040f1669ca0b316ba3b205b5de30433", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231284, "uuid": "71980838-1f3b-4054-afa9-49de00207582", "value": "T1E124237A46E507CBD682ABFF250994C32ABD545A371EF4098F7CCEE278C27683542E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231284, "uuid": "a4eec0f3-c423-46c9-86cd-96d90392d5e8", "value": "6144:XAp+z3MGB/rQmFiOrs55NmmVFPm2JY+dV7An26Z2L+cDM+XQxL:Xtp/UmkOrs5zPNY+b7AnZ2L+cQ+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231284, "uuid": "9b5ee519-b3c4-46d6-9c74-26c3ee7259cf", "value": 221894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231284, "uuid": "ec806eee-f1bd-4a70-a6bc-60dbc60cbc17", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231284, "uuid": "13421190-0c46-446f-b4cc-9c9996cff210", "value": "PROPOSED ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfa4705-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628231138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231138, "uuid": "8ce39575-d9a2-4813-9aa2-098d9c56796a", "comment": "Malware payload (Formbook)", "value": "cd614ee86b5661f86d0a7f2f089f3e8f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231138, "uuid": "e7d9d4f4-3440-41a1-8109-4805a64bed08", "comment": "Malware payload (Formbook)", "value": "b41d1ffbb8d7c2a870f77e24ae83e6b0b06eb01e0f93f30341d1731d052add08", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231138, "uuid": "6be11e01-6681-4d3a-9840-1579ed7c3107", "comment": "Malware payload (Formbook)", "value": "4be21d1432333d4c4ee4aac8ddae3e79566c74e9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231138, "uuid": "478aa282-b525-437b-8a2b-33382c57c315", "comment": "Malware payload (Formbook)", "value": "df3267af252395cff3ac05f5ba34b072a7ec9c7480205ad057f0dc763c826fc103783ea895503dfae77fdb46f95aa762", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231138, "uuid": "c01e4d84-4d7a-4f68-ac30-3de0320ac535", "value": "T124E423D6531FD0DEAABBC44C21757C230AD9E91CED47B00D9E2D55822E0B19BC71A87E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231138, "uuid": "cde82ce2-7808-45b6-b870-82dee92fe5e9", "value": "12288:6bcdDIShaVvcE+AfWZzImWvwk2FmDMZ9RLYCjLSrg5un:KathS0EcZ8mfDmMZ9RLBLkg5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231138, "uuid": "c6a00316-6d03-474c-a298-86e1785e520b", "value": 676600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231138, "uuid": "98396e1b-d608-4d31-8fc8-c9770a8a7abd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231138, "uuid": "964326d7-07fd-44d6-a807-f6b62de76732", "value": "(0998 R1) ST PO1805140.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc0f669-f683-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628233203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233203, "uuid": "d2f35892-4e26-4987-826e-c17a4925b81b", "comment": "Malware payload", "value": "88c9c5c7c8689f6747221d83de532e78", "object_relation": "md5", "Tag": [ { "name": "pw:37842964", "colour": "#BA2CBC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233203, "uuid": "8b37cb3f-5447-4082-954c-3600171e590d", "comment": "Malware payload", "value": "b534ccf5f3d510a7c9cd105d5b9d98bef4a12fbb49ec69f8c2a83cf24a1d824c", "object_relation": "sha256", "Tag": [ { "name": "pw:37842964", "colour": "#BA2CBC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233203, "uuid": "7a00e2ef-040b-4de4-aa35-0bc2dc25a10a", "comment": "Malware payload", "value": "1b2d330e1041abf264ab383216cb670ff42f92fb", "object_relation": "sha1", "Tag": [ { "name": "pw:37842964", "colour": "#BA2CBC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233203, "uuid": "2a3bf662-f769-4ce7-ae9f-da820c1ab706", "comment": "Malware payload", "value": "0d7cad0f82a831789ca963ae365dfad7c613250cc986826a1f06199edfc11c800d33d59298c3e4cae13e0196f31402ba", "object_relation": "sha3-384", "Tag": [ { "name": "pw:37842964", "colour": "#BA2CBC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233203, "uuid": "2465a6cd-31f3-462a-84fd-ad2d6e4f6087", "value": "T15A43F2E35A96ECB7A85064C1A3DF4371274EDD289D604F422B832E6290F75BD9611C2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233203, "uuid": "6aed2ed8-4b74-46cd-940c-5475185b3eb7", "value": "1536:3Ms4d/9DeGRMtk0h7QgbRDvFH+eaQ3N0KCS:8P/9DeGRMYKDvFHX3N0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628233203, "uuid": "b74597b9-626a-4d8a-9512-afd9cf683f9e", "value": 55642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628233203, "uuid": "1c690ed1-c39a-48f4-a17c-c0b348fcd429", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233203, "uuid": "3c98779f-c043-4fbc-b655-2c7c03db1da0", "value": "20210805_id6f4a18be50.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272fd143-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628231154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231154, "uuid": "46a6363d-e9a7-4881-9c63-e9df9588e533", "comment": "Malware payload (HorusEyesRAT)", "value": "1d3b6ec85f6dd6ae7fcb038e02df8eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231154, "uuid": "7f8cb8b5-daa0-41e8-8610-6a448849e7ee", "comment": "Malware payload (HorusEyesRAT)", "value": "b6af00e22b28d6c1d4d5fa5aab446961afdcafe2b9f563a0432a06fa044a578e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231154, "uuid": "c7219de2-a516-4536-a20b-b2116c7ed1e1", "comment": "Malware payload (HorusEyesRAT)", "value": "292f7acafd86183b4a1c6bdb759b77bb4c6b0fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231154, "uuid": "8b61e6a2-5fda-4deb-b734-96302a0276d3", "comment": "Malware payload (HorusEyesRAT)", "value": "3f8f5b98076db8f64bb4f8d0e077d2481b3b118a6e7808019bd76716ceeae633790616fb554e71c04de9c74a90e83a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231154, "uuid": "5f3e9674-7375-4d3f-98c9-2b6adcc8a9ee", "value": "T12AD2BF08A2CE8F29C17D4A7E2DB3424453BCE20F4213EBD96DCCD49A2D6736583136B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231154, "uuid": "d3e3da83-3e2b-4430-8ffd-310b6a70d006", "value": "384:+mEOXbEyhb1PzZXm1/S7fwFCtgr+qdR8PyWXgcw+JCgIXQqneLhU8VYAVWe9kSRp:+mvrEyVX6CirblWXgecgIBkVWGUERZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231154, "uuid": "c34b2fe2-8cfe-4647-824a-c85524244c51", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231154, "uuid": "ab1ec2bd-e9dc-44ea-87da-e4c51203ed38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231154, "uuid": "d16afc08-f773-42ad-84ab-34e334cf8c7f", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775c71b7-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252334, "uuid": "b38fae72-b33b-421d-8645-e138f6bb7400", "comment": "Malware payload (PlugX)", "value": "8f42a57b7547554fb685f15e4a724582", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252334, "uuid": "9dfe92d7-737a-4969-8160-6c1fe3818252", "comment": "Malware payload (PlugX)", "value": "b82752e798eec15d7e5ff9bbef1e9eabb2ee862ea904b327f4322fa55a18cc3f", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252334, "uuid": "7bad0222-39bd-4b93-9d42-9785faedfda6", "comment": "Malware payload (PlugX)", "value": "707a8d09a7a2e0b7430bd0bdc596112709366d02", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252334, "uuid": "a8caef94-ba22-43b4-9424-0f7408eec0a1", "comment": "Malware payload (PlugX)", "value": "61bbab387987a53da6f60d0de14438da440a19b47bb4790b926d3f846235eeddb5e71f72c5d83872de520d17e5e92e41", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252334, "uuid": "78988e97-00c0-47fb-912c-c7773efeee68", "value": "T145F31800E040D3B6E4BA40F94BBDAE5B257DA962071515DF37C29C3E79D2DE16B38E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252334, "uuid": "907bcb10-3868-4de6-ad9b-6e96904eb9ef", "value": "397051b6d9c5c8b855041d0a2769af43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252334, "uuid": "9f1a332c-7bc0-4b5c-ad26-ffe8b8a96a89", "value": "3072:SXZC1fhEIosP/HMP7kUj6IXE6i1xRqLCJVQyyR:uC1fWIpP/H67kU+I06i1D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252334, "uuid": "f20d922a-abf9-459d-bd35-5226f8096d77", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252334, "uuid": "abfb8d2e-466c-459d-a220-4f2edb559104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252334, "uuid": "69c4b23d-a523-41db-92f2-3dd666127a57", "value": "b82752e798eec15d7e5ff9bbef1e9eabb2ee862ea904b327f4322fa55a18cc3f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368d0012-f6a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628247930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247930, "uuid": "2d0b72c0-7df2-4472-8dab-a2505eacf718", "comment": "Malware payload", "value": "a518d438c8f809d03fe68103ac98da91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247930, "uuid": "3df0511a-97dd-440d-8f4e-19315f6b046e", "comment": "Malware payload", "value": "b86309a73092c22f77fc2cef52e60db81db29695187cc43d8a8bb22261d2fa7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247930, "uuid": "e49cf848-59b5-49e9-af49-adea90a22735", "comment": "Malware payload", "value": "5efbbbb0e918a71a452e833f48b707f488f11d19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628247930, "uuid": "5aee4b42-7ac0-47d9-bc1e-8f61f8b2d2eb", "comment": "Malware payload", "value": "e31d3a935de9c3dab207c2f165879739b0afcd28d588a98177542389a0cbe569022bf68b0d466dd492a26a6e39757c77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247930, "uuid": "163b2703-627d-46f2-a226-c6c5a2b18717", "value": "T11AD633CC2C9AF573F475027A485962FE01E78CAAD482B18D53437AF540B85A37E27AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247930, "uuid": "d3f2804e-e7cf-47ac-afa4-bed523f94643", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247930, "uuid": "25687fea-a49b-4535-981c-97690f76ce33", "value": "393216:9HSKH8LbZjrLt1WWjS5VTN2SGK7tH12QOypTk+cceSZati4B2:9HJ0Z3af5pNFfyepI+ccH4B2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628247930, "uuid": "181c6478-a677-4c91-97ed-27d46ae6f64d", "value": 13094858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628247930, "uuid": "76a896fc-0c09-48ba-93c5-369ca9254fe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628247930, "uuid": "0697c449-aa26-45e4-81a6-c4524aecd0d0", "value": "a518d438c8f809d03fe68103ac98da91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a292b3-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628231473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231473, "uuid": "209fd1ed-ff61-4d8a-ab32-a3c01a004947", "comment": "Malware payload (SnakeKeylogger)", "value": "2657fa141ff2e9e0ff7c8d1412814333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231473, "uuid": "6121cf45-6eca-4216-820c-cce77981a85d", "comment": "Malware payload (SnakeKeylogger)", "value": "b96e2add8b9a663566f740d06f882ee0147aab444bb026c9d1ce6998927f3d53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231473, "uuid": "379f486f-f894-4baf-8faa-601cea45d26c", "comment": "Malware payload (SnakeKeylogger)", "value": "0ad4496686cc778fa6964b2833dc030165580dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231473, "uuid": "66ba5d8d-78a8-4d71-a26e-22dddaef8206", "comment": "Malware payload (SnakeKeylogger)", "value": "877f17c2068a2456a9c0a862af53159d7fd2b617892b1e87bef96e0b2f1fb325477782eb810f1834532713424df91e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231473, "uuid": "92f59c52-187e-4de6-b11e-5e4748e809ec", "value": "T1A005BE90E685AA06C59818BF0F3DF67057EC9D8B0556C1813DD8DE173BAAEFA09C35C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231473, "uuid": "0b725ad3-8c91-4ccc-bcb7-6daef2b050a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231473, "uuid": "39d86dd2-93e3-46c6-9410-52e923bb2cb6", "value": "12288:9c59OK1OnRHhQCcHzV1HDV0OwboeQ1jwt2NjFqOl2K:9WERHhQNHzV2MegjwMNjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231473, "uuid": "7c2cdc9a-4716-435e-bfa9-2313acaa243f", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231473, "uuid": "cdbec31a-5eed-4e43-a30f-9ad0c65b807a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231473, "uuid": "ac67addc-3fca-4e45-8a4e-41d3c6c2bedb", "value": "ZYJY-2021010007.DBLF0445+446+441 \u7f8e\u9633+\u7eb3\u7fd4\u8f89+\u4f17\u6e90 2\u67dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a8bfd6-f6bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628258834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258834, "uuid": "24405600-17b3-41f3-a9c3-fd59ae2dc46a", "comment": "Malware payload", "value": "3fb702b547b9119b013055e6ab325d42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258834, "uuid": "bec4e90d-1d04-47c5-b284-6c3f479a9566", "comment": "Malware payload", "value": "b991180002cb05f0b8a6a7c1172731b157d0044bb9f3b16a3c419083263fdb39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258834, "uuid": "3d020483-21a1-423e-ab20-d17326336191", "comment": "Malware payload", "value": "e756dfa6b10c7fc68045cc1ecd4512ff65703477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258834, "uuid": "07eda87e-9b5e-48f8-b26b-ff0ce5010aa2", "comment": "Malware payload", "value": "f13a9f747ffea2b74eb8635c5a2d1dcde8226f2907024ec9f97ff9b2ed404a2f96b27626883adeeea40bc3b98b78a471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258834, "uuid": "d55a6879-99e8-491b-8dd0-29040b409ac5", "value": "T15B4391645688B4BDDBFDCD39A4371E1AA264F03C01D56F2B009276CE9E4B7D26D1B20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258834, "uuid": "ac8a737c-9393-49f4-b13c-6ea86fa06438", "value": "768:S/MhdtZ2bLhZ+IOqSbRDTYA3ASu4O3Vg+CgXy7L383:0xhYDT7ASup3VXCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258834, "uuid": "23b34ed2-99e7-4dd6-b574-a101f10f40b8", "value": 58288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258834, "uuid": "b6caed07-3357-40db-b9f9-384c99060181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258834, "uuid": "82a352d7-dbb4-41fb-84ef-5f1941cbeb6c", "value": "5fcc50.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f013cb-f685-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628233751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233751, "uuid": "641140c3-5b34-4831-8ef6-7b766ba35c71", "comment": "Malware payload (Formbook)", "value": "3856ef031167c1b3a0e0a40674bd42f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233751, "uuid": "e7b8aa9d-5573-46d5-83a9-4c3faf7e8005", "comment": "Malware payload (Formbook)", "value": "b9e6760d4d04760b495e95fcda0eb6c070046617730c7066914563679cce68bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233751, "uuid": "6820b94d-03b8-40fc-ac01-481b0c76321a", "comment": "Malware payload (Formbook)", "value": "728e44609c5a0852dabe23d019b5cf3b3f25f739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233751, "uuid": "e747b5e9-677d-44d5-9907-188f456d2591", "comment": "Malware payload (Formbook)", "value": "86a6c5fb041e01944bdf2b7ec291a63b29727e3716e09f4e8fd69fcdde27f5af64f6b10c02482f0cd06fcb6b0f18a60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233751, "uuid": "6579f92b-de6d-476e-a339-ce79bbe08add", "value": "T18C15AD602EA953D4E1BBAB3406B2514187F7FD3FD616CB8E2C64305C9B72682CF12B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233751, "uuid": "69f459f4-2659-4dea-8dbe-1d21e41e4c5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233751, "uuid": "dc6151d0-f6be-4f2e-9260-05d6e314e007", "value": "12288:hRcaQxt8mvZ0ZbgDPwFVt2NjFFdqoeACbp9nJIx4bZovgff1R5vdP3xEBj2Kn23e:oxcb0wFVMNjlqgCdQYHdJAfGkTCNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628233751, "uuid": "1a269c7b-2d57-465f-9339-b58a71c6b648", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628233751, "uuid": "87e6f2c6-ef61-4e50-a812-580429f3b561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233751, "uuid": "9ecb8573-261a-449c-9cc7-baf6a74070d8", "value": "Pipeline operations equipment (Valves,Pipe Fittings).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab443fa-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628231723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231723, "uuid": "b1d38e5b-9210-4b69-98b0-cc55e4d390bc", "comment": "Malware payload (Loki)", "value": "946412a08526cfe67ead0f79b90fe86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231723, "uuid": "e9cff4db-136c-49b1-bec5-316ef7bf289d", "comment": "Malware payload (Loki)", "value": "bc983b2e86ff88ab133c447395fb0caac565d33e7655c2671d1dec948e0bace8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231723, "uuid": "bab2d950-8c3d-41a9-99e5-c834122bfa66", "comment": "Malware payload (Loki)", "value": "663aaaf472a44c54ac38210054319a008079c9ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231723, "uuid": "cf6475dd-e93b-4334-850d-1b00a14dfb5a", "comment": "Malware payload (Loki)", "value": "84fb006b0cf6d28ae58c056bac93385e0001adc9830774e65ad2a31026af38b34befce6ac504bad2c1a0d199ca88098c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231723, "uuid": "4d5d089a-74d7-4d1c-adea-f2f3ad915e7e", "value": "T15134024E854DB761DF38C0BCE3139878483DA5BFFDB059AEF9942DA2520A601DB2191F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231723, "uuid": "23774635-f4d9-465e-8b43-e9a4d50d154d", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231723, "uuid": "034bf805-5fb9-4e0b-89c0-2278cc19675e", "value": "6144:dbCpn2vWgRs+Dniz2Gu0QiHhp3Vy4WULFA:YJ+DizRQ6jLFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231723, "uuid": "a2d81903-5ade-4f2d-8df1-a7d4f8c3d92c", "value": 234702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231723, "uuid": "818dcd28-1005-4062-af51-1199534f840e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231723, "uuid": "215c90e3-0988-488f-a6a4-861a63da91b0", "value": "946412a08526cfe67ead0f79b90fe86f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1493127-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628231466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231466, "uuid": "837d86e1-8748-43aa-bcb3-9a6526cb4a0f", "comment": "Malware payload (SnakeKeylogger)", "value": "3a151754c2dabd64d43dadec97a51dc1", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231466, "uuid": "33ca3ace-4b5f-44e4-b8bd-5c1cef6c77fa", "comment": "Malware payload (SnakeKeylogger)", "value": "bca3eddcd3c7c1f1354298508dc3643b4cb2f62e8bcdbb6cf87b6814c5db7e98", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231466, "uuid": "69242ca8-6e98-4b27-91b4-0d57cf1a4b27", "comment": "Malware payload (SnakeKeylogger)", "value": "b292fe0ede14abc8e032d3cc75bee2e74770e175", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231466, "uuid": "3fa7ac09-76a6-4303-bcad-434abeb422d9", "comment": "Malware payload (SnakeKeylogger)", "value": "b0db04bb2e77b53b6d282b34b09fdcffc7c97cdcbd82fcad121fff440129e6bd4a60cb8cc48077de06bd7d013f7f0f34", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231466, "uuid": "28dfd8a1-8b6a-4d7f-9679-abadc2df6daf", "value": "T114D43339CA9FC1A582C8AC874C1897FD6F635994BE1D17599E377A30EF6A4E030044EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231466, "uuid": "d0ea53ef-9bbd-490c-bdd6-8fa8bdfbb03a", "value": "12288:Ti5ePHoAjmCnRrBYa5n3U8iAuhNXeRe9deLA6IkX8sZtY0d:TBPxiC04nk8iAUORe9YU6FZvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231466, "uuid": "5ce2f0eb-c7f0-4293-ae8b-7615c36d74c3", "value": 608001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231466, "uuid": "3d295077-ba1a-4bea-a1f3-f95148ad7975", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231466, "uuid": "52545409-ed23-4c3b-b4f6-5bb6fa02c4ed", "value": "ZYJY-2021010007.DBLF0445+446+441 \u7f8e\u9633+\u7eb3\u7fd4\u8f89+\u4f17\u6e90 2\u67dc.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e90aa1-f67b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628229593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229593, "uuid": "55b8633d-0f23-49ce-ac51-d35a906d19f3", "comment": "Malware payload (NanoCore)", "value": "b763e8ec664271b409bf74c856137f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229593, "uuid": "05721768-0216-4bde-9496-6f95f7535507", "comment": "Malware payload (NanoCore)", "value": "bca7d4635b7130251ca3ca66b199519e3a9fd4af9c3ab13f346f0b487a940757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229593, "uuid": "bbf2c38a-053a-4080-96b0-8806f3753c00", "comment": "Malware payload (NanoCore)", "value": "2465cab89835d6faba678dac336880cd500a254c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229593, "uuid": "1a0ff6cb-6662-4260-870e-9e7d300b1eeb", "comment": "Malware payload (NanoCore)", "value": "fd1fd4011936ed4e89a307ebec3d43f2a8788596dea28a7a39e80c7f0f97ed20fb0b72c71142f5de7b6dbe8461d2ca9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229593, "uuid": "db0ec11e-bfad-4576-9556-3c0ccefa9f2b", "value": "T134F4022572681B65E43E17745671001127F0FC0A9B27EB5EBFE4B08A4AF376A43DBB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229593, "uuid": "338af5c4-e329-4d15-88b2-9dbf3b9799ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229593, "uuid": "fb92373e-e362-431d-b14b-9edb6ff41db0", "value": "12288:YoJ4dw8RXgSXTzwG9BSUXojOVRbZV8QFyUUI8fuIaqxa11AWm8hdt2NjFm:oxxgGIG9IIoKVFhj82Tv1hm8HMNj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229593, "uuid": "d70890d0-7fea-4385-88f8-c45242b96309", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229593, "uuid": "a74da1a7-4344-4e4b-9812-806d70a624ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229593, "uuid": "99650fbe-94cb-4ce7-a0ae-2094a2cad8a7", "value": "BOQ-DOU-2021-09-02.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c635774d-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628257190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257190, "uuid": "2304e29e-70f5-45e5-94ae-b12ca5a39598", "comment": "Malware payload (Formbook)", "value": "e665299c5f3a510ea38b8d827cbdd156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257190, "uuid": "9bd961c4-d359-4fa4-8fea-3f624b74f3c0", "comment": "Malware payload (Formbook)", "value": "bcec959aa0f7a8d36decb8a12184595ab7b9c4c7451e54b03de0640b0cf6474b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257190, "uuid": "045ecbd1-0159-4c89-b6d7-86525ca9f8b6", "comment": "Malware payload (Formbook)", "value": "3fb73f7982ddb0dd61da7b18315e1eb5415b0a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257190, "uuid": "0a5ce140-c1e7-44af-aff5-4254746deba7", "comment": "Malware payload (Formbook)", "value": "de6a9ba98486f6071caf44a3380bb809a2c7dedf52d5cc53d08c5f57996675f8eace9d78ec45f3a36b1bd8bf0c3c1ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257190, "uuid": "57a9f068-8cca-4cdb-9662-7fd91d198e51", "value": "T14964F107B1D08079DD3259729890D5719F2FFA221769CEEB375C222A4F680E35D31FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257190, "uuid": "b3f1455a-54d6-4969-9f84-1159072076e0", "value": "eb692bcafb7844ec23ba375a9c36b95e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257190, "uuid": "d6dbbca8-6188-414b-9eea-f64ead772067", "value": "6144:VfAn+VymyRPDzUFXtJHF+4yAi/yFB5PHruTwLGxLizt9kEl/xKuooYKDO:VfAOBYbzUFXty4yMTyT60GjkEl/xaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257190, "uuid": "c0a64013-5897-47eb-94fa-5e93304c08eb", "value": 307804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257190, "uuid": "b680aa7e-b5f9-4762-bef4-61f74a6f7a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257190, "uuid": "1b10e068-8f5d-4063-9762-5d0342a342dc", "value": "rooming list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eeedb0-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275638, "uuid": "50d21b04-359d-4169-b3a5-2bdcf6db5ec7", "comment": "Malware payload (Mirai)", "value": "315619b72df86fe9ed6b5c594978383f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275638, "uuid": "3ea32c32-c6b7-4d13-b564-29251d8d4cc6", "comment": "Malware payload (Mirai)", "value": "bcf607a1df9d56703d21ce30dfd818f231304c3c3643fe0ca5e74fc5433401f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275638, "uuid": "df35f811-d0d8-421e-b15d-0ac877044ae8", "comment": "Malware payload (Mirai)", "value": "17332534d3cc48034c5d556637839c1f6a312405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275638, "uuid": "20ce9477-a4f9-40c5-b5ab-848a5e399b34", "comment": "Malware payload (Mirai)", "value": "4c04e9d2490cacf6a7a45e28bbebb2ada289ea3075c523a3b20814d5e2b46cf17a0fe9fdac2c2eff7142f9057c8bdab0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275638, "uuid": "d2930292-7c9f-4302-bdfd-a1823e310c34", "value": "T10AF2F1C0933E0871E33A9DA246CD83F88734284514EAD92EF5BC15CB4984B7B29D4A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275638, "uuid": "042373bc-8cc8-4eeb-b3c2-40c6bdad259b", "value": "768:fceAn9uG0RDde2X1n22LgOWtsMxZ4qP4AlbZ100Z5q5Dzo+w/ao9ZC:UH8Be2XxmtsmZ4CFl9r5q53o+oaojC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275638, "uuid": "3447cb18-5c21-4a65-95b7-6e39f70a67fb", "value": 34260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275638, "uuid": "edc6a23f-7fb5-4dbe-9d25-4cc5e97134f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275638, "uuid": "b2bca19e-3b99-4b94-a0ef-e11619665fdf", "value": "315619b72df86fe9ed6b5c594978383f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba47970-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628257495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257495, "uuid": "53c5df07-eda9-4dde-8a8e-195aee705618", "comment": "Malware payload (AgentTesla)", "value": "79076256e795c9399e830f1e4f0fe221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257495, "uuid": "55a1dc2b-55b0-4ff4-88c2-4948ef1a867f", "comment": "Malware payload (AgentTesla)", "value": "bd0328f6be16f7c73f39a16739960a069d4812943cfbc93000bbe2a3eed45039", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257495, "uuid": "4598c4a6-efe2-4c3f-b2b1-54b7b2eba8c2", "comment": "Malware payload (AgentTesla)", "value": "6bc1068223a0238b595bc6b9e145be9aaafea085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257495, "uuid": "ef48fe39-485b-4596-a969-f7b73178b394", "comment": "Malware payload (AgentTesla)", "value": "083569e0afce281646b11f574f66f92a0a55f528421d4b35b18c66a9d9ac269d1852413ce19e076fdefcda1171a95bc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257495, "uuid": "09d74aba-33aa-46b5-9727-1a21e23d28e7", "value": "T18405E1113641C812D6BB5632CDDF80044BFCFD8536A3DF3A7D9E32AE4A62362A9465CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257495, "uuid": "a29f3036-a933-4c12-a7a9-28adea7ea89d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257495, "uuid": "1c735fd0-3068-448d-a7a9-8f6d61157e42", "value": "24576:6DszipydeIp80Mk8+0aDcWN+fKQYMNjJ:6w2HZ0T8+FDcWN92h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257495, "uuid": "c45580ba-425f-462e-8ec7-ef62271e8e33", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257495, "uuid": "f2d613b3-37cb-40c4-89dd-53b83b9ce05a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257495, "uuid": "91a6a69e-b011-4321-8502-e85981148d20", "value": "BL#TELEX-SHIPMENT-POC76120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6bb8e8-f684-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628233637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233637, "uuid": "974ca65e-bd0b-4ea0-82e7-605c1ea84b14", "comment": "Malware payload (AgentTesla)", "value": "d407e86fb5c5596f51c80d08c5bce3a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233637, "uuid": "28ff3385-ced0-4bb6-8d87-c98d9d20b8a4", "comment": "Malware payload (AgentTesla)", "value": "bd3546f8e551a2a3aacaf46a51f8887a43fae6e0b4ab1ade4f83eb5a890fb4df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233637, "uuid": "6a7e70e8-1ca2-4430-8e3c-a8ccc6e98e79", "comment": "Malware payload (AgentTesla)", "value": "50babfe7cdceec4b84007f163d57aa4daa2a5e95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233637, "uuid": "1042b3ec-9ae0-4aab-932b-7c9d48918adc", "comment": "Malware payload (AgentTesla)", "value": "e4232513584c25457b85586cfdd229019a4f3d02aa1415468358b8c7f1371dcce453aeeabc33a0a94790c6999f0732dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233637, "uuid": "bd7d076c-207f-4dcd-a2d8-f40ee2d65452", "value": "T173057C2229EB154DF3B39BB54FC4F8BE5AEAE577570AB0F638910B468322940CD51336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233637, "uuid": "c4aaf6c8-3fe2-4cc4-ab3d-c8457264ef77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233637, "uuid": "a8f13133-dc5b-42aa-a08b-ab8fe4468e18", "value": "12288:EppoR65AXwgFvuSSYhU6TzcYYpRVBLoeg4PJoyatlOGxqF5/9wLaT/DhDNBxqN3g:ipoR6qgGYpRvkeg4PJoxC2eXIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628233637, "uuid": "71fb669c-b62f-4bd4-86ca-445783112398", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628233637, "uuid": "9e53d4da-d179-4008-8f18-1f430416de7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233637, "uuid": "e453fa94-a4e7-4a03-8a65-c39225414e52", "value": "d407e86fb5c5596f51c80d08c5bce3a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d45681-f6af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628252027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252027, "uuid": "1a3dd131-d224-41dd-8c57-679b0572f7c4", "comment": "Malware payload (Gozi)", "value": "43d74eb8c998618aee07aadd58ba37d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252027, "uuid": "bb6e35cd-c9d9-4681-b13a-6d06480608a1", "comment": "Malware payload (Gozi)", "value": "bd77d709b24021b670af69667acc4fbe5e996c1a70f6f4ba6fb65574b1626fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252027, "uuid": "bb742d2c-7d62-47bc-bd24-ec08e82f0d0c", "comment": "Malware payload (Gozi)", "value": "46102f142e141cde981769ac232e1d8654b20a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252027, "uuid": "0ca28a67-d53b-428a-b779-0bcc2194858e", "comment": "Malware payload (Gozi)", "value": "0efded6a2f593431d7ef1cc78da8999fe3bab4f3a697c75cc21faab225d36f002e482ab996af7628e6e6a4a0cdcd5586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252027, "uuid": "7ddaf951-37e6-49c0-b3e4-b84f529c6518", "value": "T166346D6AE2A41A95FDBBD5B9CD93C617D7F234090A64C34F23B0CB965F43321B218396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252027, "uuid": "4bfe6bb2-009d-4d52-a920-0c8a03964c7c", "value": "6144:arezMySF6ymJNNDgq2L4LlcwFhR2hMX/DWEWk4SDFr:arc4FxmJrr2LicwlcMX/DWEWCDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252027, "uuid": "121c888a-0ad9-437f-a6c4-ce9f06a4cb66", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252027, "uuid": "ae862c6b-c34d-4f25-ad63-af6fe23ecb64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252027, "uuid": "65485083-dcd3-4ec2-b0e0-d0084c692d42", "value": "1fe96480000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0ea849-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275373, "uuid": "aabfaad5-8ad4-4542-bfa5-b2254103b9e8", "comment": "Malware payload (Mirai)", "value": "5d52322babc50eccfe918c154ea179b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275373, "uuid": "9a62458d-7c0e-415c-b5b0-fd66d217e557", "comment": "Malware payload (Mirai)", "value": "bde88cdc7ebec7a449931891fa868939d81127049f2d243ae0c6600355c05bf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275373, "uuid": "008f01fd-94aa-4937-a2e1-24e3c9a49e64", "comment": "Malware payload (Mirai)", "value": "ac06cb8db8afd54b3ffb435ac9ec80039f347afb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275373, "uuid": "17632e30-6540-42a2-9c74-9a807ed0bfe1", "comment": "Malware payload (Mirai)", "value": "f0df40f28107832456dcdae31de8f1da0d62426a341fe7affaf8024650efeb1d77c8fc311808da0c8a5657fc003a55c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275373, "uuid": "b6291840-d2bf-4e99-9fe7-904180f9e84a", "value": "T1AD03E12D6305B635F678C6706CAF31EE94133E119EE5063047B208D0283D9A1A97FBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275373, "uuid": "81a9957c-b76f-42de-ab47-719aa0e166ac", "value": "768:2zyNZ7VaZPkWQh/AnC1H/B7SpxgLtcx+Gx6JpgoBb9PFsNTqG8z7w:28Z4uphonCt0MtcPx6JtaTqtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275373, "uuid": "0f8d289b-20a8-4ee4-bfae-dbca4c29d563", "value": 38208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275373, "uuid": "a0c21885-76ae-422d-be70-5abce68b736c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275373, "uuid": "2adc310f-6afe-49b8-b0ba-78557b571801", "value": "5d52322babc50eccfe918c154ea179b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b8124c-f6bd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628258075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258075, "uuid": "8803e5bf-617e-467e-a800-661834efa52b", "comment": "Malware payload (Formbook)", "value": "442d2d8a7820a1c0c0ba418476d67fb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258075, "uuid": "e537c0e5-9395-4e98-b594-92b04e55fc59", "comment": "Malware payload (Formbook)", "value": "be6c146acab77dfb4116c0805a1244c79a5da7393ce8ee582f59ae8c1773e406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258075, "uuid": "d06fbeca-34b2-4480-b773-197111fcc54a", "comment": "Malware payload (Formbook)", "value": "97ce48bc5177efca1214d82aec85049373fe4671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258075, "uuid": "00b5c692-0bcd-41f3-830b-c41be2f32bbb", "comment": "Malware payload (Formbook)", "value": "39527dc171dc337718dcb1d74f23d20ee773d3aa91d8cbcb32a9b66369c64da8668014f1f3bfa4d0e0146160bfd8ff05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258075, "uuid": "d87f8be0-95d9-4790-bb91-828499f3b609", "value": "T18CE49E92F2A10873D6626A3DCC0FE7BC9827BE512D2576452BFC3D488F79741362618E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258075, "uuid": "edf669f2-3b6c-4ff6-8b03-1139f50d7c9a", "value": "a09d64195bff556eb90ba4781b170ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258075, "uuid": "95e9a0a9-2147-484e-a13e-04e9126808ae", "value": "12288:NlyPhGe3nf8jHmf/3AwhgFn33DdzQwcApa56Q0uGPwNfXA:NAPbaHLwh2nBZ6ouRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258075, "uuid": "6a6425a9-76a9-41c6-a580-398a7efa8a49", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258075, "uuid": "26a63cf9-5eec-4865-8be1-03109d022812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258075, "uuid": "c47fcdba-1ca3-46d4-98cf-97fb9a8f8492", "value": "442d2d8a7820a1c0c0ba418476d67fb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82260a81-f67e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628230877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230877, "uuid": "f2ce5cff-1160-46af-91da-8b5442b9e554", "comment": "Malware payload (RedLineStealer)", "value": "9b12418cd4f0d326aa18a1ed91c34099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230877, "uuid": "396c615d-2dd6-41f7-9da3-60bb9e9932e3", "comment": "Malware payload (RedLineStealer)", "value": "c0609ec67769d456afe7af414a63ec9c5ccb58a00d897524d4fbd8178711ecb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230877, "uuid": "077de2f5-3b7a-41e5-a498-d038993b1242", "comment": "Malware payload (RedLineStealer)", "value": "47e6a9d7ad43f07ddfbea7ade1dd28a72777d420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230877, "uuid": "40ab77fa-73f5-4610-bb6d-73f56d2592fa", "comment": "Malware payload (RedLineStealer)", "value": "a655c6434c26fe29bdef6aef61cf2fc08cf150a50b6d54e7e0a5e4d2a40041eb2f77e009b0b7ec142215e42c94bf8ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230877, "uuid": "9a3acfb8-7043-4089-8095-660386132f49", "value": "T170B40141F75E61B3CD6901F0409217064BB161363462F2E62ECDA2EAE6C5FCBAA417F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230877, "uuid": "26045c30-9e34-45b2-a83d-e29fb1ebcbd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230877, "uuid": "1305cd83-a70f-44c2-8f4d-13cc3e4c45c4", "value": "12288:/0rk68hlYhNCkwSL4XRgfG5imsMYsetK+PVFd:siSCksgfus/sQxtFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230877, "uuid": "408d7430-408c-4f7c-9ed8-7ab91dfdbcd6", "value": 508624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230877, "uuid": "6c0540f4-7fb9-4727-a5e1-f905973d7a74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230877, "uuid": "f0aa6cf1-39f4-4e40-92aa-2ab82093f50b", "value": "47e6a9d7ad43f07ddfbea7ade1dd28a72777d420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5e5b7d-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252342, "uuid": "22d3df12-3b0d-40a6-9881-1d7f81f2fb87", "comment": "Malware payload (PlugX)", "value": "e1a8e6f7d491a137584b40ca852494b8", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252342, "uuid": "5cdb32b1-53db-46ab-b9f0-6bd3103cebfd", "comment": "Malware payload (PlugX)", "value": "c09d86efdc1486de2dd00fdc8900ee9efc307017369b3900ce7b35e708dfcc50", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252342, "uuid": "a20fbc74-0930-4ccf-ae41-f4cd34e890c0", "comment": "Malware payload (PlugX)", "value": "d7267ef81df252efe517e43730863739720c5d38", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252342, "uuid": "5812fdec-4c29-42cd-80d5-346e4936b2b8", "comment": "Malware payload (PlugX)", "value": "b314f54124afb3672a20d23b3e302ea22d0caf129cea789ba0d5492ff0a0fdc2bcf28295970e5b43215c9bf65270dc3f", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252342, "uuid": "6dc940be-a2a4-465e-a38d-ff5d636c8b80", "value": "T10ED34C48F541D275E87F40BD1BBCAE0B172DADA5871806DF37C058AD7991CE26E38E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252342, "uuid": "2c7de0bd-acff-4a4a-96a0-b558e9f6927f", "value": "2d4775b7b89703e701e20d373dbc259e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252342, "uuid": "30f20b46-0cd5-42b4-8737-2004c0269fe6", "value": "1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uI:5sURE3VW8POLwlKb21uRYCuLMF6ejk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252342, "uuid": "09397699-7f32-4df2-bc2d-5bb880e65da7", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252342, "uuid": "a8815554-3c83-4c49-bf53-47ff6b88c806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252342, "uuid": "c1ac630d-d4ae-408d-8e2a-01687967bcc9", "value": "c09d86efdc1486de2dd00fdc8900ee9efc307017369b3900ce7b35e708dfcc50.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1e5d8c-f68b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628236642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236642, "uuid": "e90c03a8-1da2-42de-b5cf-91bacb753644", "comment": "Malware payload (AgentTesla)", "value": "17ad6aa820589c091482a239b7ac8ed7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236642, "uuid": "f5806115-f49a-4746-addc-bf39b176e171", "comment": "Malware payload (AgentTesla)", "value": "c1429303621a21dde308369b2c19b782b5c8c23e8993a2dd39f73ce119c60dd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236642, "uuid": "52e682d1-8fec-41e0-8288-994a20d2996d", "comment": "Malware payload (AgentTesla)", "value": "b81d57e8e20fa999d2ac988ae59d6e4db9e92457", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236642, "uuid": "97cb26cd-f8c2-4e80-8ea4-55d31a183f87", "comment": "Malware payload (AgentTesla)", "value": "9bae7cae74060dc8308feba6c5017e4d08e275ec745d7b55e6d398b8b21826d1b51b4c4ad546d746bc796413718b985e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236642, "uuid": "7be48944-8329-48b4-aa67-139a94746c1c", "value": "T13115CF90E580A616C59818BF1F3DF6B053EC9D8B155280812ED8EE573BAFEFA09C35C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236642, "uuid": "ee8c1bd1-e48e-478f-817a-cd76bd88247b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236642, "uuid": "ab29f25f-f8bb-4dd8-bb73-4a5847153e2f", "value": "12288:Dk9UkgDFmOnjGSzH0ib/cTg6Ze5Vc6zzRTXafTvQwE0jcYZWs1jst2NjFaOHeF:D2UFLjZ0ib/c/e/c6H8EocrUjsMNjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628236642, "uuid": "7558d376-f7f6-44ea-92dc-e67945c1f14d", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628236642, "uuid": "5f814bfc-5d09-402a-890a-c23cfbf727e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236642, "uuid": "34f46d17-f581-4fef-a1e6-e611b7995af8", "value": "PO #DSTO45789357382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8b9d2c-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628226813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226813, "uuid": "d1ef6625-1f9f-43e9-920c-9e9c94355c06", "comment": "Malware payload (RedLineStealer)", "value": "3f4ce1522ad3b1d6b7c765d7a675b70a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226813, "uuid": "c2f52027-abea-4a83-b295-70edc6a6c426", "comment": "Malware payload (RedLineStealer)", "value": "c16894021a6ec3ba2a4657a255fba1541a23fde8117e1377e1684e06bbac5c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226813, "uuid": "f75e8f54-9b36-4769-a0fc-07d64dafa1a8", "comment": "Malware payload (RedLineStealer)", "value": "dfdaabb6321606580a5292e471d61edde0eeaab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226813, "uuid": "6e8b3608-021b-475d-aed3-b7120438d167", "comment": "Malware payload (RedLineStealer)", "value": "939299a070f28f580587e875f1d49249e23926b854bb4936d34ea00fe7e31c15b426bc34f55d79a5735276c5ab95bf32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226813, "uuid": "38d2898a-a7b0-4d83-8bc3-ff3a6e8ab79f", "value": "T14D551F2868BFC019C0E3EEB12DDCA8BBD99A55E7640D743701B4632B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226813, "uuid": "6be7fae3-ec04-4e14-a094-63a0d9f6ebd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226813, "uuid": "59d46d5b-26d4-4cf2-bdb1-e6c3d5e41add", "value": "12288:xIM4E0bKSaYpEU/EDmFRTQWI3Oca7CaokJG:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226813, "uuid": "cd878d7b-f877-4362-bcf2-958b3e6ac051", "value": 1379903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226813, "uuid": "045b1ef3-fc7d-4301-aa75-a88587b86dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226813, "uuid": "5af191e2-9af0-4f92-bcf1-319c4edb14d5", "value": "Vape Patch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db6de92-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628231729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231729, "uuid": "0bdca8a5-eccf-4bae-84dd-190214d3715a", "comment": "Malware payload (Loki)", "value": "e19ee8eac3b2af0be52706b024817fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231729, "uuid": "d1f015e3-d813-4484-a277-cb2de9011f12", "comment": "Malware payload (Loki)", "value": "c2a568e116a85d6085f78797c6906be3986236bdebc72c8e50638798aed60503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231729, "uuid": "956e6d95-baee-4666-9345-415f5802bf5a", "comment": "Malware payload (Loki)", "value": "d03d76cda18c45f7f49b3498ae969c756731afc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231729, "uuid": "6374fe57-b3ba-4a73-a1ec-6c27b163cd39", "comment": "Malware payload (Loki)", "value": "1712277088eb7e9e6f89453f46b7a82311fc35f4883f931ebe132057d5baacc84c46bf9ea9ce6ca95ab7d87283bb6192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231729, "uuid": "08bff85d-1302-4bb8-ad94-b16d995aa854", "value": "T1523402AA7E51CA39FF37CC3AFE1D92913535E0B10834015BADE0671DBE6B4011CE5A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231729, "uuid": "6501cb83-33ec-4c01-9a5b-707a726f48fd", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231729, "uuid": "b70cc761-62ad-4f9e-b25c-a450633edb25", "value": "6144:w7YcPTywCS3SucakhyFP2tlh1pOnlRbvr1ECXYfq:YywC/vauLtlAnPbb0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231729, "uuid": "ae032d70-be00-4b79-9d8e-5f268591d8f1", "value": 235786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231729, "uuid": "850f87dd-864b-46b3-8f3f-7389c5ed5536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231729, "uuid": "0b982ed0-7943-44c0-84a3-b9765026ed77", "value": "e19ee8eac3b2af0be52706b024817fae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b295a5e-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628257065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257065, "uuid": "526cb776-7019-4c26-b0dd-ed83211d6ad8", "comment": "Malware payload (AgentTesla)", "value": "c9603204eb7a63846f956198e78f2a10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257065, "uuid": "44f1acfe-1ebc-403c-a8bf-f97eb22cc6b8", "comment": "Malware payload (AgentTesla)", "value": "c3c35aa52c8ca93f877ba4226099a1c5a70b00fad1fa0657b48b03f65faf1dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257065, "uuid": "1f980511-c1dc-49ff-b767-407974726544", "comment": "Malware payload (AgentTesla)", "value": "534114146ec402c8a9473ca9bbbcdef6c7b3b38a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257065, "uuid": "6c50fe8f-07a7-47fe-ad38-3bc7c3f34c55", "comment": "Malware payload (AgentTesla)", "value": "9f7b50afa807a87f19d1e7b970314af309d3eaea2900bc2d8512c9341b4c208055f0a9afe7d065333077b7443ae0be75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257065, "uuid": "745e423a-d4a2-4469-8d39-4659ae7881ca", "value": "T11E25CF2DFB64BE58E9991DB78427440866E4DA636337F32F2DD83DD01433B2A4E4E162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257065, "uuid": "fa6893af-bcf6-4650-b716-6bde55e64086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257065, "uuid": "66401cce-7040-4654-9a18-0259d05529e5", "value": "12288:sqAfFAT1XtswK9rmO7QeFIsAjucAnJa+Z66GKQE+Jalo8YItG0jc9eQU7:MK9swKsO59c0JarE/awG0EeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257065, "uuid": "eb58ab29-f1fe-41f3-9e35-ada8db4869f4", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257065, "uuid": "2519fc53-0a45-4b20-9140-99b99871fce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257065, "uuid": "96611bf9-af71-4064-8e49-36e23b4c0647", "value": "ORDER-ASLF1SR00116 40HC 21T05 DALIAN TO GENOVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d45bb15-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628252612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252612, "uuid": "3461e09d-ef67-4a93-8af8-34ab6ff4d445", "comment": "Malware payload (NanoCore)", "value": "1571e2fc9c822d46b9ce7fc40bc0e315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252612, "uuid": "1d08c647-95de-4f0f-9378-1fb5076ee987", "comment": "Malware payload (NanoCore)", "value": "c495c20d2765ea6964ab35551a73a23db3d7b4acc4c2c91de430ddb856603a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252612, "uuid": "ea1be76f-549d-4c13-a75e-1e14bbc8889d", "comment": "Malware payload (NanoCore)", "value": "4cffb6ea07a50a0944b1fd58afc482793bac2042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252612, "uuid": "b9eacf34-12bd-48f7-9082-d51faf01a055", "comment": "Malware payload (NanoCore)", "value": "b3faf2cd1e2a4f99766e579bf4a8de4562e7a717bd480c380193a5a721c66e8e66d3b02d12660ec7c1f737eda8099a8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252612, "uuid": "60364e25-17d9-4960-89f4-b98f476a5491", "value": "T13935E0343AEE6308D5BBF770463692404BFAF937D716C74E2C62604C9AB3A824752F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252612, "uuid": "3e312068-1f1e-49e5-9b06-b4cdecb9fe09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252612, "uuid": "d6233cb9-0b4c-40b0-aab3-1136ae4fd6bb", "value": "24576:ZXb0wFVMNjMZz9Rvp3dUGcG+SO1y2XXJvkdMXt1td5:ZXYwFShMNp3dUrhSq7Jv2yd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252612, "uuid": "3c9c22d5-e66e-4d44-a331-0059ad21f762", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252612, "uuid": "81d502de-2075-457d-bf96-70a13dcb577e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252612, "uuid": "511aa7cc-4466-4378-83d9-b75218d77c39", "value": "BOQ-DOU-2021-09-02.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f9ee4f-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628257192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257192, "uuid": "a8111846-4e34-4c05-bd60-e5a3b4ac2053", "comment": "Malware payload (Formbook)", "value": "5d5276be06b293b3fe9f5acf12cf59f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257192, "uuid": "49938d0e-0889-493a-8b77-693e31a79729", "comment": "Malware payload (Formbook)", "value": "c4d1d6a9baaeb3802cfb9f7e21db83b85236844b62dc05f8ed4822e491703eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257192, "uuid": "bf67b61b-c93a-44b0-81c5-dca757999867", "comment": "Malware payload (Formbook)", "value": "beb5812c8d6556ea2dfc0d34c43f2fc9ff0cbc60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257192, "uuid": "7058544a-2805-4bff-a104-bbc9af16860c", "comment": "Malware payload (Formbook)", "value": "e4f481c831c29d1f9283622a539d3520121cee9af69d698dbc16600a9a4806946de1d75908fd0909b41b547e99ba1cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257192, "uuid": "9ba9476b-7e85-4233-a2a7-ea9a4388a6fe", "value": "T18B25BD5EFB84BEA5E45A0F32841B6B4882F9D4635273F3AFA9E1B9D458317064E0F113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257192, "uuid": "322e6266-bff3-4ad6-90eb-ee0f8e7110cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257192, "uuid": "417c93f0-ec8e-40ac-b35f-872c0e123ae3", "value": "12288:IXC+S76gTutc3bsBYxefRoZ7QeFIsAjucAnJD3Hjo1bZ3OC5LOjgFJgHq9meYTeZ:IXC+yNpnwfRoZ59c0JHMeQHJKeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257192, "uuid": "ad0506ab-5fc5-4449-8423-8989ac2112d6", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257192, "uuid": "989546a5-60fd-4a5e-b85f-72c9d0ae475c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257192, "uuid": "2531f262-02f5-4032-9476-cb006ac40e0b", "value": "ORDER-ASLF1SR00116 40HC 21T05 DALIAN TO GENOVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610b1da8-f6e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275919, "uuid": "bdc24b19-e258-435c-8ddd-1cf24c13c2db", "comment": "Malware payload (Mirai)", "value": "67b6d1099ca1eaed5b8e445d06014d55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275919, "uuid": "29ea43d8-f07a-4185-961f-1d601f1efc07", "comment": "Malware payload (Mirai)", "value": "c4e3e639abdc2294b1f58f0cfe3368957c339dc9e93697e34469d454428af6e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275919, "uuid": "489303b5-5d5e-446b-99d5-1e708ae459dc", "comment": "Malware payload (Mirai)", "value": "6752e0baa5d2adbd0620b096bf5f39171e9a24b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275919, "uuid": "051a9d04-7eb6-4655-80dd-dbbc9c299bfa", "comment": "Malware payload (Mirai)", "value": "503a4089d2192450eb5c4f9db6755cf5548902d1830cc7484685b46e23a943f664575839470701029b1b3be90256a862", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275919, "uuid": "a49afbdf-c79f-46a5-b2d2-b4262cc4b11f", "value": "T1B2731825B87A2E27C0D4967E12F78625F2F5330E1470866C7D760F8EFF64694A9062B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275919, "uuid": "6ac16ee2-24d7-499c-ba8f-dad36f40f7a7", "value": "768:C0PoxS4NhbnJTP7bciWwwlCPJzM6FeH3oumEu43QPGsWn9Ldn0uo7lDRLyShkEF5:DPKPbEw7PlM6Fe6LiKVtePxsJcD5Uq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275919, "uuid": "155af545-f443-4b59-aba6-61425879c1e1", "value": 75128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275919, "uuid": "edd095a5-8eb0-432b-9aa3-d9fc68766b6e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275919, "uuid": "f256d0bf-3222-473d-83cf-4ffc6de31685", "value": "67b6d1099ca1eaed5b8e445d06014d55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff2ac1f-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275380, "uuid": "87cebd7f-9420-483b-8be8-12761a7c3f7b", "comment": "Malware payload (Mirai)", "value": "424edea7a6659b6c2ca3067186355556", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275380, "uuid": "2018d83d-b64c-4d0b-8a4c-167cc85e9412", "comment": "Malware payload (Mirai)", "value": "c5f7f6893a5f198eac6f0cfb84ece2248223e5f21569f222895b5c823eb64ac3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275380, "uuid": "0b262dbb-36e3-404d-9ecc-8f9365fcb4ca", "comment": "Malware payload (Mirai)", "value": "4b44d85e572df1d378d0e64614495718cb2dd131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275380, "uuid": "9b92dfb4-2756-434f-b20c-c5d94fbb5f32", "comment": "Malware payload (Mirai)", "value": "11d766fbbad7d875b027b4202cfaa40e1c5b3b718afd0dc226a101e1b0cba2b112afe893cb18b688fa72668ffad94a4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275380, "uuid": "955fe79e-3f0e-44bf-815e-6519b300d8ea", "value": "T1E9E2029DD48CC2BFC4B6CFF2417B24B89915119849FD0B76F96D631A2B230127E41E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275380, "uuid": "4926a304-c06d-4e40-8ec8-062e018aa426", "value": "768:pKubSImXYtxNYupLOnludo1tps0jP4QEIG:hSIiYvnpLOnAdo1tyrqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275380, "uuid": "07add846-b129-42b8-bf95-8239349bed54", "value": 31556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275380, "uuid": "9e23a942-7da9-45ce-b2f9-1e456fbd6627", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275380, "uuid": "4483a84a-2285-45e6-bf6d-520c5305341d", "value": "424edea7a6659b6c2ca3067186355556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85660a37-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628231312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231312, "uuid": "b2a1f700-debc-4c35-bd0a-54d5f51dfe36", "comment": "Malware payload (Loki)", "value": "13cf23e91100291ebc26b409500ebd63", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231312, "uuid": "93f5e406-464a-43d0-8b21-4dae3c1b9d49", "comment": "Malware payload (Loki)", "value": "c6448bb51093538570c2b7aac0eff02b4c0227991ed554b7db66256c2f151438", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231312, "uuid": "1b48125e-e9fa-4f36-87f6-8f80d405866e", "comment": "Malware payload (Loki)", "value": "ecba59f4c0a4117d714f6f9443ad0328e14129a2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231312, "uuid": "beae5589-9f90-48f4-a075-8ba9bb785685", "comment": "Malware payload (Loki)", "value": "e57c4fcfce8ca784271eae6858867750378a3941c5d48b1765ade02fb82c6334a30dfd839a8032a82d97615b23d8a688", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231312, "uuid": "41ccd71b-7eb7-4fbd-a6ee-337e9a3924cf", "value": "T1B9C423BE8E7CB111D534933D8132D2FBE370BAD2038390D5545C1A9CAAEE79E5A2CC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231312, "uuid": "39b37c1d-fe82-4a51-bc54-db7428d763d6", "value": "12288:Un5xsDIiNZwC98PwoMUX4QdMQgCOusxCs2otAyMa:kxsD81X4Qi5HusosPAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231312, "uuid": "56b72082-fa2e-4eb1-883f-6f8d5afaf57e", "value": 549577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231312, "uuid": "a689dadc-32bd-4ee1-9afe-5596d0a31f73", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231312, "uuid": "f61a6a43-dc50-4e40-8884-7b557ee2fb6a", "value": "Pending SOA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c840cb66-f674-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628226700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226700, "uuid": "07c3c8b8-7016-429a-bea7-9b18bbeaec14", "comment": "Malware payload (Formbook)", "value": "d8abd4f86a18863e236bd2f3118344f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226700, "uuid": "7103f0a6-bf45-4535-8479-416c2c093194", "comment": "Malware payload (Formbook)", "value": "c70917b8034aedf54cf578fa9db38399a6129376bc7d06cacd6b324fed45c5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226700, "uuid": "b3eba8cf-7a6d-458d-a1e1-3cdaff0ad8b3", "comment": "Malware payload (Formbook)", "value": "72f6c8df84b627ece609e249b530c2e8bba949fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226700, "uuid": "65cb2dbd-34c9-40e2-bea6-8ba76c44a36a", "comment": "Malware payload (Formbook)", "value": "dbaf76b22be2efe402d5566fe32dbdd1801f075b899e41832038a96e3f253f56de53f31f2ef01ca43ba3d3ad9429ec84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226700, "uuid": "d402b56d-7446-46da-bf87-e61027165698", "value": "T15D15F891B22794A2D402657BAE91CDBFDCBD7C407411329AA2D77A6453F007B2932B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226700, "uuid": "09a04aff-2c6f-4496-ba84-0e95a23e1518", "value": "a27bedaa147286540d08fdf824189cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226700, "uuid": "6a56828a-e63b-405a-ba9b-accd4ea79019", "value": "12288:EghRSVRxnU8yLl6hqTvkUFZOi3Df0nuvVnu75:hQhnUFlSekm53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226700, "uuid": "d9080c35-d8f7-485d-a11d-de5935ad3005", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226700, "uuid": "0a116d25-fdf1-4735-a575-b4cf9988d506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226700, "uuid": "7a8caca4-37f9-438f-b096-802039e27463", "value": "Documento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162d1679-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628226830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226830, "uuid": "cc1561a9-bdb6-4731-b5d7-f497551905c6", "comment": "Malware payload (Formbook)", "value": "3636377f8a772f02bc3747e9aa7e65b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226830, "uuid": "56c569d4-3f3d-46e3-a319-1300a7c40a4a", "comment": "Malware payload (Formbook)", "value": "c7bf7a6c4655e31f42bfee020ea2e939274766bc68fe4d52c64a31d116bf1012", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226830, "uuid": "28581385-3310-43e1-a567-0f67616a8d5f", "comment": "Malware payload (Formbook)", "value": "4a56e3c64cafcdd73dc23df5f8566438db4c526f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226830, "uuid": "ce36033e-10fe-4742-848e-da66259ac2ac", "comment": "Malware payload (Formbook)", "value": "ed137027b54ae305298b4361a6b1d314a610035374baac332497075d7d1223a83d9052dda88d6bd0026bdc5655957632", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226830, "uuid": "f5b7f686-7373-4870-ae3b-013b79de2b98", "value": "T107B4029670281F92D76FADBD1AAA63621AD59ECC8C78DF339EDA300445F97853C07342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226830, "uuid": "010a21cd-709b-422d-8e5b-bf5193281847", "value": "12288:OxdnECUy8PIsAdxk8jBEFmG98MorSVh3fBSxI:oF3kRm682tIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226830, "uuid": "7fbf9efa-2c75-4fa0-8b6a-f42014f8eace", "value": 534296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226830, "uuid": "edbc7221-e87b-4dc8-b422-619f24802969", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226830, "uuid": "f29ffbce-e01c-4ea4-b5c2-4254c2588395", "value": "QT 20210508.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6501ab9d-f683-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628232976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232976, "uuid": "007b6659-ed4c-4260-90c0-79622359c8cc", "comment": "Malware payload (RedLineStealer)", "value": "e4244e9684651daa3d583f5e324029b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232976, "uuid": "f8f5ff49-8628-406e-8c81-0da249e0dfe1", "comment": "Malware payload (RedLineStealer)", "value": "c806b2ab450d3412c4a6a3ccb57a54ce112072ae70367a4d86a23dd9128c6da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232976, "uuid": "c175f88f-6c94-4bdb-9654-62daf33d62f7", "comment": "Malware payload (RedLineStealer)", "value": "f978f7449fde3b4585309aec7ad1d7b2783addd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628232976, "uuid": "1b09fcba-f155-4b87-bb07-abdb734ce08a", "comment": "Malware payload (RedLineStealer)", "value": "1135c974364288cdcd60269ce1f1065d322d7ff36a8531106822264799a4c53f1ee457829d199a2969ba4a9dfad04501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232976, "uuid": "e83ef7b7-7c76-4bec-a826-a1a12e5b6632", "value": "T18C84DFA0B3BA511BDBE723F1D495125457310067BC0AE2E35C96A2B8CAD5BCB7D0E0E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232976, "uuid": "11a0f5be-ba28-470c-b946-1cb75ebc7b53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232976, "uuid": "13eaf3dd-ef32-4829-98db-9c2f291f621d", "value": "6144:KWaqflbkV08tDlfxai52zwKOiLq6MhqHlqgbzlPBIAUEPIl6X6jYAV:Xk68hlfB2k7i26M4FFd5hUo6c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628232976, "uuid": "a967ef06-2e8e-4226-a279-df31df27d76a", "value": 389872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628232976, "uuid": "4a848b9e-c503-43da-8f50-d5b6d870b2e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628232976, "uuid": "fb2e3ab1-0f1a-449d-839b-fa5e508d0ad7", "value": "f978f7449fde3b4585309aec7ad1d7b2783addd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2114dab-f674-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628226770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226770, "uuid": "b1606b31-dadc-4cab-abbb-33d0a8a90dc3", "comment": "Malware payload (AgentTesla)", "value": "505c3df00817113b98a4ebfeac89063f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226770, "uuid": "ce1ba66d-e72f-41bf-af82-7488e930d109", "comment": "Malware payload (AgentTesla)", "value": "cb4ad208cd7b22277225b548a4a83b63daa0090070103a263b65b512dbe2884c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226770, "uuid": "8ff5d318-21eb-4a12-ba9a-3dd8ce39320d", "comment": "Malware payload (AgentTesla)", "value": "4d12984ca26fbcc76044fcffaf22e036d93903e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226770, "uuid": "16800ab8-e203-40a8-9fc4-2bbf36a1f308", "comment": "Malware payload (AgentTesla)", "value": "6871fded1ad85fa36d1defe1d5ce33dbdca6d7446584c7c79563f424ea2620034b7605227f11504df5193fbe075813a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226770, "uuid": "393a5ad0-f686-4e48-9350-59358f1cfd75", "value": "T180B3C6ACC51B06A48F85ABBC5B172F85518CBA6EF3884A333278A77417D6D3E511383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226770, "uuid": "ab34a389-45d2-440e-bd81-35002bb0889b", "value": "384:ze9ky73EPXCVesmKxnEvwe+TY9hCnKZjpHAen6cbBWn1cPFx6q3fbDC8h8T:zbiedKxniMYrCK3HAc6mpX3D78T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226770, "uuid": "1c5d5150-b731-4dda-a225-153d0d007b73", "value": 112384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226770, "uuid": "b35e6dd8-a443-4d8e-9589-732b8fe050b8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226770, "uuid": "90bff9c2-ede3-4715-81e2-40683c4f680e", "value": "QOR10038200.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27eb485-f68d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628237374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237374, "uuid": "dd936052-41b6-4a12-b6ef-dcb6c50b3970", "comment": "Malware payload (RemcosRAT)", "value": "a310de72c33230edf52821a75346e92c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237374, "uuid": "e50d074a-0efe-4442-87d5-93085806de4a", "comment": "Malware payload (RemcosRAT)", "value": "cb5bbf44295f0df808a863306cff28a7237ceda45a417d90f7eaa6176b0d6047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237374, "uuid": "5ed1b56b-f1e5-459c-8e55-09ab1c16bda7", "comment": "Malware payload (RemcosRAT)", "value": "6fc2b9e2f8824232824b280506df60c54678ea52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237374, "uuid": "42158362-e6aa-4c9e-a07e-a31d07ea75fa", "comment": "Malware payload (RemcosRAT)", "value": "f9a74cacc0d0a29e5946dc356767bedd9e6ac628ab7c2afbdd9ec528fd919ee2ede1fdcc884f75ebf4e23db7ee39ded6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237374, "uuid": "9ca48ba5-836a-4396-8410-ce5229f495de", "value": "T1B5E48E62F3518873D6937A7CCC0B92ACA8267F452D3966423BF93D488F7A391352614F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237374, "uuid": "49e9c7bd-09e4-46b5-b5a0-2fb116c7b151", "value": "a09d64195bff556eb90ba4781b170ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237374, "uuid": "e2f9e2c2-b75c-4d5a-829d-a7042bddf147", "value": "12288:NlyPhGe3nf8jHmf/3AwhgFn33DdzQwcApa56Q0uGPUNfXA:NAPbaHLwh2nBZ6ouFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628237374, "uuid": "a23396d8-2370-4bf2-aea1-90955c1f484d", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628237374, "uuid": "a8828af7-76b0-4258-b4a8-e4d2754c1ad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237374, "uuid": "90e342f4-70c8-4b01-be08-f7d41f871aa7", "value": "Shipping Document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c278c3-f6e4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628274826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628274826, "uuid": "53d90916-2de0-4b1c-8740-7393bca90e87", "comment": "Malware payload (RedLineStealer)", "value": "ee604bb0856594bfd21f6edcfc6e221a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628274826, "uuid": "0ee8f51a-4e35-4999-b6b4-8224ec35c993", "comment": "Malware payload (RedLineStealer)", "value": "cb8bd17e49390c51c71aeb5176fabd5c0dcef8aca83c7dce4af0b3e378c2e5ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628274826, "uuid": "e747ef9c-23b4-489d-ade1-b517cdcef148", "comment": "Malware payload (RedLineStealer)", "value": "9bbcf52464db704a1816705a4b890cd72c90c818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628274826, "uuid": "39aaad06-1df9-4995-afb7-b7cb44813d2e", "comment": "Malware payload (RedLineStealer)", "value": "ec26095c4337cf9a9f631fcea68ff5c1a86f7df65fc5d50b5bfb30eddd8dd0a9c830a48b35382e33a2b4fd11047b4ab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628274826, "uuid": "90d9eb82-f6f6-4217-8e5a-8bce1c49bfa6", "value": "T197F4123176D1C072E55359309DE4A772FEB5B9322AB1AA8BFB900B1D2F319A2C315743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628274826, "uuid": "dc1cf5ae-9f5c-4340-b1df-88e6e0cf77d5", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628274826, "uuid": "f6165572-fa05-4b78-b791-61e2c986d58b", "value": "12288:lY20AljdZgBPfKfwsopZ7tdV9XgDfuyvQxAogJfqsUsz0cX0wth:a20gPgFKosopZPV9mdvQxAVBbIcX9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628274826, "uuid": "f9126461-8bbc-4643-b3bb-8b3733215649", "value": 757443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628274826, "uuid": "c8fb5cd2-963e-4ebf-a202-d9ee9688bce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628274826, "uuid": "361e643d-bfa3-4c85-8598-dba7f2814f3c", "value": "ee604bb0856594bfd21f6edcfc6e221a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd606a94-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628256746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256746, "uuid": "a33163c3-bfb6-46c9-bcb4-b0cbb0ef6d21", "comment": "Malware payload (AgentTesla)", "value": "04eff13123bc65c47fa910c9c5b33004", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256746, "uuid": "28c4f36d-5f01-45d9-beaa-a67b504a75e8", "comment": "Malware payload (AgentTesla)", "value": "cb8d5adf6f6c6d0da4112ec3216aa856dc0cdf75caaae4c0dfc8049d57900cef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256746, "uuid": "b11817da-a31a-46f6-964d-3b9719287c95", "comment": "Malware payload (AgentTesla)", "value": "7be617455fd74770c81b605f359f23a03b329421", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256746, "uuid": "0a676c8e-ec3a-4af8-a6ee-7fae19a0666a", "comment": "Malware payload (AgentTesla)", "value": "ff80fa5e6a6c992fc57bcccf7adae4edbe8c6da9666ce52feda54e54df521fb9ff83f6477f57ea8a3e1d0da3fcf6fd08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256746, "uuid": "fe21426e-b9d0-41c1-a871-8d14e616810e", "value": "T1C425BF0AB7447E99E25D4E3A982B824863F5C1D35733F36B39D57CD41C3271A8E6E222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256746, "uuid": "611ed399-fc3d-44b5-955e-4084c378a994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256746, "uuid": "b1cb187b-8754-4007-973c-0fa20059a89d", "value": "12288:ZQvFnW5KctdsZQfQDZKYFBQ7QeFIsAjucAnJnB8WKObYIEVej3cFV2Q:kWDsZQ2KYFBQ59c0JBFK2YIEILcFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256746, "uuid": "276e5ccb-f90c-4de0-97b6-faef41117038", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256746, "uuid": "80a0a4dc-ae9a-4553-a20c-b85e0c445936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256746, "uuid": "fbe010b0-f65a-45d8-ae0c-f60b5946f0a7", "value": "Order_01792PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3156c0d-f6eb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628277855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277855, "uuid": "07184ff9-fdf7-4b77-b8c1-d3fc3a64d0a7", "comment": "Malware payload (AgentTesla)", "value": "4e1495585f1982eaf5368d897f9b1985", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277855, "uuid": "0112d43a-af2a-430a-8eca-0ee7995430a7", "comment": "Malware payload (AgentTesla)", "value": "cbb385b8529f8c65542da6de1561bac167da44c7de62a3f82407182db4aab8ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277855, "uuid": "766d927a-c7ed-42a3-8674-24dbb49bb54c", "comment": "Malware payload (AgentTesla)", "value": "42e38b1a6e8e99e5c227afa2eec7d69a769f9a52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628277855, "uuid": "eeaab997-a72e-4ec7-aeb4-d7df17435a20", "comment": "Malware payload (AgentTesla)", "value": "ab1f5b934d546a7063d86d091633acd657faf67801674617ec981ae5e0a04a26ae6b0ad82fc3bca3d4458f87686ec2f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277855, "uuid": "9159ba63-ed71-4ad6-aca1-ae5b9cf1942f", "value": "T16C05CF647AED1704E1BBEB74423562004BF6FE3BD72AC74E2C25709C9A73A824712F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277855, "uuid": "ce9ced03-1d5c-462b-b789-23ed43d135ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277855, "uuid": "5abddd30-6cb7-4493-a4b8-bd9df043857a", "value": "12288:7caQxt8JvG8LbgDPwFVt2NjFPAgUhNELNBcYwZeJSL/pJ2bjon6r3ZOHnqYkDo:6qb0wFVMNjehiBBcF4JSFob8n6jEHqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628277855, "uuid": "d7acd8dc-4da2-4020-a554-6b63b6e94cb1", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628277855, "uuid": "767a760a-1045-429c-902c-4ddbaeba2f22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628277855, "uuid": "d284014f-3500-4d49-bae6-37d54fe548f5", "value": "invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93220659-f6bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628258823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258823, "uuid": "726f0839-542f-4cb5-af3d-b39ceabbf099", "comment": "Malware payload", "value": "42b8216ef14fcde542b104ecf795dc1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258823, "uuid": "9a373b5e-d735-4930-96a4-2584e5bf31e8", "comment": "Malware payload", "value": "cbf3b507c9bec6e61a01c0251ff9579c6952060b3d5017b76faa550d9c0e1ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258823, "uuid": "2e02d681-be14-4a38-8f2f-e173d8438cdc", "comment": "Malware payload", "value": "b353a7d898d52634187f7c218a8172ccca792941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258823, "uuid": "2ced1c69-486b-43e6-9235-566d9c33fe3a", "comment": "Malware payload", "value": "de7133e6a4d63943f9f263c13e3d0fdc695b648403953ff29a30c43b56bdaed707bb6d1bb2f8b96bea0c2e64cc2c549a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258823, "uuid": "f963828b-4185-4c1b-87a2-ed0342afd269", "value": "T165E25C74661894BEDBEEC138857B5E1AB360F01D4226AF2E00539ADE2F477E11D4BB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258823, "uuid": "040ee86a-1e06-460a-89ef-734b0350c219", "value": "b9f335560d593ab66ca7fbc65507923d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258823, "uuid": "0437a16f-f5f2-4417-b604-dd93bf037968", "value": "384:WA3N8o5hKTeVwJFiolSO3VUbO7ALG1ql2vX0J4QVva5oefOmzKA/4C0ssFss:WA3ASu4O3Vg+Cg2y7L383", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258823, "uuid": "e2c33e54-b58b-4c4f-b0c2-d8bd54231433", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258823, "uuid": "16f7caf7-de3a-4baa-9a88-cc7df680d85d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258823, "uuid": "e2541c0e-f651-4ae6-89da-b21468c73cf5", "value": "5f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c95fc5-f6da-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628270365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628270365, "uuid": "20114e2b-01b8-41eb-9da7-9ee439d2f7e4", "comment": "Malware payload (Formbook)", "value": "d257108a969f1183b34cdadf9c5bfad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628270365, "uuid": "eca7fe49-ee66-4560-b036-f800fc856860", "comment": "Malware payload (Formbook)", "value": "cc0f2348e1c6b1cabd55e7770566e41cf7ce5978f0028d8c0f66eb55ec26cc6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628270365, "uuid": "89561887-eb52-4cac-8abc-820246fca386", "comment": "Malware payload (Formbook)", "value": "58e3f5a93c905bd2b49abd5048056caac61ec17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628270365, "uuid": "05a5d2c6-80c7-4fda-ba47-6ff914742ceb", "comment": "Malware payload (Formbook)", "value": "4ec71c33bb6601a0b2ead077bd8fde7b8df1445f56aec10fa92ffd842e43da6435b1afc4bc83209391bec7bff741150c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628270365, "uuid": "18ffbcbe-18cf-401a-9e51-1c37f273d999", "value": "T1A064F2047BC0C975E973193188659AB16A3EFA711F706EEB67AC057A4E206C08521FFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628270365, "uuid": "3a56682f-1ea5-42cc-adea-09f20077e68b", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628270365, "uuid": "26cc6f1c-db3d-4cb5-9194-fbc2a38b83e1", "value": "6144:zGrf0xh3Hfr5YwuLpVz3YJbbbbbbbbbbbbbJiYFzC/48ZgH64CBdtm8aZJIpbTzA:Crf0P3HD5YxSiY/Ab4Wm8ajI1TFEF678", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628270365, "uuid": "bfc36d1b-2b5a-40ec-a8be-8bd447426ba8", "value": 334644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628270365, "uuid": "ed1e835a-ded1-416d-9094-842e08611a7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628270365, "uuid": "d2fefc6d-11f0-42eb-a237-bac591fe2839", "value": "PARKER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80209719-f6aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628249771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249771, "uuid": "cfed3f91-b0c1-437b-8306-4c28d01a27a9", "comment": "Malware payload (AgentTesla)", "value": "14717034e3c0710b8d606f12ddb6c8cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249771, "uuid": "5b576681-60ee-4d76-b436-55b4544fb73d", "comment": "Malware payload (AgentTesla)", "value": "cc5f6d70a675d3f50190d1d38706c9b6f1e4d591cddabcbba3007560b1809008", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249771, "uuid": "5da563e6-4eea-41d2-a730-82160975e03e", "comment": "Malware payload (AgentTesla)", "value": "d7b4cd8d30cba63dcc1362a3d41c3371cdcfc6ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628249771, "uuid": "37cffb2c-6adb-41f7-b368-dde66c55b467", "comment": "Malware payload (AgentTesla)", "value": "8f10b75d0fa0e769ceab38a712d5d5b55388a9202b3f7cfb78969a513413b9d069d1f67c5543a11ceea397cdd0cde211", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249771, "uuid": "07313f26-8403-4231-a7e3-6b72a025a0c3", "value": "T12BF4AE90E685A602C19818BF1F3DFA7017FC9D9B1556C0412ED8ED573BAEEFA09C25C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249771, "uuid": "32b82aa2-6732-441b-a95d-c3bbaff47d1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249771, "uuid": "c621eed5-4d4d-43e9-8687-e9827871f2b8", "value": "12288:ugrkTiCVsiasez22ripfp7RxdJyqUzbI4Vfh6ylO3Y/1jQt2NjF3OX7K:ugUVIblqfXnJsH96jYNjQMNjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628249771, "uuid": "54ce67ba-a9b5-4e5a-814e-870e220608ae", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628249771, "uuid": "56c62141-a35c-407a-9eef-6b41b786cc02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628249771, "uuid": "88d41661-11ea-44dd-8fcf-9e1922c336b0", "value": "Transfer receipt Copy 1038690332210516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f089935-f6a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628246602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246602, "uuid": "459d7fd9-f2ed-436f-a395-52e37d44dbd4", "comment": "Malware payload", "value": "6d6399e5e98164e365029a9b141e1646", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246602, "uuid": "b4b0f1fa-05c1-4c1e-aa4b-561f70d6745a", "comment": "Malware payload", "value": "cd9421c332a2b90b26152f0e85a7db621306cd1daa70f30af3210895d2aeb577", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246602, "uuid": "1d91515f-0451-4482-9528-03403f5a3788", "comment": "Malware payload", "value": "64f8b386000ed34f7b9f22a8144328d0e61ed31c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628246602, "uuid": "5fa1dba7-ed47-4e16-aa6e-086c8188f9e2", "comment": "Malware payload", "value": "319b16e1699db39d7bf54fdb57d287885e76834cae8fc339a6c9d98fab6f86af9a336e36adfe5b8aa6cdd8f784d1ee2d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246602, "uuid": "258c7f14-1dd3-4b16-8ac1-ae28dbf9df6d", "value": "T195B4235ED86C3C98ECBB133599A678528771709B82C50672B43C0D838F4EE583E675BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246602, "uuid": "d092829b-5872-4b4a-9d4b-0c3344c141cd", "value": "12288:VpibeEe4ptxOrPocv7P/UUgSMvFhaIbVMZxIHPbB0:jDEe4ptxeoGj/oLtMCMZxIHPbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628246602, "uuid": "c8a77691-43ed-434c-812d-9467f947fc8e", "value": 509814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628246602, "uuid": "8437a24f-3579-4b9d-849c-cde9ac09b012", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628246602, "uuid": "4ed260a1-1212-4afa-a30c-631c3204e0da", "value": "\uc778\ud130\ubdf0\uc9c8\ubb38\uc9c0-\ucd5c\uc740\uc728(\ud55c\uad6d\uc5b4).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06284750-f67e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628230669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230669, "uuid": "14d04dd5-4f41-4342-9226-291175ffb3d1", "comment": "Malware payload (SnakeKeylogger)", "value": "ecac725ddcdd32bc821da7f6857dec95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230669, "uuid": "8b9f8866-a1f4-4de9-bf60-bac5ef2f552c", "comment": "Malware payload (SnakeKeylogger)", "value": "ce1cf72e73bce44e190b5998072b7069653c9afb3fe4499441e8d4d791f56837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230669, "uuid": "09f448ad-5ad8-4657-a242-ffef33e3ad0e", "comment": "Malware payload (SnakeKeylogger)", "value": "079fa74915e6fba3c13a510d2003e4119c724ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230669, "uuid": "252efbcc-f146-439d-b00d-292ac7ceeced", "comment": "Malware payload (SnakeKeylogger)", "value": "0f4a0ac9944cfa24b270ee983bb76bc103a965401b9ccd910e45f999e91f05f2aef83211fd0ecc38c16f6455889b84e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230669, "uuid": "7ac42ac7-e429-42c6-b63e-c0dc971f8fcd", "value": "T1C0F4E0257261C901C3FB2776CCEF40084BFCB9813A63CF1B799A32A9495277699879CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230669, "uuid": "4ed682eb-506e-428f-ad1f-d0b6948d9b76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230669, "uuid": "d81db407-10ac-464a-adb6-26b0dd761a39", "value": "12288:TzYXTjASHq0pkzV386oGr7m5WgaBEjvCov9hFcR64V7D3NLirTXFi4t2NjFA:TzOTcI486rriZaCLCE9wR9V7D3Nun84F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230669, "uuid": "0420da98-3766-43bf-9470-77b0d4390b41", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230669, "uuid": "09235edf-ea0a-461b-bffd-77500baaa3ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230669, "uuid": "8c384c44-ce80-43fd-b1c7-a6a05a0c9b0c", "value": "invoice OrderNo.11133991BP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1e3095-f67b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628229630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229630, "uuid": "9cbf0e25-2169-4073-9503-798a90a4133c", "comment": "Malware payload (Formbook)", "value": "836dd65f8206612521a583a08109ead1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229630, "uuid": "b96502e6-1a84-48af-bfc3-d312c8656088", "comment": "Malware payload (Formbook)", "value": "cff84e417e1483abc23bd1ff30bac2fda21a4e80f4dcc210130e3157a42299d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229630, "uuid": "43a6b47b-8f86-4058-b51b-eada7f86c0f6", "comment": "Malware payload (Formbook)", "value": "b1b952a4d1f2f2975484289c2fee09c5ffa42200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229630, "uuid": "bf8241ae-1ef5-40ac-b36b-be651f7852f9", "comment": "Malware payload (Formbook)", "value": "ff34726cc293fee8fde2ea38f54a3c32453fed0932ebb801962e8647e3d44c5e5e6b5d29a6f4a49162da92ea69536bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229630, "uuid": "854a2946-1424-4097-8ed5-1488f52cc501", "value": "T1E33423C1A4C50F51E4634DFE9160BE78B52F2393701D421FB2E3288E9C59BDE132A7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229630, "uuid": "00ecbef0-de04-4314-8e84-73e20543889b", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229630, "uuid": "248a640f-92f5-4c94-a817-61401ab399a4", "value": "6144:/7NfH8U4bPiPRpQwZhCWZQ9Y/MiqU/Ll4l:58U4OlPpHvVTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229630, "uuid": "c929ba4b-62e0-46af-b8f8-8a64230c217b", "value": 234490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229630, "uuid": "6d2564fa-78b0-43f4-8d10-de3554d7ab0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229630, "uuid": "597b7c3d-71ff-4e1b-ae6f-dfc402c927d3", "value": "usulo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39a309c-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628257562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257562, "uuid": "7c03e51a-6837-4755-a51e-4b6bbe6e25fc", "comment": "Malware payload (AveMariaRAT)", "value": "69b2919aeae1bafab2af46ba3078c425", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257562, "uuid": "2816aabf-3fcb-4120-b24b-5a7b6d4f4eeb", "comment": "Malware payload (AveMariaRAT)", "value": "d10722e2ba880417c63ff3b7d3e12042a9b45b44b6a4f1497cab0979a9ab9296", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257562, "uuid": "3aa82988-5b4d-488d-aba2-bdf6b69cd10a", "comment": "Malware payload (AveMariaRAT)", "value": "a05ff132efefd500605ffb1ca46371a49af80d1f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257562, "uuid": "856eb283-a734-45ef-b577-a75001979a41", "comment": "Malware payload (AveMariaRAT)", "value": "69767d808458c69159e7629f351ac63475831aff6d290c1f9e1a05207db69727d164665b89721527b2c866e33dc9c201", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257562, "uuid": "a371719a-2620-4ebd-9748-c9082f3e6a34", "value": "T1E905DF347AEE2304E1BBE7741A3591414BFBF537DB16C74E2C68508C9A736828722F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257562, "uuid": "44df1fda-6290-4add-98b5-928e1d45b287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257562, "uuid": "5ada53f7-9e4a-406d-9907-19f72f6a8134", "value": "12288:3caQxt8BPx8bgDPwFVt2NjFz5dGs9C0J+D8stY5MOJVBLmwLhbHWIbPmzqLVsZ:fCb0wFVMNjZTPCzD3YdL3bHtbemLVsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257562, "uuid": "0afb5f6d-dfe0-4be7-85b6-264b63467c8e", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257562, "uuid": "615cffc8-a5a1-4513-929c-9c94404dd001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257562, "uuid": "2555302a-8824-4314-9923-5310efd74bcb", "value": "SIGNED PI NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8242d3af-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252352, "uuid": "a115fdfd-61ea-4f3b-83ad-615d9871c646", "comment": "Malware payload (PlugX)", "value": "2512bc611f3477627381e7b69fd3dfc0", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252352, "uuid": "f31b9221-d7fb-46d0-bd8f-47e01d5f8e42", "comment": "Malware payload (PlugX)", "value": "d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252352, "uuid": "d64a41f7-1ae2-48b2-a31e-318d1642dc7f", "comment": "Malware payload (PlugX)", "value": "4de71f730b57d672c3ccc9a655fd9e347b5462f9", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252352, "uuid": "f6b673ae-0bca-4624-ad2a-0606b93adf33", "comment": "Malware payload (PlugX)", "value": "16a9970a8dac6b50ec81074114356b2f6244c1d2ee80601e5b1796cb2617479e549b709fcb5dffd219808393ad3f87d8", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252352, "uuid": "b218d1ec-119e-442d-8301-acde27d4f083", "value": "T1AFD32A15E140D3B2E87E50FD4BBCAE0B227EAE65471405DF36C8942A75E1DE16F38E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252352, "uuid": "085d1b69-c7d2-4044-bfbb-9b82ce319754", "value": "75c054ac1bbae1f166a73824a11d5efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252352, "uuid": "792b1d28-eea9-4fe4-b8e1-cc33b75b2771", "value": "3072:wh8W5EOvE8utrloMC0kfF1IZEZZ4QQ4h5UNrd:BWWOUtrlTSe+ZR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252352, "uuid": "13563d9b-363b-4024-80c1-a2346243c91c", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252352, "uuid": "3728d019-bbcf-4d91-8752-25da1b07d622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252352, "uuid": "6c8871a2-b73c-46db-b1be-2ce1f96225fe", "value": "d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838295e4-f6ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628251066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251066, "uuid": "69a5ad28-e8ee-47f6-8371-0724360dbae8", "comment": "Malware payload (RedLineStealer)", "value": "ef5792aa4cd85ac9b5848da9f9fcd6af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251066, "uuid": "93aa3430-cd91-4ed3-96eb-6ac5d15e4904", "comment": "Malware payload (RedLineStealer)", "value": "d4ac121c5a776d0f65e039bf0922b1582403177b0d316dbd1cfcac9f36b4265c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251066, "uuid": "20a3552a-4f8d-4de9-b866-598f6910f49d", "comment": "Malware payload (RedLineStealer)", "value": "d7dda5da9c23c94afa86f40d318f60d5bdd0c921", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628251066, "uuid": "7a8c4231-1203-4648-947f-6fcb4b3363bc", "comment": "Malware payload (RedLineStealer)", "value": "03fc388db8586179053e16ffcccc7c176a3d27e0c3dfe7e9c5c41e47d2a9d71bf57ddc466f7f68358fcd5c6ddf35f02e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251066, "uuid": "8e2d26dc-1c2c-4758-a4f2-15d51eba37b2", "value": "T1AF54F1213741CD72D41339B068BACB81679EF85AE75186077A4A2B9F3F712D06F3A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251066, "uuid": "0a46f69b-4fc1-454e-a1df-de60dad5304c", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251066, "uuid": "57c1cf76-8a65-4821-b08d-aad03a1a257d", "value": "6144:4rLOHhMfUQfpvzdNTs7FTYxN4ZwzPupqRL3UxJgLBI:4ramUQfpvzmY0cVRYYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628251066, "uuid": "c4bbb2f0-b8df-4a10-b971-21854a8cb923", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628251066, "uuid": "34837594-9e71-492e-9c44-917bbaffd2b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628251066, "uuid": "8484f858-9c53-4d6b-85d5-0169048fe242", "value": "ef5792aa4cd85ac9b5848da9f9fcd6af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794d20ba-f67f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628231292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231292, "uuid": "e1ed5c08-3df9-440d-ad2b-1b8f3d72ece9", "comment": "Malware payload (Formbook)", "value": "fe69159c72a9f2ae7cc592a8572c3bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231292, "uuid": "7380af45-6101-44a5-ba49-b65daff5cd52", "comment": "Malware payload (Formbook)", "value": "d4b50f02cca2034a0feebf0145206aac100f816fba4dc91f8e8138819f46abb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231292, "uuid": "f551affc-76aa-4a7a-8f26-35f5b87e0550", "comment": "Malware payload (Formbook)", "value": "fa1096af31c9e6184485b59551dd5446bae348ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231292, "uuid": "2acb281b-f49c-4997-8bf6-e0b0f577644b", "comment": "Malware payload (Formbook)", "value": "61b14f7be9564ee9e3b39bafa3878247e4e1136a40b43f44ed38a18351a9e4b306bc628f9cdf26b490f9cce1b42d33b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231292, "uuid": "215b664c-8214-4767-a034-6718651e1b72", "value": "T14F341209DBC48F76D01AB538B5BAF49CF494A16056FB27FFF5179E21061A88A8120F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231292, "uuid": "2615bea9-48ab-4f16-89bd-b3a810904d73", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231292, "uuid": "3bd7e5e4-bdfc-4a78-bae0-6ce4387f0637", "value": "6144:IpVix5AIws740pKNsFdWfNJDz22aMGnNUz5VF:ldLBKOzqxGNUlVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231292, "uuid": "86975ab1-f555-47a9-a1b4-94853989d2b2", "value": 238484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231292, "uuid": "3bf03251-c1c2-445e-9ee5-c76c54069b0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231292, "uuid": "f6014691-e98e-415b-8314-9bb92861e195", "value": "PROPOSED ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbd57d4-f68c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628236852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236852, "uuid": "34678559-3362-466b-9ae7-e3b8161d34f1", "comment": "Malware payload (SnakeKeylogger)", "value": "81f70b54b7d3636313ab065145c42e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236852, "uuid": "b68b5e77-cd5d-49f0-ba47-f49d71619954", "comment": "Malware payload (SnakeKeylogger)", "value": "d5b2a38229346acf8eea0d20c4687f9f59627dcbf09c12d8ea5eb77e604653b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236852, "uuid": "09854a5d-2646-4a2a-b288-77b3eb4b9c32", "comment": "Malware payload (SnakeKeylogger)", "value": "95e92f8dd3f90fdbd2f9b39ff5467cf108721b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628236852, "uuid": "d9b0eb40-381d-4ab5-9b3c-fec9313c4673", "comment": "Malware payload (SnakeKeylogger)", "value": "6e9853f5fa61fd8cc509a19ca0a95cad9d754e2ca9d7cd3b2a462ddbfbddff36ede09c627c0b6528c26a8642e0ace083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236852, "uuid": "5df3dd0c-2f70-48cf-b2fb-56d8ea3ae7df", "value": "T141C48D2A25D14907E13CCE3C1952926AF178DEC2B4DDDB8BECC73C47D639B8615806AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236852, "uuid": "860ba109-bd47-441c-ad73-e87910d5ad84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236852, "uuid": "fe117eb1-f3a1-4192-9f07-422d46091904", "value": "6144:JvLv+4SxVYycTWfDL6hBmgpq2aCnwnhNXu8doLp9be6tS7imKXIlWBS38KNrG0l1:pSPTKhgg9UNXuuoLLbe6g3lDfA0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628236852, "uuid": "df577034-a0b3-44d1-88c5-39600da105f6", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628236852, "uuid": "0a627d95-d2e4-412f-aca1-8867c973a3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628236852, "uuid": "1585087c-d49b-4056-a1d3-abbf78f957b7", "value": "Q88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0617b32-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628257556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257556, "uuid": "d449656a-8251-46b4-9c34-2965d4ccb829", "comment": "Malware payload (AgentTesla)", "value": "954a405887faa30ceea46f441a2615be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257556, "uuid": "094a02ce-3d65-44b0-b7c1-3410c3c7d993", "comment": "Malware payload (AgentTesla)", "value": "d5d87a51678607282919dd12634f7eb9c084a4b8f2ebe662a118885dd29dabd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257556, "uuid": "8ea31d79-7d95-4411-892c-659cc1f5de5b", "comment": "Malware payload (AgentTesla)", "value": "89e18b3f535421d12e3780b2259e5f5ebce0ad3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257556, "uuid": "1c70a844-232c-4151-ad07-82b78a1271a2", "comment": "Malware payload (AgentTesla)", "value": "c1fac859d0a820ab1f234f9b26e6d27f41bf11cb4d2feace508a2c588bb85531829d290fb73e4fe0cdfff482123a183e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257556, "uuid": "beda3400-a63e-469f-8ec4-2982701c3b70", "value": "T1E605CF347AED5314E1BBE7344635A1008BFAF53BD717C78E2D60649C9A73A828722F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257556, "uuid": "a2f8a806-9d3f-4873-92bc-4af5d91f9fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257556, "uuid": "f1e9235c-1dab-4dbd-80be-a2e9ab2da9e0", "value": "24576:5x+Ab0wFVMNjNkDCFBwuyG5Eb+S/z415ZBhkj:bJYwFShmDCHwuVVS/zU5ZB6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257556, "uuid": "fab41a0f-0c69-4b71-8a68-e6ca2809feaa", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257556, "uuid": "53652c71-836f-49c4-98eb-e8be221da656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257556, "uuid": "e7df5c63-d7a8-421d-8794-7916c7009656", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860de593-f703-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628288007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288007, "uuid": "f0433cdf-409d-4ce2-afa7-d26e1e37d1cc", "comment": "Malware payload", "value": "685632a50d8c514a09882f24165741c3", "object_relation": "md5", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288007, "uuid": "b8d7b1cc-6d66-4650-a3bf-d5f2b24163f2", "comment": "Malware payload", "value": "d71cc6337efb5cbbb400d57c8fdeb48d7af12a292fa87a55e8705d18b09f516e", "object_relation": "sha256", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288007, "uuid": "fb11775b-eb99-4fc2-9b14-e28abbecc47f", "comment": "Malware payload", "value": "864667b969b7b31e8975700c4e9236390a250118", "object_relation": "sha1", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628288007, "uuid": "999e569d-69b6-4c2f-8e09-5a8d37d96923", "comment": "Malware payload", "value": "a31f5bb4b81a2f334c5fa53f0679a85bbae81649425ffcb04ffc1636efe48f855cfeb96fb71b9eb9c05e507eecc2912d", "object_relation": "sha3-384", "Tag": [ { "name": "BreakWin", "colour": "#2C4545", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288007, "uuid": "488bd5a3-5491-4da6-8b11-68163b5d475d", "value": "T1D2E47B3935D2C03AD2731630192CA7A914FAFA728D774A1F7398476D1E788929D22F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288007, "uuid": "11e92c7c-7bb6-4b41-b778-7e92390b504f", "value": "6a4fb41bdb00ba9bffd919feb1151eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288007, "uuid": "9351efc5-1c96-4f48-be02-caa11719f00b", "value": "12288:O2PdKLgL71y/5ulCPnjiAlVsuqk/RyJ7PnVPYpHOHf/TBmaAgzjS:O2P4ULpy/5OCP+2rUJ7SpHCHTBgCjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628288007, "uuid": "d147452c-d6de-4615-8e75-4c415eb54039", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628288007, "uuid": "1795891a-9bca-4c8d-bd90-712501c715fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628288007, "uuid": "f706d85b-de77-4f0e-a567-176a8a5f692b", "value": "d71cc6337efb5cbbb400d57c8fdeb48d7af12a292fa87a55e8705d18b09f516e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570035d1-f673-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628226080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226080, "uuid": "d731c1bb-550d-47f3-a4ac-8e800b7513d4", "comment": "Malware payload (RedLineStealer)", "value": "7a788caf6150720822e7ce9f94da340c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226080, "uuid": "78b28b57-3eca-4d30-9d7e-984c0d09e59c", "comment": "Malware payload (RedLineStealer)", "value": "d8209991681e317131bd0735c151352a784b9d6c8678b06c18648a99b10e9018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226080, "uuid": "f2f4e63f-8c3b-407d-b24e-30a02f7b843b", "comment": "Malware payload (RedLineStealer)", "value": "5dd93822bb87d46250c4f3634e2e82205b7f0ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226080, "uuid": "21959f12-3bfb-466d-858f-05ca57ccd4ea", "comment": "Malware payload (RedLineStealer)", "value": "4ebdb374effa9270048b868b11a35774990b3a63cf4f4bd4edee61230adf0e128ccb35072d9530babb45489ea1552f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226080, "uuid": "b4d7e41b-b72c-4e55-a74d-0c208c27ddea", "value": "T188B6331BCE92EDEBF4D94875485D9FAD1BA2782C0478A252D7483D0D29CC1A67C3FC1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226080, "uuid": "00d13110-b600-4739-94db-0b70dcd63f87", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226080, "uuid": "7dc65083-b83d-410e-9a62-124a4a9f63fc", "value": "196608:+NhvHVhumwFj9irruhEJInP5R1TzdoL3pdVkc0uyyGT/ailisIknBKr4ExxYx:+3fhwl9ilJInx/do138u+2ilipzr44ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226080, "uuid": "65943386-07c1-41fc-a990-129ba232d33c", "value": 10948477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226080, "uuid": "4f060349-c086-4699-96a6-187706cb5e32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226080, "uuid": "4031b253-7477-46aa-bba0-880ea28f20b2", "value": "SC_hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acf39a2-f6b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628253225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253225, "uuid": "bbda8ced-57df-49c5-8949-4e60cb8d1a71", "comment": "Malware payload (Formbook)", "value": "353c9edbad0f773c0b487216f62f209d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253225, "uuid": "8f053f0e-579f-4375-80ea-1e78f15ad5bc", "comment": "Malware payload (Formbook)", "value": "d9177550809d70fa016c76478a9d4edb2a930cf7f05dbd1bba0f05b2d7564a2b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253225, "uuid": "200b7845-4eb0-4a37-9276-fcf87d64dc24", "comment": "Malware payload (Formbook)", "value": "d168fb8f62e6f98a56d00512e4ab42d3dd49d558", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628253225, "uuid": "60692fe9-2efb-4a66-b6c2-0600ad0aa5b8", "comment": "Malware payload (Formbook)", "value": "df7217e7225bed851cac7698cc5a13351f9a6078f69c9935cf604877c2b415ddce60bf42b3d0e1bce267fa4e89ac982b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253225, "uuid": "b4def8c8-b8a7-4ceb-9ba6-4f4e4c0b6b71", "value": "T139E43302F6307DBE9311B7EC0D474AAE93B51C2DEE65A3DD85B9658ACC07548300D7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253225, "uuid": "0f157d52-1b72-414a-af30-5d0c01dd741f", "value": "12288:txdOSpE9tq2W0hFCSMacJXRwWQQFqxWy0Y7bbY1gDFkZtt4oCnkMh5O:txAe2LJahPQcyhkmJkza/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628253225, "uuid": "ee502cc8-68a7-4f34-b52f-236af0bd7a2f", "value": 710753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628253225, "uuid": "2fe6f143-f988-43b6-b57d-8ec7325d6071", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628253225, "uuid": "8236c0fd-aa63-4c5e-aa8b-8d2d91858afd", "value": "Payment_Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05d16fc-f686-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628234498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234498, "uuid": "07a8ae57-1d3f-47f7-aa42-be890c091daf", "comment": "Malware payload (RedLineStealer)", "value": "1f66f90bd2ff6aba4db2ad1b94453020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234498, "uuid": "c1e84767-eb15-40b1-8c2a-5a886b78fd39", "comment": "Malware payload (RedLineStealer)", "value": "d96b12587bf342e3a99493402b3ede54ef5b3f31ff4b09a6710f1443a66f2683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234498, "uuid": "511b05bf-f13d-4654-a334-e0f90c2f1b24", "comment": "Malware payload (RedLineStealer)", "value": "06509a28c407ee7a4defdc8c4959f285df6658a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628234498, "uuid": "22002156-b221-4d98-ab06-3540bb141263", "comment": "Malware payload (RedLineStealer)", "value": "fe402457b1ebaee69d8b7a3c26bab92ee38b2652bae714de2489ec536507f7ebde9bcf7915be04ed706586d3279019d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234498, "uuid": "c835661b-8f71-4423-8968-56efc0db10b5", "value": "T172A63310BB92B532C7D109B20F6617A946B96F511F18FB1393E03653A8733A36E61E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234498, "uuid": "b7cb951d-c5a1-403b-9942-d1937128f43a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234498, "uuid": "237c98c4-28ce-4ed8-bf5f-9fc4fc05dc4d", "value": "196608:93TQkePt2wAV/AwusXN9mhG6Bp332uUaRLXiDoXqJG7s3Mpe2xxZ:pI1MVlFXN9m8+3dRLXi82s/p1xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628234498, "uuid": "e9e279cd-581d-4350-884f-1478b22f45a5", "value": 10177859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628234498, "uuid": "0f77d03e-bed2-4957-bb44-dff1dcc7327c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628234498, "uuid": "feef2dea-b983-45ea-97e9-dba3ed20d732", "value": "1F66F90BD2FF6ABA4DB2AD1B94453020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8688bb9f-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628231743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231743, "uuid": "4064afc3-414b-4a1b-9e48-b87b53281725", "comment": "Malware payload (AgentTesla)", "value": "034b8ed08edfa130c4753550d7aea9bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231743, "uuid": "7cb340a1-0ce7-43df-a674-f6128e6d79ab", "comment": "Malware payload (AgentTesla)", "value": "da2583a529827b15b05b18370fe5f8bab878fdd0c78e4fde91e2e5c5b476930f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231743, "uuid": "360a9caa-fcbf-4d59-a694-08aa06a3cf46", "comment": "Malware payload (AgentTesla)", "value": "7efd865efe47e8f2665cf5bdc4556be769ea998f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231743, "uuid": "1997b5da-6dbb-442f-a489-f8826cb72d2b", "comment": "Malware payload (AgentTesla)", "value": "1e8c7236ec8ad6adf01f252be9ff1357da2c80e1bd8383e7476349fbaada113819f7c2c0071e0157279a65cc528fb2a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231743, "uuid": "057f2fd3-1867-4f8b-999f-5bff14f3c796", "value": "T1A505E0257651C901D7FE6B32CCDF40084BF9F9413A62CF1A7CAB325E4A533A2A9465CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231743, "uuid": "463cdcc9-1c06-41f7-9ab2-3fc963958813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231743, "uuid": "82d1ca00-af15-4db8-8da6-e4c6ac3a7036", "value": "24576:CvrroA8+PzWh7/wAUEcgGtOz23v9MNjd:wr4+qh//4Oz2/Kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231743, "uuid": "cc9e4595-8596-4b9e-9f65-c28bd1a16784", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231743, "uuid": "2fe9d792-33d3-4bf0-a119-bab127a820ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231743, "uuid": "49939664-82cd-4324-9144-98c95a96c822", "value": "034b8ed08edfa130c4753550d7aea9bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b560e93-f69e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628244556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244556, "uuid": "58ef5b23-9fb1-47ab-a819-731f9476d666", "comment": "Malware payload", "value": "997200828416e51e43dd1cab16ed4e75", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244556, "uuid": "08b5aba2-271e-44a8-8206-95cd55089d0f", "comment": "Malware payload", "value": "dae4a56c510e999c93f4995532eed2c857787143d7f8e999a4ca00f777f4e98f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244556, "uuid": "a4db4f8f-7ccb-4b9a-9ae1-7fa5a2985d05", "comment": "Malware payload", "value": "6645e445eef002c5820ddfae294df63142e56074", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628244556, "uuid": "ed78672c-5441-43a5-9f19-59ff324c56f2", "comment": "Malware payload", "value": "8ba3437fcbed977e70b496e22a895f6a9845f1f1bee0f80b3d59b203695421288befc686bcee86089ee6fc6195c23064", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244556, "uuid": "993652f8-fb75-4e4c-b2bd-d84aa0344d8c", "value": "T16835125BA4B37FB9DA255234452F65512F985CE289002CE51A023A0836FBDF73BF335A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244556, "uuid": "a18b3120-f667-4452-bff5-047958dc4be4", "value": "24576:eS8IW6enOG2RyRm0r31k2D2P4t37hAu2WHTclQx3DAVw:4Ieuyg0D1k2D2P4PAvWAlQaVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628244556, "uuid": "b7376125-a63e-468d-a066-df8a5f42ff16", "value": 1117160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628244556, "uuid": "6d404f06-3d12-4b86-9365-ebd06fe148e6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628244556, "uuid": "c44a8c16-7eba-493d-ba7e-7c83b10e2d06", "value": "NEW ORDER QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3d14f4-f67c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628230174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230174, "uuid": "11a9d666-23e8-4d82-a3d2-b0cd73120a39", "comment": "Malware payload (HorusEyesRAT)", "value": "3a94b8c98fc5da9256c2c51d1ae987ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230174, "uuid": "78d31f85-7a54-4417-a1b2-30d442f00f70", "comment": "Malware payload (HorusEyesRAT)", "value": "dae944f8fb5b1dd202506345d8468db0da2157a4b40776346fde9868cfdc8bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230174, "uuid": "8a09a74e-343c-45f4-bf6d-ab77aa5b7e2e", "comment": "Malware payload (HorusEyesRAT)", "value": "f99626865cd25a744462779e3ce962e93c2f49db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230174, "uuid": "2a1f31cd-096a-4e5e-898a-af1c16767996", "comment": "Malware payload (HorusEyesRAT)", "value": "580e6da0e73ed789681d91384b13f357ed7878dd986347261c835769ffdefa530b88a80568bf126b75f853d844b9017c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230174, "uuid": "6af39ed2-09e1-4c30-97dc-25c4970144a6", "value": "T18D45E7F63525F789FC3C35F4845BA246E2ADFE8E464C892EB887314487E53817BD1262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230174, "uuid": "bdd11837-c00f-4034-bfb9-eee361fd3eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230174, "uuid": "56aae2bf-9ec9-45d4-8661-5d4129529fb1", "value": "12288:Dr6qcPn3VvxwLlfQ6jMRUKZNuUfvyMtDDirVQX6jMRy6jlR:phjMpNjfKMtSjMNjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230174, "uuid": "13656519-fe4b-48c8-982b-c83d6a6f77aa", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230174, "uuid": "7df8668b-f9ce-4004-977f-a984b6f065f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230174, "uuid": "5cf3e2fe-c329-458e-a8dc-8286e085aab5", "value": "HorusEyesRat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8797dd36-f6b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PlugX)", "timestamp": 1628252361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252361, "uuid": "0ca6266b-d09a-4ae2-b404-43c740025f32", "comment": "Malware payload (PlugX)", "value": "e3dace173ded785a9af4a9007587eec6", "object_relation": "md5", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252361, "uuid": "35d24b65-e960-4976-bdc0-ee6f64def808", "comment": "Malware payload (PlugX)", "value": "dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4", "object_relation": "sha256", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252361, "uuid": "98de848c-0e17-4793-96ad-955ef5bd7035", "comment": "Malware payload (PlugX)", "value": "2b746a247ef14585e9102336939e341f62cc6b67", "object_relation": "sha1", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252361, "uuid": "522854ca-0a4e-4f2a-86d3-004505e50776", "comment": "Malware payload (PlugX)", "value": "7bf36947d60b30cee7a36f9873ad99c5f449c95b17631616646348911477b5d661a1cfeb545b8242342a1f57ad2b55cb", "object_relation": "sha3-384", "Tag": [ { "name": "decrypted", "colour": "#87AB4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252361, "uuid": "16a87408-ffda-4935-b398-762366e4a740", "value": "T1B3F31800E040D3B6E4BA40F94BBDAE5B257DA962071545DF37C29C3E79D2DE16B38E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252361, "uuid": "bc98c01b-1249-4d9a-9abc-ee39ef1eb898", "value": "9ac5a54fc7fd8bbc266cbaeb715d2c69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252361, "uuid": "0d31c065-9376-48eb-b484-d54433d77f50", "value": "3072:+MZgx/c7SKIPuExpL/bZdHXC3e81wBguUqp5uws:1gx/ySfPuExpDbZdHXCe81wDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252361, "uuid": "03eb971f-f9ac-4d52-adc5-6e3ecf66777f", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252361, "uuid": "13c7ce63-9d8a-42d4-819c-f0bb7229a23e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252361, "uuid": "5518e81b-78c7-4b9f-acc7-272d2fe054f8", "value": "dce920f5db90efecc7fb7a6b6399c80fc83e3f1251f160cd1295b6a4b67125d4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adae8b2-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628252823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252823, "uuid": "b2fa126b-8077-4875-a12e-4a8a4b2d7b5b", "comment": "Malware payload (Smoke Loader)", "value": "1c493aadbf2447c09faa0d340855b2e5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252823, "uuid": "08203f52-794e-4677-bf4b-53ec10411e1e", "comment": "Malware payload (Smoke Loader)", "value": "dcf60583940d9683d950022fc0ff511ea3a7364b728635eb904d28460200dd98", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252823, "uuid": "64e4c7f9-b9f6-448b-8f48-53c3fa6e497f", "comment": "Malware payload (Smoke Loader)", "value": "a99d6a3782ad93177e456cda9379dec5e4ca9c4e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252823, "uuid": "76bca542-9ee1-47ed-b8ce-aecdfceac4e9", "comment": "Malware payload (Smoke Loader)", "value": "d4536fc29126751d7c804354ebb7c2584a604f5507f0262f873cd5548a80dd9da0e94ac9d5c3e798efed1dfeabf12368", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252823, "uuid": "b61b3d79-aacb-4f04-a71c-a3f8d8c5b697", "value": "T1CD04BE213690CC72D141397058E6CBE1AA6EFD71DA248643BBD927AF2F312D0563E35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252823, "uuid": "10244ccf-0594-452c-9b10-a91a7f968fd2", "value": "e2b259c404978a1459509d0864ffd9b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252823, "uuid": "3d3512b0-5502-4674-83c3-f1fc3073bf09", "value": "3072:AhLFrB9qI+XFig3p5IerReX6SQjT0tzxJWtk0+:k9qI+VFserRgLMaxJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252823, "uuid": "794e32c0-fec7-45d8-ab13-1df3b08e3a8c", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252823, "uuid": "8611e638-2952-47f4-8f51-8e92ffb0cdb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252823, "uuid": "5d07c174-46e2-44c7-8ae8-99aeffd3075d", "value": "1c493aadbf2447c09faa0d340855b2e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9833cbe1-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (StormKitty)", "timestamp": 1628257543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257543, "uuid": "f9a2a9ea-6bae-47cc-a44c-7f97f22ffe84", "comment": "Malware payload (StormKitty)", "value": "4399c21e668cbe469401638c66ef0519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257543, "uuid": "7a3ee9d2-34f4-4485-ab0c-3e75104106bd", "comment": "Malware payload (StormKitty)", "value": "dd28e77b8a4352128745bf0a5b8a7df5dc2cfd7b80dd5cb0ea300d95098cccc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257543, "uuid": "c94b5304-a771-428c-a358-1f18e47070b8", "comment": "Malware payload (StormKitty)", "value": "6caabc0989fb59963f1178de1a528f0f50b7fe33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257543, "uuid": "90b15172-899c-4e54-8352-817d745528f4", "comment": "Malware payload (StormKitty)", "value": "a392a26f0a4566c5ff6f37bc75a4b3a9be60f8346def7d0763cc954a7a8cd74745a4cad5f7aed9be89f8302310f6e60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257543, "uuid": "41785a94-6894-4e74-8ba5-380f039515bb", "value": "T13B94E14571A38A20FBF384F8CBB7A82E32EBAD58413958796774FE161B7CBD45087019", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257543, "uuid": "f4917908-7874-47e3-b269-6d5284249c14", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257543, "uuid": "31f9207f-9294-4e99-ab5d-0eccd1878fac", "value": "6144:+/LAKDz4XXXXXXXXXXXXXAWkcDVfe7BKJwhfgJeDs4fTe+dbOQXXXXXXXXXXXXX/:cI7mW4DNxk/w1DBX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257543, "uuid": "057ecf0d-ac3f-4793-bb44-f848dcc0e61b", "value": 408502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257543, "uuid": "2869b74f-437c-47f5-87bf-a29a4469a311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257543, "uuid": "c1f14080-53d0-4f9c-bed1-43e65357c2f9", "value": "FC73GQTY0090TWI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0ffdb0-f6c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628260718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260718, "uuid": "60463b88-97ad-4926-9e40-236bb9163867", "comment": "Malware payload (AsyncRAT)", "value": "de1f9c942cbb4b01247cc93803d8cf25", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260718, "uuid": "ac133e7a-b2e8-475b-b8a0-f21841412942", "comment": "Malware payload (AsyncRAT)", "value": "dd7a3c0b3aaa7603a1aba2366b919b222f055528a3f1050ca02841a2e6134188", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260718, "uuid": "53770d85-ac3a-4de5-b02f-cf579203e9b6", "comment": "Malware payload (AsyncRAT)", "value": "2aeaa4033c62ce809b13ef8fe87ea208a3e7568a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628260718, "uuid": "3e2b9abf-ae9d-4119-8d15-f885976849a8", "comment": "Malware payload (AsyncRAT)", "value": "e9043f15ace8ac205408ebb532e30609448989faf9057507b1041dc65c39e9939e948b4c5d079640eb9174ba94ab4acf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260718, "uuid": "ceb4c94a-aabf-4ea0-a8d1-1f5a358ca5d5", "value": "T1B301FE1188DCB28653C1CADF89F89C15E842A3409B0A302D64E5AB0F081779203DFCBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260718, "uuid": "7a5a7f3b-a042-42f8-9c63-e2d17950c56c", "value": "12:v6IxommIV0+BnTa+/9+iM9+DOOyv24uxSr9+vM7ITkSSsaDehb:vjtV0QrhMpOSBa9TPSsaa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628260718, "uuid": "77e0c7b0-b284-4252-ae22-18a84914d548", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628260718, "uuid": "effebf62-d862-4109-9690-21126d6a967b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628260718, "uuid": "ff8d8c90-02ad-4fb8-899a-068c0e9d6730", "value": "KZYI335.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f997bc7b-f711-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628294213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294213, "uuid": "f1a9c35b-246d-4bdc-be0b-ee2ec1b69139", "comment": "Malware payload", "value": "066c252149d59c5952720b25d127f381", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294213, "uuid": "c06cacd2-3f1e-47e7-b408-11d693f21d9b", "comment": "Malware payload", "value": "e0e601b2b1f514081d893cba2d7ce5753c9db775bcfeddd7bc84d08a88659369", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294213, "uuid": "90d56558-063a-4230-ad1f-cde712046c4c", "comment": "Malware payload", "value": "6bff63538d37da2e44e720b9ad897e24f33f9b7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294213, "uuid": "9550aacc-a86b-4de3-a996-16fda697ed43", "comment": "Malware payload", "value": "428b4ba189f76d61bcd42e7874b9cb5e2bc0943afee469b0f3158d0baa667599dcb102a356f4c113a018c585edd956c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294213, "uuid": "c2fc05df-fe0d-41f9-876f-1214c6424fcb", "value": "T16A35BF1079A6C614E1EB7631CDBF80044BFEFE266522C71E749A321C9973356CA43BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294213, "uuid": "ebe821fa-edec-43d2-adc2-3c4437d3e2c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294213, "uuid": "a666b773-0d42-4390-ad1f-725c3a33a2f0", "value": "24576:NZbGbgX7InDMNjvlhmWQlw5wlmdbPG6+I1PPEOu7n:N17InghdVR+lqbepI1P8Ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628294213, "uuid": "84dcf0fd-2523-44a6-84ee-3624a076ed46", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628294213, "uuid": "3a11f94e-1e0c-475f-979d-4fc68cc128ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294213, "uuid": "e1d5073c-009a-4adc-90cc-038da452d36d", "value": "066c252149d59c5952720b25d127f381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adf2c16-f654-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628212826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212826, "uuid": "24c603b0-7a9e-48b8-ad69-ff3f20c2a444", "comment": "Malware payload", "value": "78c1154bcba17c3d636e698e81e8499d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212826, "uuid": "197aa4bc-4a9d-417d-8209-334c73d99d3d", "comment": "Malware payload", "value": "e30f605b81b59d626c31b6436e0e0e49c4f6248b43ab14ebe23f0217d6ad89e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212826, "uuid": "cb7677a6-81e4-4d39-a49b-88cda34a6a87", "comment": "Malware payload", "value": "d3c6554bf308536ffc5a9246693ede872f5f11ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628212826, "uuid": "86af3ff9-05d6-406f-99b6-a7c53da3cf10", "comment": "Malware payload", "value": "ca36f41d618d4a8f55e713d02e190be2df929bb9d9b8b7db794f3616c69f23d735e5f4cac3191d68384e163d111a99a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212826, "uuid": "361b2377-481f-41b8-95a7-7d25cf50062b", "value": "T1E612E72AF3D8873AE5BE5A3158B293010335F6489453DA4F2E8DA54B2DE73480B527F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212826, "uuid": "b5a055ce-8873-453e-a993-a02f6dc6165d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212826, "uuid": "35d2cafc-0cfd-416b-bb1e-06fdd78216cf", "value": "96:bEJuSguzDBV2lDX7Xmfw9kYZ2u7PuVVzMnzmjktdZCfR8v0/147yWJ860ntzNt:bEAlGzKX2fYJ3Pu4z2ktdZntx8tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628212826, "uuid": "26f250b3-c0be-4548-972d-e71364672d88", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628212826, "uuid": "a20ddd67-2846-4873-8886-0cac09f0d3f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628212826, "uuid": "218a5955-5145-4240-9988-6ee454f3ada9", "value": "78c1154bcba17c3d636e698e81e8499d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e81821c-f68e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628237609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237609, "uuid": "91bf94a6-540b-4130-afbd-a3ce1b64fffd", "comment": "Malware payload (AgentTesla)", "value": "5086497919cd3e08a315ba0c9c19e835", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237609, "uuid": "9e009b42-6024-401f-abab-b088deacf2e6", "comment": "Malware payload (AgentTesla)", "value": "e56b6b0e8c952292ec51717b619e4570126aed99c7faca77a734dfad09a0a800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237609, "uuid": "a9caa7ad-5fae-460d-895c-e6b9045c23b1", "comment": "Malware payload (AgentTesla)", "value": "cf137e97975f847d47299ca136893d51b9082cb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628237609, "uuid": "8ecad8c8-eb8d-4bd0-aa22-9df7eadb9824", "comment": "Malware payload (AgentTesla)", "value": "e481086c7d3de120960cbc3b02a6a838c9bd91aaf1b5d64f0cdb2de9d9f0ddd2e5dbf88a23e8b1de376a25495091a7cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237609, "uuid": "569b9c3a-d1c6-42e6-b1d8-6bf9248b39a7", "value": "T13005CE90E685A616C28818BF1F3DF67893EC5D8E05478041ADC4FE573BAAEFA09D35C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237609, "uuid": "b4c11bde-bc04-44b5-8929-ed61ef82074f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237609, "uuid": "1fced4fe-1621-4623-a456-0d9d68b5d6fc", "value": "12288:CsFSqUgLdDJEF9/DBa7qfu5N3BpGy/I03ZF/ZbFrxkl03iokMNjj/C/1jgt2NjFq:CTgrUgGfu5NxpGZ0r/5FuoDRmjgMNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628237609, "uuid": "45d3dd97-bfb4-4080-9742-df355b0a0f59", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628237609, "uuid": "4d8b3823-08cc-4503-8172-054db9b5fe5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628237609, "uuid": "4154f749-70e4-45b9-b608-94bfd3fb9e05", "value": "KB Kookmin Bank_Payment_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5872386-f6bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628257189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257189, "uuid": "7a60e098-7116-4d92-b9d9-4123a91f0ec7", "comment": "Malware payload (GuLoader)", "value": "708a4ae692e7f200aefc373af62b870e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257189, "uuid": "d79f8591-f564-40ea-b60f-cda566382122", "comment": "Malware payload (GuLoader)", "value": "e5a816999e872c25ee4802b2602b043aeb0660633a5fec196f6d4705799bbf62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257189, "uuid": "999a19b2-1cd9-4f16-a1e2-f2381f3a7bff", "comment": "Malware payload (GuLoader)", "value": "d88b1b991373a757148a131361d704fd5e070e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257189, "uuid": "24b613aa-8921-4365-86b3-acc6ef3a9949", "comment": "Malware payload (GuLoader)", "value": "ed96f0eb36a4e825fa2c42606a134e0f1149e41331a1a13b8a3a334813da8a4dfc3cd8a1bdd1f404db8edcb618c5074e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257189, "uuid": "615ce4d5-3887-47b8-a2ba-2080ae21109b", "value": "T117B319F071A39459F192C33D8733FA1BCBE378A3951E852EB101976A1173A8D9369237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257189, "uuid": "87d9919d-f80e-4017-ae03-0cfc49e1a849", "value": "b947ef57db12504396f2fb768b954d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257189, "uuid": "904c0eb9-a5ef-445d-a197-d8acfc60b97b", "value": "768:ZcZs5J9I4x4eQX8NnruqdCU1Dt/h8UE1hK6iCF0u98QaJZtgntTsOHGN2FEpFk4B:6C+JGNPVpeuCFT9MRgDbHkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257189, "uuid": "6c1a34e1-ecb4-47f4-90de-ce1a9ff5e202", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257189, "uuid": "318132c1-6023-4846-b86e-e0569a4832df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257189, "uuid": "a394e4c6-a8ff-4bdb-998c-7a0d4346dd7b", "value": "eMailShip Arrival document(s) awb #960597804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d409f514-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628256784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256784, "uuid": "3942da8c-7427-4942-a2aa-7896e96406d8", "comment": "Malware payload (RemcosRAT)", "value": "d1c95c0acf80a1600a595da3194c0159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256784, "uuid": "ca0554b2-afd2-4c56-b3af-3f216ffb280d", "comment": "Malware payload (RemcosRAT)", "value": "e5f79bde8290898a804457c994f654e33758135263c724c6b1c6fa44959e06b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256784, "uuid": "451fcf73-a68f-4808-aa39-568d0bd89d29", "comment": "Malware payload (RemcosRAT)", "value": "2b0b6da260c381e4ae15b7dd60511c98bdb7c80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256784, "uuid": "85003b79-bfb7-4705-9b14-ed187c3665dd", "comment": "Malware payload (RemcosRAT)", "value": "2a4d5537632203268764d2ebfc97add8dfda50d96c9644e8e5cc8dda4681784bb631db2e0db154c85196d8529801941b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256784, "uuid": "7001dafd-11de-477d-be76-17e29157137d", "value": "T108E47C52F3904837D663BA7CCC0B97BCA9667E012E24B5452FF93D488F79781352A18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256784, "uuid": "bc764142-e31c-4bc8-b86d-dca92430f578", "value": "a09d64195bff556eb90ba4781b170ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256784, "uuid": "5363b1d5-788e-4744-b69c-9018bf1b7438", "value": "12288:NlyPhGe3nf8jHmf/3AwhgFn33DdzQwcApa56Q0uGPxNfXA:NAPbaHLwh2nBZ6oukA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256784, "uuid": "82248e8c-3327-46b7-b041-94c6d5de8161", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256784, "uuid": "888ca117-483a-475e-9f9e-87d713a48826", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256784, "uuid": "5a9e8824-8e50-45a0-9e29-dbf9e9fd2611", "value": "Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bda08d2-f678-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628228102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228102, "uuid": "d0a7a83d-9920-4ab4-886b-3adf3d3fef4c", "comment": "Malware payload", "value": "022f855de08fd62cd1555605e11cc260", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228102, "uuid": "241d2f96-cd9e-42a1-ac4b-f6350f79777a", "comment": "Malware payload", "value": "e62a25171adc2602f2a856f5bf8923f83266960a1993dc3f4106f9bd3973703e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228102, "uuid": "e552b840-728a-4816-ab79-ea9d141a0672", "comment": "Malware payload", "value": "806a0102aba7e7f3d5e949e958c68ca4ee5e40de", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628228102, "uuid": "079c9da2-aa2a-4224-ac4e-7280c9f728c6", "comment": "Malware payload", "value": "7b922ac967180a531c359086989508d1aeb6a09db024e78c7734b57f4724f428ec38c4da693bde7f55c60cc595f555dd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228102, "uuid": "e37ff569-188d-44d6-aed5-3fd99d1fa736", "value": "T108D42332F6BDAC55F97F2C78A654AF88E6055B7B02A2E00C3E2D9C4637E11D3564F109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228102, "uuid": "18d7468c-f014-4159-ab76-930d5ab5e476", "value": "12288:vplMouB1pxUJ+UiO0rCZeXuISER0lHZvMxqfegSfQu0GP/oeGX7AQg:vS1TqisZe+Iz6HVferUeGX7Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628228102, "uuid": "2a4981bc-5674-430a-97fe-c0a270ec7f8b", "value": 620966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628228102, "uuid": "5000ec8e-2886-43b1-a67a-06dc858ed33d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628228102, "uuid": "4d4b1bb2-5d4c-4ab3-bc9e-263b3d56ed8f", "value": "notif-3823751.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b99266-f6ca-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628263689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628263689, "uuid": "5bda9cd3-a63d-4197-bc52-b010f746c9e4", "comment": "Malware payload (AgentTesla)", "value": "20201a45a4ed588beb4a894c60128e5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628263689, "uuid": "ba034653-15a5-439b-9bc3-c1eee75681e1", "comment": "Malware payload (AgentTesla)", "value": "e69229b8be53810406136e0a2a1c1638f35a3790d070658bde47ce1be9f3ab12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628263689, "uuid": "54ea0d62-8ad4-431d-b7d8-477d7e29c5d3", "comment": "Malware payload (AgentTesla)", "value": "f166bcfa01e9f8040f6dec6e4a877e8fb4fb3828", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628263689, "uuid": "ce9f16ae-7251-4d39-9dfd-d9559c16de8c", "comment": "Malware payload (AgentTesla)", "value": "b09db7cbaacd8b4cf0eac039dbe9df69eb7d87c8b730fef9ed634b8aa43bf66a5c06332dcd156de4a0bcb997dd3721ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628263689, "uuid": "077fa697-f6e9-411b-9c39-75b25f5cd830", "value": "T1F415DF703AFE5714E1BBE7304636914087F6F63BDB26CB4E2C64609C9A73A824712F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628263689, "uuid": "c74e655a-0c7f-4e56-9729-f699094301b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628263689, "uuid": "0e43c924-794f-4030-9d15-b3dc68d4b3c7", "value": "24576:zb0wFVMNjPEhTKeGCUDk5zGV4ESQMtYp:zYwFShP2TZGCUqzsLeap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628263689, "uuid": "8fc0d9c7-0a92-447f-a38d-a665ed14b7db", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628263689, "uuid": "ae086905-4c00-4cab-aeff-b3cd0875e925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628263689, "uuid": "72f376a4-eb70-4e66-b518-108e3d6a96fb", "value": "MT TBN PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6aa225-f6ac-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628250488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628250488, "uuid": "0ef3a25c-1beb-4c61-8f43-ea73de8b1774", "comment": "Malware payload", "value": "fe2a4f1be1fccb8caab33d62ade2bf87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628250488, "uuid": "bc8176ae-05ff-4989-b903-710120a24bb3", "comment": "Malware payload", "value": "e732f80e4d62ef847bcd0e50efb3b2256e140b9866c4bf7a6459a3f0ae456966", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628250488, "uuid": "7f60f5f9-6858-4668-8fcb-f2000a3121e5", "comment": "Malware payload", "value": "52237b46925f55e218e425993dceb23d74241499", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628250488, "uuid": "5654bb06-ab82-4818-894d-5d909397640e", "comment": "Malware payload", "value": "07d207a3ca880ef8867c87afd57ba723f7321987cfd299665596f9034dbb949d4023cf3831705afa26fd2a6c343d9df4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628250488, "uuid": "a3c43e90-cd7b-46e1-9a96-5a6784dc2790", "value": "T18A6402AF99777C8BEE1B0FF021A70E4E5AFDD2CAD2C668906255048035FD346A2507CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628250488, "uuid": "eeea578d-2243-4187-95bb-f69ac9153679", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628250488, "uuid": "013d93af-4dbc-4797-9550-8accedf8c478", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628250488, "uuid": "01c95878-9f7c-43e9-b8ed-afe86a3d4079", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628250488, "uuid": "3be56c6d-bd44-460d-bd6e-57b461a88ef8", "value": "fe2a4f1be1fccb8caab33d62ade2bf87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254418ab-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275389, "uuid": "b78ae701-eb11-4e5f-8537-5fc2b76e7cda", "comment": "Malware payload (Mirai)", "value": "483da871a823919735fec01f59109efd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275389, "uuid": "ff761bb9-7396-4204-9721-315df856eff2", "comment": "Malware payload (Mirai)", "value": "e7ae7a4518f2cc6d8d8aea3f0bb9a43ea947e643df0fbd67987c20b15ae70d06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275389, "uuid": "f04d2213-9f2e-4511-8ecc-32a731f7c474", "comment": "Malware payload (Mirai)", "value": "743ba401e74f24f6a804bd8be30ffa1fa80bb171", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275389, "uuid": "39afa18f-c6a4-418d-918c-300834765373", "comment": "Malware payload (Mirai)", "value": "9756108cb2eb85a7ca204af8da7681d14f40c8deb192a985dda570f295a17c5810de3502bbbfb71444a38cfe0096d919", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275389, "uuid": "5b8e7ebd-ad25-4d50-8017-9a11e160c8c6", "value": "T125E2E1269CD8373BF37AAC70174E67B74BCC3AC19A8C71072B96066CC5A646FA41DD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275389, "uuid": "39b846b9-8fbe-4da0-9997-9786ba21e1a7", "value": "768:EQdXNd6xyoEJYWzd7B+uxbh5k0B3oPvssyvZUSj8:1dd4MYWB97xbDkSo3ssyvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275389, "uuid": "e96badb6-b559-4c65-b39c-7a8651d9e563", "value": 32684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275389, "uuid": "9ce70d0d-edb1-405d-a75c-58b9c4d11c13", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275389, "uuid": "5d8cd567-d05a-4f26-9c4c-6c90fa88807f", "value": "483da871a823919735fec01f59109efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75488a94-f6ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628256625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256625, "uuid": "fa88d75b-1cfa-4cf1-8d65-ee7737616e4e", "comment": "Malware payload (SnakeKeylogger)", "value": "9874557f4e281bf0fce0298e5f7158e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256625, "uuid": "8a1ee987-6d09-4cb0-9b7e-3e5a517d0906", "comment": "Malware payload (SnakeKeylogger)", "value": "e7def3c5e90cc4793a32a6637e8390b504f5df9734e434ae19871365f0df2209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256625, "uuid": "e37ba99d-e714-48c9-9bbb-c050ce4e2cb6", "comment": "Malware payload (SnakeKeylogger)", "value": "35594ef175a8a43e584029f66697ce40697a7a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628256625, "uuid": "4d2d39ad-e01e-4814-a04b-97ee6052dca1", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f48c2e627d00ed6f04e135505280695358486ea77bd6830df9d8f6d9c5117a613a0a6ef856e19e8cc5894495b94c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256625, "uuid": "ca284526-14e7-4f6b-b800-5c5c2db4b792", "value": "T1F405CF343AEE1314E1BBEB74563191408BFAF537D713C78E2C25649C9A73A828712F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256625, "uuid": "6d2aa0b2-ca0f-4881-871f-c12f59c71a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256625, "uuid": "1c3c9b1d-ce6e-4afc-87f7-235a177ec475", "value": "24576:zQYRTb0wFVMNjosHgWXCGj1LND4ORGP7f:zTYwFShFHgWXd1L9Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628256625, "uuid": "7c668b89-2fcb-43ea-bd5a-3ce50939d101", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628256625, "uuid": "9c49e294-84b8-432f-916d-27c33f9f8a25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628256625, "uuid": "61ace8bc-db5e-46ea-9792-682ce1f475f5", "value": "Devis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074aaad9-f67d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628230241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230241, "uuid": "b3d9acdb-16dc-4f10-a78f-865c35d753a9", "comment": "Malware payload (HorusEyesRAT)", "value": "1e2b7728f6db35af799760a123542fee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230241, "uuid": "dd7ee7e5-7950-46ca-a4be-87da35f50a52", "comment": "Malware payload (HorusEyesRAT)", "value": "e8ef46e417bedaa21c478313cd8f007eb81a8f7099b796d62a61d67b95974302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230241, "uuid": "8574a285-708d-4f24-8e54-ee5baf076276", "comment": "Malware payload (HorusEyesRAT)", "value": "c43a77b06cb7ac60b657cd0b9de930c3d92081f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230241, "uuid": "8ed80cc6-fa98-4f98-8325-60debaa3a0bc", "comment": "Malware payload (HorusEyesRAT)", "value": "7c6942eab6b2d46759692fa4cb2eaa07ee3679a29fe4e5e05d049fca759d7e4722f8374d0e365fcbe9463ee1ffb93154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230241, "uuid": "3984ce65-470c-4123-841a-b0e67c994c0e", "value": "T194D2BE0D73D9CE06C57D4EBE297303011379B20B4783EB8A1DDCE09B9E9779846225A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230241, "uuid": "0df6ce0f-c192-42e3-bcab-95deca864db6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230241, "uuid": "a7b67578-e06c-4d72-abb5-7de4166424f3", "value": "384:7hmEOXbEyhb1PzZXm+oRyVl/D6lyVuXHOpArj/XQqneLZbU8VYrVWe9kSR9tr61E:lmvrEyVXqRsruyAXusjBE1VxGUE2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230241, "uuid": "af91e388-c72d-4a9a-b107-6fe65bafd552", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230241, "uuid": "ddfdfb19-5cf7-450b-9b8d-802412afe2f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230241, "uuid": "4ac2acaa-6755-458d-a029-808637873ec9", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e550d1a4-f684-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628233620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233620, "uuid": "e6cd1fa1-99f5-4080-846c-754a3a8b4a22", "comment": "Malware payload (RemcosRAT)", "value": "e312632ef9548565eabc682af0fbc369", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233620, "uuid": "843a043c-34d4-48b5-9b75-500617431834", "comment": "Malware payload (RemcosRAT)", "value": "e982ae5ea3e7d8b92372076442bd0f96a572d974a2265c609a0cc5e4b4eac9cb", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233620, "uuid": "89fdc756-d26c-473c-8e5d-4cfca64ac59b", "comment": "Malware payload (RemcosRAT)", "value": "7c707c2f0600729e9954d3f2ed102643cfeb108a", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233620, "uuid": "946e1ff8-45e1-4f9c-aa44-50085b9f78e5", "comment": "Malware payload (RemcosRAT)", "value": "ad1f49e8fa87302a5cfb115bd800b90ed83c59cc6c8cd72955f0ca950aeadea50778cc22b4b54efb11284d9490b8ff04", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233620, "uuid": "cfcd5e41-b56a-4481-a2ee-6692ceda0414", "value": "T11AE48D61F3614873C2627A3CDD4B53ADA826BE412D2473466FF93C489FB9341392A19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233620, "uuid": "90f410bc-a131-45b0-9126-f264c1295175", "value": "a09d64195bff556eb90ba4781b170ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233620, "uuid": "18001a49-62dc-4f0d-af12-27ce33d100bf", "value": "12288:TlyPhGe3nf8jHmf/3AwhgFn33DdzQwcApa56Q0uGPWNfXA+:TAPbaHLwh2nBZ6ouTA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628233620, "uuid": "0f0a7745-3c99-450e-9632-61dc8711d75e", "value": 722152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628233620, "uuid": "40f53586-3017-4b5a-a80a-a58acbdf7b7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233620, "uuid": "f218635e-afeb-4f90-86c5-017b2e6852c3", "value": "PI#443536_Clvginpxlcltmugbbdjzhthnvqtewvwkrs_Signed_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680ff0eb-f6e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275930, "uuid": "f0e0bf80-6527-4e63-8758-bd5e95e76fb9", "comment": "Malware payload (Mirai)", "value": "eeb44d7e78d471f8c0cc071fb0a880a1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275930, "uuid": "362ffd85-bfaf-44b1-a7bb-e4e6f3032a6e", "comment": "Malware payload (Mirai)", "value": "ea9e60c57b0a8aa3a335004cdf8f0409151aafbb2645096269ef81759fb1c071", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275930, "uuid": "9a3025f8-8bf0-48f8-a499-56af06e35edc", "comment": "Malware payload (Mirai)", "value": "55b57a985478db3be8a911b600c6643fe80beba9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275930, "uuid": "b07477c9-a0b0-443a-9651-071eb02160d1", "comment": "Malware payload (Mirai)", "value": "9d5266d7fa14920daf85a56a3e52ef62020690d6c6d60fcf5957b881468b621cd35d7b6dd07e1c9221d46b38e4728c58", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275930, "uuid": "1e0d81aa-c324-43ff-a423-1e63171567be", "value": "T122E2F1644EB5A301D05DD6BB44FF5F22ADFBBA5C0D9A0281D2846BDD9AC0CF41CA4C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275930, "uuid": "fd7073c4-388e-492a-a821-229b0d02de8b", "value": "768:L2GzdfWBGrnXvH2mPvoUfAQZOIZKgEoxz:Bf2mPAU4zxgEoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275930, "uuid": "0f27e0c3-dc77-4f84-9010-c060e8fc4ebe", "value": 31308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275930, "uuid": "cfcfa879-3847-49cc-abe0-793feb7a1154", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275930, "uuid": "26d71d29-bbba-4245-adc6-1a7ffb433c96", "value": "eeb44d7e78d471f8c0cc071fb0a880a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07212720-f66a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628222081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628222081, "uuid": "68086481-c1c7-4a1c-97d1-71f5ff92953d", "comment": "Malware payload (AgentTesla)", "value": "cf684c8028ef1845f51ffb9864bb7acf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628222081, "uuid": "fdf869c9-1bb9-4611-aa0a-6e781a68fb27", "comment": "Malware payload (AgentTesla)", "value": "eb62cecf43b2e2b3b9ed73bf2354f4387f8b9bb83dea24956be5602da1163869", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628222081, "uuid": "48bb776a-3cf9-4549-aa11-99d75a48317d", "comment": "Malware payload (AgentTesla)", "value": "1b9cd7a9285865418095e2c38c6685fee346cb22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628222081, "uuid": "97250c2b-4c36-42ac-bca9-681275b853e5", "comment": "Malware payload (AgentTesla)", "value": "4deb8c55c2c4dc7eb2bf7faab065bd4c397427be5bf61b23097d190d54c48f9b6d681cf9ccedcc97260554f155dd6029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628222081, "uuid": "d44dfabb-c38b-435a-834b-7ae8facdbea7", "value": "T1B7F4F0A1A2940B23C49C267B0F3AD5B517F8AE491525C14A3ED87D973AFFFE706C2481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628222081, "uuid": "4e48b3b8-11a3-435b-a0be-48eac392d1e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628222081, "uuid": "4f6890e2-edce-433c-a72f-9f7027a23351", "value": "12288:8w0Eds4BqRec0VemF7GhFgkz/DxCzduPflMCPYopgzkC+q42y8U/1jct2NjFdB:8HEb0etXdG/gcx+duP9z19C+fDjcMNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628222081, "uuid": "73f5fc71-e7c2-4419-a8c3-7a1b2519d3bc", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628222081, "uuid": "13669fd6-5fe9-4905-be82-4433a557f142", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628222081, "uuid": "47f155fb-4b24-4650-afd2-0c2a8c0ea291", "value": "dhl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a7dd3a-f6bd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (PandaStealer)", "timestamp": 1628258047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258047, "uuid": "bc3be1f7-b2df-4654-b1c4-6005cbead420", "comment": "Malware payload (PandaStealer)", "value": "92241e9deba2241135690963861f0ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258047, "uuid": "872d5522-3f9a-4464-a4f1-dbbe739eca71", "comment": "Malware payload (PandaStealer)", "value": "ec346bd56be375b695b4bc76720959fa07d1357ffc3783eb61de9b8d91b3d935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258047, "uuid": "51f5f903-ca69-427c-9d56-240ae9b7da01", "comment": "Malware payload (PandaStealer)", "value": "487d114c2fffbeed6183619ad96e07c91ddb1af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258047, "uuid": "b0d27bb2-9314-4acf-88b8-4962e58f1431", "comment": "Malware payload (PandaStealer)", "value": "f011661d989a8d5d7ddf04033bcb5c7ab7ddfe5aebcdff7b5c36f809a092e95b6d28a7272640e87b80f1d5cacf7b9690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258047, "uuid": "dd4fb884-bcfd-4402-8d3e-e5b78b1334d4", "value": "T1ADF412907AE96B1AFBFE87F500B3644043FAB62F6A62D50D8DC194CD3C65F818251B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258047, "uuid": "b4500079-c4f3-4973-9af0-f59e6cd50fab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258047, "uuid": "81a07f0d-2976-4f4d-a1e7-513444c8657b", "value": "12288:maCrCrqcJhRuNs9+g4snRefAwLxZmvUiTQvUOSvyPgBhd/Sr6+GgE9pMXLhU:7IwJ/usoLxERQvUOgBBHSkgE9pMXlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258047, "uuid": "74f1111e-a5b8-47a8-91db-665b9732cdc5", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258047, "uuid": "dcf20df4-249e-4653-b005-97ad9cfadf36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258047, "uuid": "278d4b93-1d10-44ac-b37b-4167ddcb5f53", "value": "92241e9deba2241135690963861f0ddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14710e9-f66f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628224567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224567, "uuid": "2082c64b-ea34-4404-8807-c2a00a25dfcb", "comment": "Malware payload (Mirai)", "value": "ca473ee7b7b24e87ed3abf165b6de028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224567, "uuid": "eb253350-b81c-4008-809c-23edaa9f05a9", "comment": "Malware payload (Mirai)", "value": "ec663beb5a1c638ed1a79e8bd77d2ebd181718d67347bccb7af378c1b2afe053", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224567, "uuid": "7ffd5371-b37f-4f36-b348-3df31fc7951e", "comment": "Malware payload (Mirai)", "value": "5b1fcc407cd34e4ae4bc7bfd46fa12532a9ed387", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628224567, "uuid": "153a2eb7-f7a7-4d1c-8b88-e0be1d9f1ca2", "comment": "Malware payload (Mirai)", "value": "970bcb17aef5a9b6738dbbf9ab4fe4fdf305a8af72ae706c4abe0430530579f0adb5e28435230a9a1f8f1db59e2a3883", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224567, "uuid": "35be48da-43b6-4d55-a1c3-84b70f52a9ea", "value": "T163639D36E40A99A4C0834634B0E2DE351FA3A9C043672D76AFE446F61403EACB55DFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224567, "uuid": "96f59b51-5134-4c10-a9bc-1f50a5c1ac99", "value": "1536:HaG7dobeF5VwtHgpNkfvp4Q/Ni3j3XGB2OACzV:HvObePVABuXM2OA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628224567, "uuid": "fa296030-a11f-4c55-8019-455c7c36263e", "value": 66952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628224567, "uuid": "176f54e0-7d10-4b6a-84f7-4ad17231584e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628224567, "uuid": "04add1c5-5ec4-4157-ac3f-ebdcac48b04b", "value": "ca473ee7b7b24e87ed3abf165b6de028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422bf268-f67d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628230340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230340, "uuid": "896552e9-83c2-487d-8c28-5328f79cc8a1", "comment": "Malware payload (NanoCore)", "value": "4956ceb3fed384172bbffe30997fc515", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230340, "uuid": "e6aac043-0b0d-474f-b550-da550287b7c1", "comment": "Malware payload (NanoCore)", "value": "eca5a099031d8e068b7ca0f30c48ba08f72fb018552e6b647ab67652a325fb9d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230340, "uuid": "2a3254e7-a74b-4ba8-8710-d4f8f3a88858", "comment": "Malware payload (NanoCore)", "value": "d0305d87fb64e08cadc0487c8ce9bdb334b72255", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230340, "uuid": "447bc8cb-861e-4f5c-96ad-0374b37450b2", "comment": "Malware payload (NanoCore)", "value": "f84581990ac542c0552c1b196167a25e58db6483d255a04b8c18146ad100bbdbddd27f25de3391e7c811f1b0ef0e9d1d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230340, "uuid": "c1c4a232-b966-436c-9bef-237bfbd5ab01", "value": "T15CE43332B47E3994A9170370E545F6213E7F48AF99595337C2BDC20E086C6E3906DEAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230340, "uuid": "15fe782d-bc9c-45c8-803d-68c5e63739f7", "value": "12288:upBYBxsOHT3wC9ZOUxcjsTRbDF8QzwUaI8VaIMqhav1AemEhsFj/:0ynsckC9cOc4TFjB8831v7mE+FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230340, "uuid": "0d9d758b-3741-4ee5-8666-3918d3bab386", "value": 663421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230340, "uuid": "bb4e45f9-a51a-403e-9d81-2d86a7f6c4c5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230340, "uuid": "842f8bb3-ea45-4493-b5af-57ca7056226e", "value": "BOQ-DOU-2021-09-02.bat.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f41bd6-f711-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628294132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294132, "uuid": "4439b473-8419-4c3c-9997-ffb99b38b774", "comment": "Malware payload (AsyncRAT)", "value": "a40c2bf784b33d54752428c42e28ee6a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294132, "uuid": "04b1f453-0ddd-4a0c-b94b-91a263cb492c", "comment": "Malware payload (AsyncRAT)", "value": "ecb8839117d73d33390c84f7f6e02f4970156ccb2da7b48083922f60625fa8be", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294132, "uuid": "cdf924b5-05cc-4af9-ad24-cf8e126daa3e", "comment": "Malware payload (AsyncRAT)", "value": "d0dd11c51a0a729720616a59c4d45c1d73e5729c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628294132, "uuid": "5e1f1d92-63db-48a6-901b-805269839067", "comment": "Malware payload (AsyncRAT)", "value": "16a5bb916bd98a2f20de6248aecdf316aadf0f74fbd0d64b6acddea29d5aa9f1608d081625ae1601e1f6a16faea1b5e1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294132, "uuid": "18220b89-c32e-4304-b9fd-854298b1477b", "value": "T111231B0037E8822BF2BE4F78ADF26145867AF1673603D54A1CC451DB5613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294132, "uuid": "089c3855-5bbd-4008-877a-39677d45b9c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294132, "uuid": "04254a9b-3529-4a7d-8429-668b7b8ea416", "value": "768:Duir1TUEFSuWUow3kmo2qzQwzBNVZGPIMPzjbegX3mEobB5VumF1EBDZ6x:Duir1TUKg2JWlvMP3bhXWhBymF0d6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628294132, "uuid": "ef629454-7255-4475-98a9-ba9730ef2e4c", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628294132, "uuid": "0dea356a-2419-4a7a-9e52-a4ddf6cb280e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628294132, "uuid": "662a1914-c04f-496e-966f-a0f825487a4c", "value": "a40c2bf784b33d54752428c42e28ee6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707d9f91-f6d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628266496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628266496, "uuid": "e27169ee-9496-4f63-9e12-67e21ede4a33", "comment": "Malware payload", "value": "259c75e4a960a53d21ac2f44b844035a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628266496, "uuid": "13f70825-e73c-48e8-a9c0-c91444c57f90", "comment": "Malware payload", "value": "eef5d903a7e1eb2b6ecd93316efad2bf00def8fd4466dae0157615726a46ba4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628266496, "uuid": "302e0944-38b3-4502-86d3-a7b0c78f1e6d", "comment": "Malware payload", "value": "4d89d7a922325a1059f8d0b19d5aba8d0ff9d25c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628266496, "uuid": "4f88c555-99f0-4314-a416-3c8e08ab2836", "comment": "Malware payload", "value": "25f2801ea2f9f9159bc31bdf90f5a5a47a6b6109e9aa5d1025dee2a9c003f8cc9ae0b6207b12a93ecfa00021b6646494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628266496, "uuid": "c0ac5ab2-738f-4e86-a72c-72b481a1e0d3", "value": "T12BD2D010DB9C0429F836CF7855F3BBC54735F191892FE72B2DCB026DDD905289A602B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628266496, "uuid": "80025758-9ae1-4078-9aa5-1e8de3beb063", "value": "768:mK1dFlRITXm6v26CuMIZ0zaFPx+inHCCINuev00GAsVkYF9jE6hax:L1zlCR2doSQPx+YnOu400qVkYF9jEyax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628266496, "uuid": "393ed927-7528-4cd2-b48c-91a5dd943b8d", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628266496, "uuid": "17ce4eb2-4190-46de-993f-72f2e19d4f30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628266496, "uuid": "0f0da6e8-ffc7-4e55-94eb-9003d518cc07", "value": "259c75e4a960a53d21ac2f44b844035a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac82af5-f6bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628257547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257547, "uuid": "4347e957-d5dc-418e-975d-e35af18bc3c4", "comment": "Malware payload (Formbook)", "value": "09ac3d54f584db5184760a6a1023ffd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257547, "uuid": "3c98cf09-cd13-4aa8-be34-300d8a39b658", "comment": "Malware payload (Formbook)", "value": "f0e5f425b27be304c21b4d472ea8f67dc134e1f813ec8405f07389b2af7c58bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257547, "uuid": "520c9b32-e75a-43d2-825d-3ef5986ac2e7", "comment": "Malware payload (Formbook)", "value": "3a00794766a64da95986842b2210cb846e0e4576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628257547, "uuid": "8551dbc2-f6f0-47d1-91f1-de3bef4d68e3", "comment": "Malware payload (Formbook)", "value": "b5ac5df49765206647c84401bb0e7ea1d8ddfbbeff59ab69a86fb7c751e92e9e60d91d4a585df9d638465ca64836f2c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257547, "uuid": "93fbaddb-5e7e-427e-a254-8f336b011787", "value": "T1B7057C2229EB114DF3B79BB60FC4F4BF46AAF673560AB0F639421B854722940CD52736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257547, "uuid": "16edcaa3-2756-4701-8ea4-8e1359c9f264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257547, "uuid": "c75ca711-c9fa-4aba-a9d3-38c2d3bdcc2b", "value": "12288:QWjR+6AqZRoR65AXwgFvuSS1IylAX1BC72V6L5jvxrW3X/AxmIVyIX19zcif/W8d:ToR6qgZlsj6tZrSvEj5r4+PvPCUDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628257547, "uuid": "00c96270-f12b-437f-936e-2ecbdeb89c0a", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628257547, "uuid": "9d709f50-6b24-4393-8621-77727e113e38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628257547, "uuid": "c8d35628-0baa-4520-94a6-25e80e5c40d3", "value": "DOC040821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e9fb9b-f6e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275923, "uuid": "2022f328-f83d-49bc-8853-2c3d41a22be7", "comment": "Malware payload (Mirai)", "value": "d88d599adc539936f4c322289df77be1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275923, "uuid": "f88f15d8-a913-484e-b27d-7e2992cce722", "comment": "Malware payload (Mirai)", "value": "f2ecef6972fa7be407cb5576547d0bbca6bf778cc26ce02ca5a08bb884f58d6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275923, "uuid": "03ed8d78-9d1d-4ebb-8421-1b055c4a4f50", "comment": "Malware payload (Mirai)", "value": "834d1f19e348cc64f0c5aa5407c16bf934596344", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275923, "uuid": "0ccee06a-5fd9-4d99-a645-85743b1e68cd", "comment": "Malware payload (Mirai)", "value": "d9f720861b9d73376de151bd59742fba528bc34b7090db8beee6904a4b323ccdac8805259910bb8427aa9fc142ecf549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275923, "uuid": "dbb1e198-dded-4919-9944-361991d89f72", "value": "T126E2F1F79124E33CC46711B58BA1F68CF61668E463857A4003850DA3E8A71BA2B61FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275923, "uuid": "5552c22f-fe9c-4f03-ab36-88edc8593107", "value": "768:H8nowK7gZEr2xeCdPytk9jowehybY2TnqZ62qGREq0TcF:GpE6E7kR2hyM2D062bGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275923, "uuid": "97a87019-032a-4235-b0c2-7b8549903e5d", "value": 31468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275923, "uuid": "d9de71fe-9759-4924-850d-329232db92d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275923, "uuid": "e1359f8c-a5bd-4aff-b54b-7d33aa30e85a", "value": "d88d599adc539936f4c322289df77be1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13169b8-f684-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628233613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233613, "uuid": "fd9e6b81-a7dd-4b2b-93e0-f3ccf18243af", "comment": "Malware payload (RemcosRAT)", "value": "1870e4082c71f91981883d7db966a7e7", "object_relation": "md5", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233613, "uuid": "d1b7058a-a54a-43c4-a8fb-0967b4d3db17", "comment": "Malware payload (RemcosRAT)", "value": "f40ea734a3f51749e09b1c4db8ede2ca4cbc07ce4be92732bebb4cbb201bd352", "object_relation": "sha256", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233613, "uuid": "c2db3632-f0e1-4490-94ba-bedafa20d950", "comment": "Malware payload (RemcosRAT)", "value": "9c01d3adc777970af581551b188ec9411e763724", "object_relation": "sha1", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628233613, "uuid": "d6f9b1cb-fcfa-4666-99b2-96871c6247b0", "comment": "Malware payload (RemcosRAT)", "value": "6310c72a0c7c1a321c721470cc882804c18195b372f99b10430ac8ec2656fb29dd318f8b283f9def62aa9f502a602f8e", "object_relation": "sha3-384", "Tag": [ { "name": "185.157.162.100", "colour": "#8E47B3", "exportable": true, "hide_tag": false }, { "name": "express-gus52.duckdns.org", "colour": "#6B44E4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233613, "uuid": "6f8a5f88-7e5b-44a7-b3ba-cf64b7914e33", "value": "T18E7423ED79B6EA949C13AC32630807CDB859D4ACB71DB0F391F27A04AFD738C05965A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233613, "uuid": "aa613dbf-8ab6-42d1-ae4b-8de56b8291d7", "value": "6144:5hg5P8hrNYjdM5qOkf3gw3MKcLtRgxn7eqHrmqc6GnNHKM+2i2KmsRlLdzv7ANZC:TfVNYjdFgw3sjgxniPqQFKJfNTDmDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628233613, "uuid": "4af8623c-67b7-4531-aba1-56ee468b5336", "value": 340294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628233613, "uuid": "f17ce506-2323-4838-a2c1-b50a9df71795", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628233613, "uuid": "506e62d6-2bf6-4352-aede-c560b4254360", "value": "PI#443536_Clvginpxlcltmugbbdjzhthnvqtewvwkrs_Signed_.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0b6618-f69f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628245124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245124, "uuid": "536452ef-ad34-45e5-907d-71d98684b63d", "comment": "Malware payload", "value": "ef70efb6e885047f42ea3f93164ef9ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245124, "uuid": "c7ca83dd-4f59-4a8d-9f8e-f42cc10d9b90", "comment": "Malware payload", "value": "f449def15ea89b554018005cd897a9564c0312e15b9a57306d7a48e4857a84f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245124, "uuid": "97997370-7dac-43f5-91ea-46ec4e6e0a33", "comment": "Malware payload", "value": "526f1f36a9100329736811ba3f322c1539f53dd7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628245124, "uuid": "4621692c-3233-4533-ac73-d8433528d920", "comment": "Malware payload", "value": "4ad97c520619fa28ab765afa80600c88d61b6654cbb2fbb97abac5dfac2966aa8cb151dbd915c975d7af7a4378bb2ac9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245124, "uuid": "fabfbd89-004f-4740-8726-99f1a723973e", "value": "T1CAE1F59EBA49C01A739D76C3FFF88851120C72BEC5B6F5EED126B974254C097A0D8272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245124, "uuid": "95a55f98-9f07-45f4-b259-2a62183184ab", "value": "192:0KrUfNEb5zGZZ7FvvfD7e+nFn0EZ77L2RIfz59AD7D+nZ1EZ77NfZvG59AD7D+ni:0KIfNg5zGZZ7FvvfD7e+nF0EZ77L2RIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628245124, "uuid": "b8097c2d-ac56-4515-8a41-7d36c08c2248", "value": 6973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628245124, "uuid": "f10ee835-3de2-4ac5-ae67-c533feb4c617", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628245124, "uuid": "c696bec2-6466-4f94-8c2f-925732ae411f", "value": "f449def15ea89b554018005cd897a9564c0312e15b9a57306d7a48e4857a84f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561bcad5-f6b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628252707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252707, "uuid": "d9c036cb-dcde-436d-a4b2-f8b18f14f858", "comment": "Malware payload (BitRAT)", "value": "1bf1d6e8ef16cccf201173d11aafe00e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252707, "uuid": "97eb3ff3-ef65-4473-b827-64f714d536e1", "comment": "Malware payload (BitRAT)", "value": "f5481cd3d77f9e73b0e1a2425bf32886d2ff78f872a278b3b2dc0b00a35d1e95", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252707, "uuid": "6cf86423-7b83-4b10-924e-f7d1fd0c5220", "comment": "Malware payload (BitRAT)", "value": "ff3866b22e80acdf4175a1f496422c4736148bb0", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628252707, "uuid": "bad4a67b-1df5-4f3e-8914-907048d360f8", "comment": "Malware payload (BitRAT)", "value": "197564dee103b9d4e20e95e4439e36476a3cf5eb993308ab13143ffa4886293b064a5a51e53cb7bca6224787bff89633", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252707, "uuid": "6cba9205-8e29-4023-b206-5b805693aeda", "value": "T11DD522E2FF838879C14F4079623D77374FBD5A680661ACC3D7806CD91B76952A6B8283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252707, "uuid": "8d766d4b-13f7-4ff0-90da-8a81bc551bac", "value": "fb0fb8edc31fffe9bb05edbac608d5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252707, "uuid": "e5c334e3-2fdf-499d-b3e9-9722bc0c684e", "value": "49152:p+8EoyPJJFc4sIe7yAsxjTNwquM4e04xvbjATC2z+v2:p6PnFc4szuRHYN4J2zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628252707, "uuid": "d3c5995c-4b3d-426c-b225-eee4cdc7ba9d", "value": 2747896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628252707, "uuid": "4faedbaa-6b37-4231-8388-f27ee7d9e258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628252707, "uuid": "54edb964-84d3-49d9-aab1-f2fad58717e5", "value": "1bf1d6e8ef16cccf201173d11aafe00e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef10ddc-f64a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628208538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208538, "uuid": "90f4f031-4d02-4ea0-88e1-70d6f406a672", "comment": "Malware payload", "value": "39991c5e94a83a32104da4c4543e74d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208538, "uuid": "f0b2e843-0b9a-4f14-a68a-b0256d21dd50", "comment": "Malware payload", "value": "f5ae5673c708d66fcd7b9dd7dfa4480fabbccb12bc289e23db16cd5502e0b4ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208538, "uuid": "c9497c4d-0209-42af-b8da-81ed5cdfd6fa", "comment": "Malware payload", "value": "02e30bfab47596eb53897a5dfc6509b5f5e0060a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628208538, "uuid": "2591b0c9-4032-4484-a1c1-e284a75b69f7", "comment": "Malware payload", "value": "41ce779dd1374c5e65879b4575ce8b0ff370365b6486dcec68a01dbbf8b458b5c293cb615c0df051be7b23d35c3037c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208538, "uuid": "a79c11b1-bbf2-4f7e-9974-e5c6ad3c9d9c", "value": "T1A512E729F3D89732D5AE1B7218A383100375F7999843DB4E2D8EA64F2DA72480B427B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208538, "uuid": "7e189b02-5f61-4850-880a-ea7c874f9cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208538, "uuid": "50c52bf4-b0a2-41ed-b0cc-b449b1c6db7b", "value": "96:5wEJuSguzDBV2SLnJU/JPFZ4jef7Puy7MnzmjBtdZCfR8H0/14syWyLHsOVzNt:eEAlGzHUb6eTPuPz2BtdZfqKLBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628208538, "uuid": "4b11808b-05bd-4271-b4c9-ce6735cdb160", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628208538, "uuid": "e9f91020-faa1-4a53-a737-96d74553383d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628208538, "uuid": "d65e8e43-4565-461e-8f3c-8e8ae5422f7c", "value": "39991c5e94a83a32104da4c4543e74d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3ddfdc-f6bd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628258029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258029, "uuid": "f6e509cf-b633-427c-bc91-50d22975b2de", "comment": "Malware payload (RemcosRAT)", "value": "aaf0d50959980eff3e49bc94c3048f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258029, "uuid": "3fd2c513-1a86-4b3e-8ca0-c1859abcd3e6", "comment": "Malware payload (RemcosRAT)", "value": "f5d2a49f8800562ae2edb68fb838b64196844c2425fea90663baf4f7d7776f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258029, "uuid": "0e41f62a-8987-4487-9651-33c160740ae1", "comment": "Malware payload (RemcosRAT)", "value": "8c6e5691078b7bcbc8c39511a48a313a1e5bcac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258029, "uuid": "82f8c9cf-a2c5-421f-a568-1903b2ca6cf8", "comment": "Malware payload (RemcosRAT)", "value": "7d566a1a3fc52126f4681913f6906243a90ce6ac107d4f985ab98c624a9167657433f5ed91a8e72fabf0cca1da1b3e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258029, "uuid": "b175cc27-02ba-47a8-b329-37117534bc09", "value": "T1A045D01222D49A68F0BE9F75A778449803F1754B9723E7AD694422ED8F36746CB23333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258029, "uuid": "086944c3-e52a-4cca-a788-8725fe5cdfbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258029, "uuid": "b678a928-9e39-4e75-bded-c1528760ec1a", "value": "12288:xWnS2djg2Vr7QeFIsAjucAnJXqmjtirGi4tn/vJgs0wN1+dHNR0+75U7+F+IVc:8So59c0Jamj2GjtnLwm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258029, "uuid": "6f32ab9e-8c09-434f-a1e3-b4435a7b4fd4", "value": 1271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258029, "uuid": "b8a5c13a-33d0-4d45-b07d-c8b9c582fb1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258029, "uuid": "78061e77-b009-40f2-a0d2-388c554b365e", "value": "gunzipped", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb54ec75-f67b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628229711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229711, "uuid": "289debce-2528-498b-9a06-9780e0cc4f49", "comment": "Malware payload", "value": "c82a11d6f3dd75ef97b7783bbbbddd5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229711, "uuid": "cac0fc11-b774-4c89-aa7d-1e92922af6e2", "comment": "Malware payload", "value": "f67940067e029b012f40f7f5e5be2e365ca02c0b5617f1f13c91612e6dc28a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229711, "uuid": "a9edccbc-5431-4469-98fd-ef0f2b742064", "comment": "Malware payload", "value": "03e578a7e9f7b9e93b9489badc11635c9bb39869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229711, "uuid": "7a36fb0d-25d9-4f87-81fb-a6dbe27cd43d", "comment": "Malware payload", "value": "fb9f11929eb6e751e8d79f6350d32279200d2b5fbf812925c3c4eb663d01f7742538166c0c4781e01e088107eb4b5a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229711, "uuid": "e703940d-8cb6-4691-bfb1-8d85d40df895", "value": "T189D4EAD1F190C8DAED6B05F1BD2BA5302493BE9D54A4410C56AEBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229711, "uuid": "4257c404-c770-4272-ab44-eeb17be2aa89", "value": "0c517b095db8f3da579eca576ece2d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229711, "uuid": "5c24df9b-8151-4915-8f29-080b22c15224", "value": "6144:XEToiupPvK+HiRiTziuEalHTJiJEOSAD7NTEyTF+lhBbd3j0sW:bpPvKeuiTz2aFQ/NTQn3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229711, "uuid": "baddc001-6c64-44a2-9e24-0acc914831d9", "value": 608052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229711, "uuid": "d7dce732-6e64-4822-9b2f-6f3f6752ad30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229711, "uuid": "730c6d20-cdfa-4309-af53-766aa4fea877", "value": "PO 675123 and approve drawing___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ac3889-f674-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628226767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226767, "uuid": "d491b658-7e5d-4111-abc5-2b9b1a1e6c63", "comment": "Malware payload", "value": "4859ed423b4bad919a76ba9c4f93d351", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226767, "uuid": "f4fe3e9d-311f-46ca-8ab2-eeeeff827b41", "comment": "Malware payload", "value": "f698839d2fc8df6f1ea58e4142e44841615f30305af8f503610160b80603f9c7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226767, "uuid": "2bea8276-6319-4364-93ab-6102e8f9d7de", "comment": "Malware payload", "value": "1a348dc3095ba3733b85dd5d92ee34a000a81785", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226767, "uuid": "77fa8ed7-a339-490e-a188-4f35c6d88281", "comment": "Malware payload", "value": "5caffd84da3cce5b4c289bf6fb0733bb12b2d72234c8b35a5bf1a0bdeca8ebb7ef7bf0d429f188b10285869442265adf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226767, "uuid": "c3a2f639-25e5-4bd1-8feb-abe7b8e32b1e", "value": "T15454AFF077809DD2DA9E9B97A1597D9D1322F07BEECA208C0045FBF92A773518A0DC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226767, "uuid": "c6a4c0cb-ca51-4a82-ae88-d99d7200d873", "value": "3072:lrx7peAz7SBG2ZGtJgm9122ipGGVlMFdbPVu2TCCFnjuGh8lbX:lrxtzz7SpKgUkd1ly9uMCC5CGh8lbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226767, "uuid": "4d68e333-4ca9-4d9f-80dd-860b732eb84a", "value": 298293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226767, "uuid": "cf48626c-3b90-4fae-bf4b-ae612b36a242", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226767, "uuid": "259a5852-5f66-4f25-a4e7-5ee089571118", "value": "06082021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4588b06-f6d3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628267549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267549, "uuid": "593dcbef-cc5a-49e1-8705-ffda6a450f26", "comment": "Malware payload", "value": "e1e74f7b6ea36f53d5bfd155fbd58589", "object_relation": "md5", "Tag": [ { "name": "djvu", "colour": "#90BC44", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267549, "uuid": "ce6f535c-2c25-484c-a15b-3bb0a9853098", "comment": "Malware payload", "value": "f70d4b4fc9941796d149798614345b8e8bf6e0c69022ac407cb8b03bf26fdc7c", "object_relation": "sha256", "Tag": [ { "name": "djvu", "colour": "#90BC44", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267549, "uuid": "0747ca89-721d-4261-88d8-c7b2c0522953", "comment": "Malware payload", "value": "64c5e81ecf070a883449da116b32ff9ec2424ec2", "object_relation": "sha1", "Tag": [ { "name": "djvu", "colour": "#90BC44", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628267549, "uuid": "a8e59669-bab5-40fe-9406-2b2b6d9dd6de", "comment": "Malware payload", "value": "81f3cdd4fd620705279d16f2b265975911dea3f01737281d94e4dd74bce263baec234e2a0596478b7ee2d909ca456266", "object_relation": "sha3-384", "Tag": [ { "name": "djvu", "colour": "#90BC44", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267549, "uuid": "98ded351-0c51-454d-94d1-b7e6dd2d9379", "value": "T11F144934B641B426E8B30439A8AD97F5552C7A301BA098FFB7C58F3D4A752D2D630E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267549, "uuid": "23b59eb9-c7c7-4218-975f-1e6de0a191c0", "value": "5b0cded5ac3f92d9987bf6aa3679ca08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267549, "uuid": "362645f9-403d-40be-b6e5-7613ec190b8c", "value": "3072:gmvsPYPdfPC0/gS56CmMUEcPbcjN4U8yYBVt5UxB/ncfwNQd1kFz/hDuxWUE+3iO:gm1BPs0iMbUTt5UHncfcE1kvuxWZHsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628267549, "uuid": "15c8cb57-5806-471c-b1fc-a337ade011ae", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628267549, "uuid": "1499c8f2-1ee3-45a4-8966-24ca201a19b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628267549, "uuid": "9d9d2fea-621f-4b4c-a7df-0d6bcec2d88f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882a2825-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628229169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229169, "uuid": "db34aa9a-042d-40dc-82a4-2c92de378fb5", "comment": "Malware payload (Formbook)", "value": "4dc5f9b53f56d1d2cab97d717fd20f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229169, "uuid": "24506464-a3f1-49c1-aa14-c1409d3fe331", "comment": "Malware payload (Formbook)", "value": "f774626e850950a6f1cbbda4a4b25a729ef33c64b31b9e7692e9d1e1b6405bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229169, "uuid": "72eff5ae-e965-4a98-9982-3362d495352d", "comment": "Malware payload (Formbook)", "value": "875afa9e6c0c51dc096d12ae3da9db2de7a3380b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229169, "uuid": "14a5f659-e048-4471-b270-b3b4959c04c1", "comment": "Malware payload (Formbook)", "value": "da674f6d34e7f3ed7698e91fd7acb2b15d02a8aed00317ed97dd4eea9d3ec1b275ef3de9f043e5a5c3e6ffc84ad2e283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229169, "uuid": "e5f38785-7f98-4a2d-922f-6111302109db", "value": "T13F158C2229EB155DF3B3AB760FC4F8BE5AEAE5735B0AF0B638910B454322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229169, "uuid": "90620f42-d05e-41e6-810b-300b6432a7b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229169, "uuid": "ae52b6e3-91be-4611-bb60-ae85340d2585", "value": "12288:X27oR65AXwgFvuSSJsLh/8M1bUkxOaMimwbvd4Nw3pSqQ+vVZ7UvP66af3tKmDVp:m7oR6qgah/l1bUk8sVh3It+/7mT4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229169, "uuid": "b4e78950-b0c8-4cc0-9a54-42687a9b239d", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229169, "uuid": "8d9a30f2-5004-4c5d-b7a3-daf4519bc220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229169, "uuid": "acd8af56-3df7-43e8-88cc-d15e4238130e", "value": "neue Ordnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecd63ca-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628231784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231784, "uuid": "4cdedf7f-4b8b-4240-8e0f-8c59c044d548", "comment": "Malware payload (RedLineStealer)", "value": "eb549f062c973c63fb2ec97805546a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231784, "uuid": "45d4007c-b944-4215-acc1-f76221122e03", "comment": "Malware payload (RedLineStealer)", "value": "f9a298e5a33d42c1b8d929ddba5a0db9762d0ed6579ff44e9cf2d683bb019b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231784, "uuid": "d151036b-ad76-4e13-9798-e180e6969b75", "comment": "Malware payload (RedLineStealer)", "value": "47828373d96c466ceec9a454e5a9b210816a2f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231784, "uuid": "1fc242fb-7514-4b26-889a-81c55d7d3641", "comment": "Malware payload (RedLineStealer)", "value": "7aab0fa71edc8c2d8204d62fa0ea2c7fdcba386164192277d600c6d68f584c4a2932a74f381a7cb875864fc60f7b656e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231784, "uuid": "0a2ee832-3446-4c59-86d0-8b0739316395", "value": "T19554F1113A50DD77E1523CB129A9CB927A6EFC19C33586433A69379E3F301E15B39329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231784, "uuid": "fd0b7ca7-6714-4703-a5f2-50e18753ed02", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231784, "uuid": "99e412c5-b2e0-4e49-aeeb-b00b8033491e", "value": "6144:GZML1SB2q9JMCQcdJr/nDVq6UZqRLah0xJgLBI:0MpSB2qnMCQcdJr/nkeRW0YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231784, "uuid": "9381966a-283f-40c3-9146-8766a044a2de", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231784, "uuid": "341b203f-8982-4e6e-9a8b-da2392f67f3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231784, "uuid": "9757d910-85b8-4c2c-b763-d202d1bde18f", "value": "eb549f062c973c63fb2ec97805546a0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2ecc7e-f66c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628223082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628223082, "uuid": "73cd42f1-2f30-4906-a033-857819e68a78", "comment": "Malware payload (AsyncRAT)", "value": "4c0005443d6f0efe50a165339ffa60c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628223082, "uuid": "e23a9c30-4f54-4dcb-a720-f77ff1928a96", "comment": "Malware payload (AsyncRAT)", "value": "fa36868347a2123d27edf7866bd82006c246b078c06d8138179701973caa2d15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628223082, "uuid": "0086e683-e029-47ba-9c68-2bfb26d352fa", "comment": "Malware payload (AsyncRAT)", "value": "55a4b8647aa88c58d50b9ca5fdb78ec5ddb27a72", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628223082, "uuid": "7276e837-bacd-49be-9c02-9379a956ee81", "comment": "Malware payload (AsyncRAT)", "value": "472a06d5eb95b97a77dc92b8ba8cfdab3a442100b5a519d1fc9f328c15e839e4227d0af0f05aa85baba9c98318d14298", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628223082, "uuid": "4856e8ed-aa80-452d-8f28-451d6058bbb5", "value": "T130536106B2BC1F5BE4BE9BF8AAA5A90487F5762D2431E7084DD670CF2465F804560F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628223082, "uuid": "fbb833ec-bec9-4c32-aa54-33a4d6ae3095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628223082, "uuid": "fc7d0caa-445c-4333-af19-46d32771873f", "value": "1536:CU2oB06+Kbri5eKWNhwdNZIFDAE91HRdu6lNK6dtK9UMXYESfbKUU5lU1eaK5Cxx:CU2oB06+Kbri5eKWNhwdNZIFDAE91HR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628223082, "uuid": "dcb63c17-643c-4e79-ab5a-d96ed6156d44", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628223082, "uuid": "472bcb2c-7d6e-450b-ab45-ade5437a4dbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628223082, "uuid": "a0e24ae3-d044-4e60-a9ed-28749f2d8f12", "value": "#RFQ ORDER4844755758484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d893b9-f710-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628293591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293591, "uuid": "01e1b7ca-f90c-4e87-93c4-7c2600d44818", "comment": "Malware payload", "value": "405bdc43daa808d42616fccb23b190ec", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293591, "uuid": "01aba64b-2432-45fe-bae1-45c950866284", "comment": "Malware payload", "value": "fa479d6af4c7e451442a9114e854fa5b6278586f4f7984e0947bc96c14b7453c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293591, "uuid": "71327aad-383a-496e-90eb-977fae813979", "comment": "Malware payload", "value": "018c2a0eccd0716e39183df724cb7175ce49a6cc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628293591, "uuid": "1a49f970-a08a-43dc-851a-c3926e73bae6", "comment": "Malware payload", "value": "1453f145f11997a2273dc9589f8a26ba89a0a25da38d8dc8badc44f977757717ef00b771b69f3a97f616b9d474ba2287", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293591, "uuid": "cd417cfe-7aae-4fea-855b-e7776fea770f", "value": "T11C1533B708AD302DC248AEBF93766FBAF34015851BCE68453DA485FFC9F17E25A81116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293591, "uuid": "cf7adda1-6a1e-46c6-a4b4-a53c396c9b13", "value": "24576:TMetT7W7dmglyAVFtFPTqhmmEPtIVHgSwlHYOyt:geRq7MglpFPTqhmmMyw9YOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628293591, "uuid": "1732c9a1-9648-4ad8-9291-21abb9d6929f", "value": 934364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628293591, "uuid": "dfa4f67c-05d4-4b9e-9d30-97f750110968", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628293591, "uuid": "c78f4efe-518f-4d80-baa1-e92dd5751972", "value": "nuovo ordine PI210512.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cb7846-f6f0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628279681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279681, "uuid": "8a779302-85e5-4814-a6cf-044f89b845ed", "comment": "Malware payload", "value": "97a037528fabd4a515d7d594570bc02b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279681, "uuid": "8ae3aacd-c079-4ec6-94ba-961e3c784f4f", "comment": "Malware payload", "value": "fa986f9828e0e1ab0659854a78e68653b5dd762ab38c3b4e6add735312b23df6", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279681, "uuid": "90422347-6e52-47f8-99d9-d333646aaa4d", "comment": "Malware payload", "value": "f7da626c38949d77bc11351410a5d9ca82c51dac", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628279681, "uuid": "9f8ea02d-af00-438d-81f8-8aaef76f4c10", "comment": "Malware payload", "value": "b345d31135fc054353dc0d354d69d369c0e25f49ae53e740cabe60236ed6843f538bd22df51e828ac862b3d6399784d6", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279681, "uuid": "fd9f9a6f-b510-4032-b581-d6742a984382", "value": "T1A264124952CCA43DEB7DAF7D48A3399B067AC30FE5DBEF694E1024284B233664572136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279681, "uuid": "a87a5501-cfbf-4cd8-8143-3dcf81ee1a11", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279681, "uuid": "a66aed67-2787-4426-be0f-10322eef178f", "value": "6144:l4yRZVLlfh7rZthO+JjkuHEEAt/wz/60ZEPC:+QZdfrXg+JwuKt/S/60Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628279681, "uuid": "5403651c-2620-4157-8ff5-f75737ea81dc", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628279681, "uuid": "41ec0b5d-785c-4190-9378-d5d54467ace3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628279681, "uuid": "63b997ff-0030-4c3c-bd11-5b27bd8f68f9", "value": "marshall.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b506697-f67a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628229013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229013, "uuid": "a7d24831-80ee-4283-812c-3418a18b7c8a", "comment": "Malware payload (Mirai)", "value": "188d0007a4a4b4be2f02e39233b7fef4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229013, "uuid": "36a87875-7ba1-4114-b663-1b9d7e1c1e03", "comment": "Malware payload (Mirai)", "value": "fb7035d7f80e124cada785d37f7fcded3b4121d6d91aa30f122cb402efdaf752", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229013, "uuid": "17d166bf-191b-4315-b215-4da8b8f72d1d", "comment": "Malware payload (Mirai)", "value": "6359cc0a11070cf99f4a04dabdb0cb26cba474dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628229013, "uuid": "cb4ad2ca-11af-4a4b-a2b1-3ffb03750ed0", "comment": "Malware payload (Mirai)", "value": "d17d38f062531f5e616a1eb6fc5c87a2513551e1a4c523e56af46bd9acceb78084fa35bc7f78bbc3b45d907f22f21651", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229013, "uuid": "d76757e4-c25a-4e38-8224-cdadfe48977a", "value": "T18264E1D6EA01BE75F4D15179FA2F034873728BA8D3C7B211F714CA243A9A24A4F7A1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229013, "uuid": "dca577a3-ebc3-4068-8c1d-e0688b59be2e", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoczroG2sKqqwPa5POdOQ33Q:2IIKXhZtL7jOTyIG87XtoNsKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628229013, "uuid": "1665393d-3619-42a8-b10b-360cc4bafb74", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628229013, "uuid": "34929a89-5578-4c1b-9e3a-982b3b9600f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628229013, "uuid": "b2824b0a-9d6d-4f1d-bcdc-1b9bd9cfd567", "value": "188d0007a4a4b4be2f02e39233b7fef4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e87a27a-f680-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628231757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231757, "uuid": "aea751bd-330f-4a08-8b65-421a24fd788d", "comment": "Malware payload (AgentTesla)", "value": "0c4562486b674bffb0165b9d5215837c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231757, "uuid": "735cf5d3-db95-400e-8fc0-1ba748c9804b", "comment": "Malware payload (AgentTesla)", "value": "fb800fa4c784f7a5c222ba238bba471b626e75c721cee3bc5fc314364600e70a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231757, "uuid": "7c0ce752-b2a1-4f8a-9ea2-720540ca1013", "comment": "Malware payload (AgentTesla)", "value": "d9b1cf27ac121015e41d86fe9e2711f575146dd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628231757, "uuid": "e0edeb8b-d379-451e-9208-4eed6272a170", "comment": "Malware payload (AgentTesla)", "value": "78c9d58dba5bb34da204df9fbff15aafa953dde465245771ab559c39f9b161e24235c005397905954a6fbe9e2c5a5bba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231757, "uuid": "d9605825-9a4a-49e0-aac3-af5ff80572bc", "value": "T1A615E115B245C951D3EB6A36CCDF40084BFCF9413A63DF277C8A326D4E823A6A9465CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231757, "uuid": "55fda6d8-ed5f-4026-8703-42d1e8ff2b95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231757, "uuid": "6a44ae50-ccb8-4ab7-851c-dea3efe6bccb", "value": "24576:KlWdbIx9C/lzOmE/5NogBbYHTLU//MNj9:K4/l9E/ogyTw/0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628231757, "uuid": "5a632e81-d71f-462f-b40a-9a2b75057368", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628231757, "uuid": "6624db53-f2ab-4cd2-9497-ca287609b45b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628231757, "uuid": "5735ad32-8328-4372-ac79-574063c85665", "value": "0c4562486b674bffb0165b9d5215837c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3747de-f67c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HorusEyesRAT)", "timestamp": 1628230172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230172, "uuid": "7e997e97-de05-4f36-8a81-46bed851172c", "comment": "Malware payload (HorusEyesRAT)", "value": "b4794dd3a6857e9427c43374a06519b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230172, "uuid": "bfc267c6-04ed-40a6-bf4b-afd59d0e4507", "comment": "Malware payload (HorusEyesRAT)", "value": "fc15bd26c1817c29c86e8c8c8cd0704d113439fbf67c8897ecfa2c047069f2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230172, "uuid": "4adf63f6-da61-4100-9174-2491e1317163", "comment": "Malware payload (HorusEyesRAT)", "value": "f24df3304b43e311a02d75df3f4e562e24c74aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628230172, "uuid": "29514201-49f8-4469-ae63-c6700c83ee44", "comment": "Malware payload (HorusEyesRAT)", "value": "730e101e8f8eb42379fb5e5da59d30d0de674afdb83dbb7c44bf1424ff71991dce481177a76163e2f36797ebd75af1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "Horus Eyes RAT", "colour": "#0A891C", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "SantanderModulo", "colour": "#67B148", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230172, "uuid": "52d17ba5-ea66-4153-8a58-10dca56e8c27", "value": "T1CC55D6F63268B78DFC2D3574942BB246E1ADFE8E065C853E7887314997E43807BD1262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230172, "uuid": "db91d361-799b-4980-a80e-f306310751d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230172, "uuid": "36fd6598-c8f4-4921-ba28-8f34556af9e8", "value": "12288:24QljsbqLvL6jMRUF1gGKM8QbP0v4oMtbDirVQp6jMRM6j6R:yAsWjMCDbKM8QD0pMtgjMbj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628230172, "uuid": "fcbac4c8-a15c-4a84-bca5-930f562c8c3e", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628230172, "uuid": "557d6e21-f275-4169-a185-ded544613dbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628230172, "uuid": "53d36ef2-bd36-4ac6-80cd-a43f0dcc07bf", "value": "HorusEyesRat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0999694c-f6bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628258592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258592, "uuid": "efba83f9-bfee-4784-9dd9-8e4c5396c0b3", "comment": "Malware payload (RedLineStealer)", "value": "72586d3b6b071b87826821f20f2b45b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258592, "uuid": "339168a8-2b49-4362-bbdd-bc3758f689a0", "comment": "Malware payload (RedLineStealer)", "value": "fcb0a4961b8b6f8f0689c935432e4fba05769108046d07fb9ddcbdb690b83aea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258592, "uuid": "ff1cf088-f740-46c6-a8de-8510f2114400", "comment": "Malware payload (RedLineStealer)", "value": "ba1107e0e9895b914aaf36ee6d6ad47bd6cbdfb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628258592, "uuid": "8088fd90-ff15-4a9a-9ab4-14bdd037c4b7", "comment": "Malware payload (RedLineStealer)", "value": "2c4231ce67b2ab7840dfffb2122e668c0264f472c4cd43840cb0f17361857cc3c87dc99717e9f6abf93e5fb37ebd6cfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258592, "uuid": "d100ab30-faf7-4a6b-9240-bd9fef7c65bf", "value": "T13EC412103651EB37E290B8B0595AC3A46A5FF861E9614507BA99362F3F702F0AD3D337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258592, "uuid": "04ddd3f5-b3a2-4f1c-a339-b967dbbd4b9c", "value": "38170c4d65ff42b014b27008b95c5de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258592, "uuid": "65d7b530-efa5-441c-b91c-6db4a11b2be8", "value": "12288:wdl/wmm6Jeh6pDNCjCLaYlfaOA0g41pTwb0ctIt+SR+Y/:wdy0eh6dxLVZcPtIt+1Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628258592, "uuid": "b063b90f-c04c-4334-8794-6f760e865283", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628258592, "uuid": "7a1103e9-a8e4-4c71-8fe3-3c7a8f0495ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628258592, "uuid": "2007ae06-774d-44ab-86e0-43d095f5fd78", "value": "72586d3b6b071b87826821f20f2b45b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f902932-f70d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628292210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628292210, "uuid": "70d1217e-b75a-43a2-9bc5-f7b1c962cfb5", "comment": "Malware payload", "value": "7227a1fd469a0294b8af000e369ad9e7", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628292210, "uuid": "02ddd023-7ae1-47ac-9313-f7d8bd1332fd", "comment": "Malware payload", "value": "fd6ebb1dbec17f8b7786a88938cae16d52455b483eb6d735635801a0b0399e49", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628292210, "uuid": "6419f51a-1297-45ce-a445-5bfc19ae5839", "comment": "Malware payload", "value": "2c2e786046a4c18201830f0a841ff234613a3ce7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628292210, "uuid": "27ee8497-4b90-4b86-94f2-27662b3bb3c1", "comment": "Malware payload", "value": "32a63ffc800c460e868f2f1e04acfe96e4b7521d99bf84b3c5a5138915cdec7a3053ef0f8eef39249261d97fa82bf300", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628292210, "uuid": "5f908115-b40c-48c3-bc2d-8b3b008af3a7", "value": "T1BD549412B650DA26CA9E0B390A9783F52730BC06BD51CE3B3177736DEDB96006D4629F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628292210, "uuid": "c357a5b6-18da-4bf5-9bd4-23d6e828aed7", "value": "6144:PxEtjPOtioVjDGUU1qfDlavx+lUgdcROV9orpdrl+5/R75xu:TV9orpdr+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628292210, "uuid": "0e576a72-6e86-4cb4-8df3-3bdf89228f62", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628292210, "uuid": "4a9398fd-0f69-405f-90e3-ab847a7b956e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628292210, "uuid": "9e6609ea-2b42-48fa-be9d-fc9becd5a932", "value": "Hyvee invoice 1st quarter.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287cb03f-f675-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628226861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226861, "uuid": "ecf9bbf2-cf4d-422a-acaf-8567929b4e4b", "comment": "Malware payload", "value": "d888ee277b68815be0329e174f6c2e27", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226861, "uuid": "b18f01fa-96f7-4226-a22a-ec2d171377b8", "comment": "Malware payload", "value": "fea8ab730704512597ec508661b4437e3448b96208ca570a17eeacefe3f54065", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226861, "uuid": "44d677c2-d7b1-41e4-b9e9-173515c7aaa8", "comment": "Malware payload", "value": "96929b47a471acc168766af65b6cdd9f08c8a4c7", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628226861, "uuid": "9e8c5fbd-dfbb-4957-ba6a-d6b07c9a90b4", "comment": "Malware payload", "value": "d0baabce0ca59dfc111f0c32c73a3c47e5b75671d6c4ecdb8a5bbbbecd5c30c9fbfe27ef0a25f6af2587d81b6a0eb405", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226861, "uuid": "aae766d3-f4ff-4110-9b3a-a526647dfde8", "value": "T15002AF94D5102419D22B4BBE1F6091EDEEE1C0367CF0354D3C81957E28B6BF22F96185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226861, "uuid": "2ea7814f-0e2c-4484-8d37-1edfbda324c4", "value": "192:37Xqwm73zChxYTR6Ql1jOanNBUYvJtRzRP1YJYiDecW:3bm7exYT91jPrUktRHODDecW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628226861, "uuid": "c453186b-4a90-465a-a4a9-5ae2febbb927", "value": 8396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628226861, "uuid": "f1215ac6-b8ea-4878-993d-61b0208a4ded", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628226861, "uuid": "92e427a9-5f8a-415e-ab5e-aed644a4315d", "value": "PO-06082021W,pdt.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be51b7e6-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275646, "uuid": "528ed80b-72bc-46fe-be32-58e6c22dddd8", "comment": "Malware payload (Mirai)", "value": "921aaf8c1285d7e03076efd43d80acd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275646, "uuid": "a988f025-4f2a-4932-84cd-3f4b98a85039", "comment": "Malware payload (Mirai)", "value": "fef051397ad13a98abdd259d6c631f475afbff530ac16d5d254b4212bcd92eec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275646, "uuid": "f7d1c496-dc46-41d2-a4f1-cae33017a049", "comment": "Malware payload (Mirai)", "value": "d29c84378cd38d5ccd8e7baa395ca5602fbf6118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275646, "uuid": "c0822bc0-cd87-4e33-bd2c-edd24c961ba9", "comment": "Malware payload (Mirai)", "value": "030e991d5d32c8f0aad565a8caec21650673dac812d9427a4d2bcc5982178d4db3c7549c37820a98d995488978ff379d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275646, "uuid": "b94b15b4-1cdc-4c78-8eca-1c7edc0db732", "value": "T15B633B9AB401AFBCF99FEAF941150A0DF421A254A4930F27B32BFE937D710A1DD06D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275646, "uuid": "0ca55d36-7bff-490b-aa4d-91b2a736ee15", "value": "1536:mmBfHAzHCsNskAM/XMpTrO4QyaFW2KYbtuanD8n5:mAIzGkAMfMZr1Q5grGuiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275646, "uuid": "e9475505-332c-4a96-bc33-dac3e12883c7", "value": 67232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275646, "uuid": "4396e3d2-8360-4a3e-87a1-09265605cc1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275646, "uuid": "43f8a25c-5d60-4451-ae79-2c7a5496d315", "value": "921aaf8c1285d7e03076efd43d80acd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6675c49-f6e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628275659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275659, "uuid": "3d71e776-77a6-4a3f-953c-f11b4d6be67e", "comment": "Malware payload (Mirai)", "value": "0d515afb894e8c9c10d1e011a119e147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275659, "uuid": "8625bef2-4a1a-4bd1-b128-1b9e48017cb7", "comment": "Malware payload (Mirai)", "value": "ff7d7e79f46ce26d0db0d259655714365e6ddd96e487039f4c4fddaf7b5297b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275659, "uuid": "4e6271cd-4e1f-48b1-847f-d3b66e87f53b", "comment": "Malware payload (Mirai)", "value": "930fec77f4d76eca4fc739efe4aeb57aef083337", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628275659, "uuid": "2c2da084-2d53-4895-be21-1c34931e6ab4", "comment": "Malware payload (Mirai)", "value": "49ce2ae5d2060bf80e3ccbe72de4a1467b9d39ecd320eb4d9c1a8ece75493c1f43724a234daf6940d0471debc48dd5d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275659, "uuid": "04ad32fc-6bce-481d-8366-71640a025336", "value": "T1995302D892F3FCA0F301A03A680A4BEE5C251D85FE6B8F256197184A6DC7615DFAC741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275659, "uuid": "b710464f-8898-4bcb-b059-69ce60e2d9cc", "value": "1536:CGJZpT8kWLcEVljPYtcKB13OA/mY3I0nw37807H+9:XZpchL0/HeyXnYY07Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628275659, "uuid": "05ff28da-3a85-47d2-847f-ceebd7c9fae4", "value": 61476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628275659, "uuid": "586ec952-9238-437e-9584-fe81c7d4506b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628275659, "uuid": "75691486-3483-4f32-b610-eb23db67fe14", "value": "0d515afb894e8c9c10d1e011a119e147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }