{ "Event": { "published": true, "date": "2021-08-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-17", "timestamp": 1629244981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "702c5245-7fdf-46ac-b29e-5cf53b3c1e20", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15292617-ff36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629189331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189331, "uuid": "19b84b37-38f2-44c4-9481-6dad03d543d4", "comment": "Malware payload (Formbook)", "value": "79ccfb5a40b349d6012a35b7072f9f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189331, "uuid": "5ef67c67-30f2-4247-835e-c787f7850a42", "comment": "Malware payload (Formbook)", "value": "00011cb5a8a25fa0000dcd7a0b057cc8fa119323e3d4b68b4f596b07eca6bb42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189331, "uuid": "f92d4bec-eda0-4d92-960c-c5c81ccb14d2", "comment": "Malware payload (Formbook)", "value": "bb787e8d375db99057f8902ca74dc87f37e3e885", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189331, "uuid": "7577842d-aa35-441b-a77a-b1ff7cd30c0f", "comment": "Malware payload (Formbook)", "value": "ed56aca3bcad64b84a968be0680e64158e14d450c12ec3b10b840e2f2986d127c06e500657be9919143ecac3b67324a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189331, "uuid": "4b5051f0-6414-479f-a9b1-06089b274f63", "value": "T19F05CFB171E78696F51F8A742578BC54037231B3E9C6893D1B1A2146CFEEA987F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189331, "uuid": "c6d5e617-c1f6-4e1f-86a5-d208d8854ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189331, "uuid": "048e18b4-625c-445b-a3f3-27174616359d", "value": "24576:jAvnAL+pBe9vDujZ1zFH/7ClDrDKwtzHPi:jQ2aUmZlFH/7Ct3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629189331, "uuid": "0c7c8e33-731e-4491-a9ec-afcec3a5cdd8", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629189331, "uuid": "4a5a2200-1725-482c-a374-71b91c0d68a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189331, "uuid": "ebd5b0aa-3814-4621-ad76-5ae0c7922c18", "value": "79ccfb5a40b349d6012a35b7072f9f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e2fd6a-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629206910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206910, "uuid": "70b659de-9422-446e-888c-9cdd10a98f28", "comment": "Malware payload (AgentTesla)", "value": "0673492f28ab092e101efc7d30083752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206910, "uuid": "d218db9c-dfa0-4960-af89-0ff5ca6d5a9e", "comment": "Malware payload (AgentTesla)", "value": "00bf53b450bc1b307438aef45f542c370d2d396805c52139721a6257fefb5a43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206910, "uuid": "7e1b7825-84ab-4ad3-9b32-47e333b7e882", "comment": "Malware payload (AgentTesla)", "value": "a08fa24e5eafff3f48dc2e5ce13221177d490965", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206910, "uuid": "ec5c1f50-21c1-4a17-a996-cbbe339079cc", "comment": "Malware payload (AgentTesla)", "value": "2a7dedf01c499ef2459ee83bbf1d4009216f7db4d22e15e3060eaf9aea4e23601cdfd341426fae88a31459dfc386e966", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206910, "uuid": "31bf8fbf-a45f-44ff-aa6e-6973b19989f5", "value": "T1D46363ACD56705988F49ABBC6B2B6F49148D7B2EF3849932323C933517D6E3A511383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206910, "uuid": "9d2a5595-a66c-40b7-a35d-bc7ddebd3f40", "value": "384:ZvWF12Pt12nzNBP26mRYb0YhVxW6x0DyzOJRmMFldqI7Gpr1qW:o2Pt0zD5mjoCDlRmgvqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206910, "uuid": "40c9ae9f-4d17-4510-9ce0-4fb4291e68e8", "value": 71060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206910, "uuid": "2605843f-f658-4451-a0af-259130d9452f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206910, "uuid": "d6a02a81-fa88-4a4d-8106-2f6ec03e5ce7", "value": "Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6a4522-ff29-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629183729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183729, "uuid": "16763473-0928-494e-a0bd-49d8afe7e174", "comment": "Malware payload (Formbook)", "value": "3079af1d15405643095be0866d3f7a43", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183729, "uuid": "70848722-2a17-40c2-9d6c-9388cb97faa8", "comment": "Malware payload (Formbook)", "value": "02a2394655f1ae005ed2af465087c24695d1b04c49618ae9f1f02425d7c60a16", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183729, "uuid": "0bfa8293-07a7-4968-abbe-5ab2cd37daf9", "comment": "Malware payload (Formbook)", "value": "45741bb3446276c731856408efdefff7d87ad775", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183729, "uuid": "91a58c6d-ccce-491a-833f-59ba0640ea23", "comment": "Malware payload (Formbook)", "value": "7e0b4620b2c35a5624fa6b6f62a03f9f32fa81c72f0358b94f3511eaf5e7477691fb1aef8a6dff260db40056447dd7e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183729, "uuid": "ba063ecc-276c-4562-89c3-a3cd80955894", "value": "T100642316262D262E8C7B9EDF2F9B505930A7D81B0294DC346CFF4EEAE32474C7326158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183729, "uuid": "eae93e54-27fa-4d22-a923-d9bd5171b034", "value": "6144:+7ljtsAQqViJUs3SP9QVw34CKKLDbMth7dDu:cQCQGkAIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629183729, "uuid": "5d61cb4a-1ce9-46ed-b54a-de75d4932ef4", "value": 316908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629183729, "uuid": "1a70c926-9835-4bbd-b385-f1377a5c1571", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183729, "uuid": "33a171c5-9118-473c-aa92-6f7b0d7408f3", "value": "PO_PRICE_REQUEST_00989_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81c656a-fef5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629161767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161767, "uuid": "6cdb05e3-70fe-4838-b501-3fdf6fc642f3", "comment": "Malware payload (Dridex)", "value": "381b94ee4daaa6f09c8defa848e4d0b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161767, "uuid": "b630b902-feb9-45e2-8540-eca17ba552bd", "comment": "Malware payload (Dridex)", "value": "03b3c34ac41dc48e0deeb97fdb2727b30e203a0fa8c40fa40ce3d9edfb9b3a6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161767, "uuid": "8a0d1ed2-ba4c-494e-9eb8-a56d1cd04c33", "comment": "Malware payload (Dridex)", "value": "dddbbec057c38165457a5f55864ff0a69b0c41e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161767, "uuid": "9abd6111-1420-46ee-813f-44dd1929f5f3", "comment": "Malware payload (Dridex)", "value": "c4f385dc54119945484d69b4535b3626427ce745eb2013fc480e61a82b3545ccfad4a19414e1180112a7a3f51081d01d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161767, "uuid": "2fc28ce8-99ef-4fe2-a2f2-89234dcf6b1a", "value": "T191341267FA84DA07C26DE7BEFD032DB107061207AB0570C9B8B3AD49AB695710BF594C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161767, "uuid": "1258bdd2-2d9a-4260-8a87-fcde974aa723", "value": "6144:PogkLjLh7aAO9PxrKf5EJkaPDxyb0ddIRN/mI+0y:QDLZ75O9PpCWkEDUb60/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629161767, "uuid": "d3f09c65-a87b-4eba-b971-71f785318c0b", "value": 233846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629161767, "uuid": "360ba3de-d1ba-47b3-9a24-d417023433a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161767, "uuid": "50f780c1-9b84-4733-aa84-f5104c0fd230", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.0740400.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f881c8-ff35-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629189060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189060, "uuid": "c10d263b-625c-4542-a364-03a87b0a2ce6", "comment": "Malware payload", "value": "617247a0649182bfe30a992c13e3a09c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189060, "uuid": "55fe0442-89a1-44bf-9e5d-3bc1079f2a3e", "comment": "Malware payload", "value": "03f64f040199ed0b66d133882fd98a5d0147f19597177f14eed5482e2010bf72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189060, "uuid": "f7edb090-14bb-4839-9532-1d370141b1fb", "comment": "Malware payload", "value": "4a511f5a2e26cb9a5b8c02c5f18779be9e4751b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189060, "uuid": "5a310cdd-77ef-40f1-8e72-dd42837e48f6", "comment": "Malware payload", "value": "e59dd3c8850e2d8896b674e973b4f6df8f2e280bc2b60b726cea9eb6c0f9481056f7a90f9c8cc6957487796ba798d4e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189060, "uuid": "4bdd709d-1aac-48c4-a017-56bbe278a2b8", "value": "T19635B33C19FE2237C0B5E375CBE28817B045A8AF7521AD9494CB572E5326E4236C727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189060, "uuid": "9f36cb51-bac8-4dab-a4e6-751a30f3ba12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189060, "uuid": "a1209b4a-66f6-4ef5-bfed-b93a5f56ec49", "value": "24576:R2Z09vtTVnJGTXpMhGNv+9PDnWsefuLDV6P9h7M/3a:RxVEMh7PDnsfsGI/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629189060, "uuid": "8358bb06-c294-4ff1-ae2a-ebcf492a43de", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629189060, "uuid": "ab74b58c-d872-4c2d-9b3e-c5a4e74edcda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189060, "uuid": "f97c273b-1b52-479b-98e0-7b708b195bd7", "value": "617247a0649182bfe30a992c13e3a09c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ab8fc-ff3c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629192158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192158, "uuid": "c91b6a9c-9496-447f-8e9a-18d9e59a79b8", "comment": "Malware payload (TrickBot)", "value": "4efbfead0eec8f4d29f6f08f6509bfda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192158, "uuid": "33306b14-1aa8-4b45-812d-248e5096cf04", "comment": "Malware payload (TrickBot)", "value": "03ff8ba48d53dfb76d0218df8762010303fd6c49524eab335cb2ecb90bfaf693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192158, "uuid": "f822fdee-d9f0-4452-b07a-90d77ffb4050", "comment": "Malware payload (TrickBot)", "value": "d13e108bb643f0105d8d949c9479e7cd457caae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192158, "uuid": "beb39fa3-7eaf-4580-9c59-9b8fcc6ea0b7", "comment": "Malware payload (TrickBot)", "value": "c1c69b4165b62870c92ca52ede830cc9d7f621b5d5115fb68af185483b5c4745efd5ca39c44baf8cbf62d2842c6ceca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192158, "uuid": "5417a793-4de5-4c46-977c-a3e7bae5ebd8", "value": "T121F47C09B6BECC35C09A143F5FD25664626BAE025B25F58773872B8C8630B62B53731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192158, "uuid": "df5eaaf2-2a1a-4507-b843-58d37ce55d82", "value": "ec99d108fd03acbc59a2a6c0a950d47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192158, "uuid": "a786220b-91ff-42a3-bb5c-a04585bdb282", "value": "12288:weTBslq08I3L92xhqmqUVWFxjPd/jxEnU2vMQsK:5tI3L9WqdjPb67j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192158, "uuid": "307ff7df-087f-4061-bad6-6c6ac2f2282f", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192158, "uuid": "63ea6ad8-5dde-46d9-aa22-4b1313922dba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192158, "uuid": "afb33875-cfc4-4885-a1d9-8d90c6c818d0", "value": "4efbfead0eec8f4d29f6f08f6509bfda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2a8812-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213373, "uuid": "768b4745-d767-4f00-bfc5-a7cb13b9d97e", "comment": "Malware payload (Mirai)", "value": "c15933e46bb48ab1fce1fdd596ef0c7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213373, "uuid": "4c34dde3-530c-4637-b7d2-a0c5732f0b6e", "comment": "Malware payload (Mirai)", "value": "040d8c63329be599b9e2ab20bcb725a9aa1fd20443f1b184a0e51e98bc6abe93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213373, "uuid": "0472ec5b-5682-45ff-9ae4-3f9e7dcdc737", "comment": "Malware payload (Mirai)", "value": "5ac3db8a13dc0d2f351f4dfc97a1c61e781b6577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213373, "uuid": "ef11eb32-75cd-4c57-9c74-5809a8fe4d73", "comment": "Malware payload (Mirai)", "value": "ff80d32c6593d760485dfb3eda1056600c6e9a7a40d0a7af5111d69d7c471c333d104c684e0bd7df4be750e75cf67b73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213373, "uuid": "4072431d-3fc4-4219-8291-e0e6f3ed265d", "value": "T1F8A34A82A780D5B3D19306F6129B8B150133FB3F4A6B9EA6F35D3CF48B109C57261B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213373, "uuid": "3d329e60-89bc-44da-988e-d2fbae51b34f", "value": "3072:dUICodUWUh917j8mc2deiPUDAZURyPfL5hVT5vxinf0OzTyoQQub:tdRu917j8mc2H5Z5Pj5h1Vxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213373, "uuid": "04c3c60e-cfcd-4016-a838-6db67b4940e7", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213373, "uuid": "ec9df3c7-cd91-4ba6-ba03-3a50a3a5dbfd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213373, "uuid": "ae2c66a6-0309-434d-9556-c9f04db46736", "value": "c15933e46bb48ab1fce1fdd596ef0c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f6b8c2-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209170, "uuid": "8476704b-62e4-404c-aa64-6945648fb5a1", "comment": "Malware payload", "value": "fbab539fb10d4d0c906c798f0b68bddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209170, "uuid": "5dfd9686-82cc-4c3f-af67-e64b80772fea", "comment": "Malware payload", "value": "04615a6b2d4327dd8220f30d7e84e7916cea239604c9eab88f6223ef35c69b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209170, "uuid": "feb6d0a8-09df-4a55-aa48-b827d108ed1d", "comment": "Malware payload", "value": "317d2089637d70417e3c963cf3ade53873807d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209170, "uuid": "b58a7989-ca26-4feb-9c0b-36b7cacec3b2", "comment": "Malware payload", "value": "e868954d0e7eea8f7b908d16d5f4ca67ff490dd6753d20c594339246f1406f297a36aa9580fedc901f5018eeb8ebe014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209170, "uuid": "84f85a8f-1671-464d-88e1-c9d359e7bd4a", "value": "T15E65FA345574292FE179C339DAE54C0BE2B4BC5F7121AA1A70EA33671737A02789327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209170, "uuid": "7968c75b-b982-40b1-b80f-d3065e0936f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209170, "uuid": "858bcde7-33ed-4560-97b5-6dbea4855272", "value": "24576:spo4QqcAcezh+SGNsQSFnJWda5t7gOEHL7ctvHFDCl31nar/1Y5:QtBJ3n7qcJ+1ab1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209170, "uuid": "6e1e597e-8033-42ad-a285-b503ff5bfda8", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209170, "uuid": "d1797893-9bd2-498f-8e1c-d2426d854bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209170, "uuid": "699f72e4-10f1-4168-a4f5-7a59ecdcae8e", "value": "PO Order_E20210056_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0978b1fa-ff11-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629173420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173420, "uuid": "ce0f075c-040f-45f8-b872-df8a4f2c60bd", "comment": "Malware payload (Glupteba)", "value": "9785ddf7b4cd721df8b0c87c843c6ab6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173420, "uuid": "c7803daa-c20a-4855-9c74-756eac9fb6a0", "comment": "Malware payload (Glupteba)", "value": "049305763188b36e9010906c55428a2b42b59da7da4e0709112835a46c600243", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173420, "uuid": "d0cf785f-0ab9-43bf-b802-8cb4c91db672", "comment": "Malware payload (Glupteba)", "value": "af889c22ad0671457d8a113f70df5ba700a23577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173420, "uuid": "18c084f5-9848-4198-8242-d24f4a9f254f", "comment": "Malware payload (Glupteba)", "value": "b1c916e6b592a4ca6b63d8787e51d353aea4609bdc3909937b3e9e7124f27f83a6ace2757730c6dfdefd19de9568b231", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173420, "uuid": "569276b1-99e0-4e08-9acb-9088dc8787f9", "value": "T16B263321EB80D731E4F312B99476967C2829FEA15F1450CFA5FA59AE2A30BD8DC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173420, "uuid": "03d7f064-242e-413e-a422-67988dfddfd7", "value": "e16577a15d2f4b952ae6a4b3a61075c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173420, "uuid": "b15b6f7e-54a7-4845-b365-97b43bca9ffb", "value": "98304:tn+PDpwuO4wamhzK2+vF8qP95AP9BV91F7JHcZw3bs5z9AW7UYNFcTmDDyU:tnUtwu1BUxq8qP9qz5FtHWgs5z9AuFc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629173420, "uuid": "a6cc89e3-2530-43d6-b959-8cdc77ba7561", "value": 4659240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629173420, "uuid": "ef944122-8496-4038-917f-fb109570f91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173420, "uuid": "ae7fb0e4-dcdb-4eee-8bae-5309d1a51bc9", "value": "9785ddf7b4cd721df8b0c87c843c6ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35012951-ff99-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629231904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231904, "uuid": "32f00b1d-ea46-46ec-b8bf-1392010e999c", "comment": "Malware payload (Loki)", "value": "dae9e43b8cc525890bbad055ef152404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231904, "uuid": "b05172bf-08c3-4c55-a478-b0dd1fc54b36", "comment": "Malware payload (Loki)", "value": "05c39991c269da208a3eac63dee75d2e3e7575530a69b6a37c1d0244bb0ff7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231904, "uuid": "4bf907c1-5333-43dc-abb4-08ecc766a71e", "comment": "Malware payload (Loki)", "value": "92a8b576eaed66f2f3be4448dea895bf648c25a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231904, "uuid": "03fd9a60-bc3b-432c-99c1-5614fd482268", "comment": "Malware payload (Loki)", "value": "f523db5208337cfc9962537fc38160086dde23d5f40abd9213df16508213a2d16fb619d0a0db02d574aa17a185da35c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231904, "uuid": "35aa57d1-5732-4a66-b539-426b36dd1c81", "value": "T1F9A4CF11B981D4B2D3531872925FE2BB9D2477305D16CD8BE3946EA1FF329B0A224F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231904, "uuid": "6d9abcc4-30e5-4d6c-ab09-029e89a77928", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231904, "uuid": "f2452507-52f1-43e4-b34a-f72220870839", "value": "6144:/6+SCTKMjPaO5NOpII5jm/JMuOHW+eJoPU/LzGz///c0oQkM57seJsmFdVVt:iyTpCOmpII5jmlboM/+z/FNkM57s0F3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231904, "uuid": "3e911091-04e8-45fc-a632-9b721e47fa84", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231904, "uuid": "9b610e2f-7c0c-43c6-9614-9b30740a8f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231904, "uuid": "55aee80c-c6a1-4ba9-a6ef-f10e43abe81f", "value": "Purchase order545_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b1b744-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208683, "uuid": "df9f1090-e9c2-4d02-b2d0-b45da64f2582", "comment": "Malware payload", "value": "cb7d25d903d7600da02a943878d14cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208683, "uuid": "515e3c63-4cd6-4099-bc8f-1931b60f009b", "comment": "Malware payload", "value": "05e47149eaf07bcc92aec783321b571a9438fbecee34b76fb65923fa8b003764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208683, "uuid": "312c7278-1eb1-495d-b01f-003c6508f9aa", "comment": "Malware payload", "value": "392a911474067b4ce1e00b99126a9e0c50a0afb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208683, "uuid": "5d75e947-cfd8-45ed-83b9-6ffc3e60e408", "comment": "Malware payload", "value": "22f05b2e9626634aab6d57091b7e9efe490e780b7ae264063ca75312acf07135f110e673ef828313d59cde6a5552460a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208683, "uuid": "9f0eb415-a246-486e-a06b-c3dd083cef55", "value": "T17C55E93815783D2BE1F9C339DEE9481BE6F4F55B7211AA1670D623670702A02BD9327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208683, "uuid": "03dccd1d-d31c-4621-aeb1-66197f72e8c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208683, "uuid": "ff1bc6e6-1296-4c62-a387-4d641497ee63", "value": "24576:xyuYccWcWz686T/q/FnIIRbtDOtCECoQciuB:dUSBRCtCECondB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208683, "uuid": "88e5da97-1058-4c0f-ad89-ac7e3f2c1c38", "value": 1379840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208683, "uuid": "d52124e2-095b-449f-ad0a-c6fb74d0533e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208683, "uuid": "96ebe72c-a03e-4326-9a46-5f4736ef0cbf", "value": "Payment Information_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa92e67-ff2c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629185287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185287, "uuid": "ce019cb9-b949-4223-8f03-3f4d6bb9efb8", "comment": "Malware payload (Smoke Loader)", "value": "b946cbd394d1a81712df966b92439dfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185287, "uuid": "e4882266-e3a0-4a04-929c-d2e384e31a0f", "comment": "Malware payload (Smoke Loader)", "value": "06051cf2934898bcc716b95d1a9f131d724fafc0425a4745d5546d3d6b9fc027", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185287, "uuid": "8e0d8a21-b935-4b58-a234-c1a6b33f1db9", "comment": "Malware payload (Smoke Loader)", "value": "78fa370ffa7956f0cc5977457bb1c9b5bd68b6c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185287, "uuid": "5d6e95c7-d955-48d8-ade7-78739ccff171", "comment": "Malware payload (Smoke Loader)", "value": "4d1f78fadc1bf0848c5cd6e11aa32fdd93c3eb713c699c4617ce9227ee03a73569e56c9162ea4f52ae5a456c63e009ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185287, "uuid": "4ee33bdd-4da3-46de-a7d2-d39d99aac4d2", "value": "T147E4F76B315CA75FD127C935B4780E31A5509FA3A2CAC613F0C3ED5D983D29E9A402EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185287, "uuid": "b4444e17-6fd6-4fa9-a067-600d656a5b4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185287, "uuid": "4244ea1e-cd10-4e61-9d35-db1868a73ceb", "value": "12288:2cSu/9prIt5/4ElFOEjbAXuuxx7yodBHM8YeBleKzes+A/sP:P5/rrE55EWAXNd+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185287, "uuid": "64e3835c-2b07-4dfa-8b48-43ab439dc354", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185287, "uuid": "ca1ab491-e930-400d-bebc-42057ac46fb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185287, "uuid": "2c1c8b04-8cc8-4ddc-8b99-0e754ff90c2a", "value": "b946cbd394d1a81712df966b92439dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad12b7b3-ff23-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629181425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181425, "uuid": "59a75be5-aef9-4616-a12b-eb3ab32a9146", "comment": "Malware payload (TrickBot)", "value": "300e87a4cc829fe6e9c333be81a77229", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181425, "uuid": "673bb961-b3aa-4af5-bd9e-b9f4169c7e44", "comment": "Malware payload (TrickBot)", "value": "0693dc7093f73fb893ec946c5311157f6d88d943ad142bf5e7cfae61d197447a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181425, "uuid": "b6e19b7f-40b0-4082-85a6-3ea462042bd4", "comment": "Malware payload (TrickBot)", "value": "287113c9e93643c7a66d8e3bb6c956d450b81865", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181425, "uuid": "544c4ddb-6d85-4d69-8b2a-ccc6ec03d0c0", "comment": "Malware payload (TrickBot)", "value": "8bcb56fc045355d6b461b7d304405f4c17f40df4dbd38bbe90810e74b5bfe91835bc925f647408eee157f5962e2e88f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181425, "uuid": "f9a8f6a9-0827-4d69-91b2-e564dcbb035f", "value": "T1E8F47C09B6BECC35C09A143F5FD25664626BAE025B25F58773872B8C8630B62B53731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181425, "uuid": "b15e18db-de55-4f2e-8b2f-851858ec3883", "value": "ec99d108fd03acbc59a2a6c0a950d47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181425, "uuid": "b07f3665-5af1-4a7a-887c-e466e8ae6628", "value": "12288:weTBslq08I3L92xhqmqUVWFxjPZ/jxEnU2vMQsK:5tI3L9WqdjPf67j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629181425, "uuid": "23bad6a2-d650-4568-b66e-9abcbadaecf4", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629181425, "uuid": "865f320d-86e9-4e17-9244-fd9e841c920d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181425, "uuid": "773f91c4-e4c3-4dd1-9018-071795b6c274", "value": "300e87a4cc829fe6e9c333be81a77229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5909f3c4-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629208772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208772, "uuid": "20b09ede-5480-4a47-bd95-c91fa0560904", "comment": "Malware payload (SnakeKeylogger)", "value": "4f529f61b597c3cfe9ac59211df8b45c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208772, "uuid": "502c738e-e8c1-412b-ae73-51a0f81c739e", "comment": "Malware payload (SnakeKeylogger)", "value": "06ffaf95c6eb6a673f76c506ff697263d31babb55f90aa1de6aac099ece70bf5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208772, "uuid": "1b281e21-0c88-4d12-a05e-dcd33807b1c8", "comment": "Malware payload (SnakeKeylogger)", "value": "bf8f00bf2bbebc087799d73d2c0a7011aad38a39", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208772, "uuid": "67a7bd30-53c4-4649-98f6-808e2015f15d", "comment": "Malware payload (SnakeKeylogger)", "value": "d4a6239b1b27c0604cd7a591fb26465bb5250a449e056ed210ebda679f556211eb90227dbe0e4077097433cd08daf405", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208772, "uuid": "5dd4f0f2-46e3-45e1-9872-e86603a6a6b7", "value": "T1FE155E381BB826A7D165D63EABD18617F04096DF3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208772, "uuid": "a049ef56-eb0a-406c-a95c-b9bcb38a7b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208772, "uuid": "0ec703e3-05e9-4aca-a6b7-de81254890dc", "value": "12288:rgN6Dc9F3nC0Py3gAh+EJbjJEKuJLacYjjuOQK0k9InHDvNyEF+PrWekPjd:lcYjjzp0DMoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208772, "uuid": "65c40dbc-ed17-4dd8-b12d-1701ca155147", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208772, "uuid": "d55f3801-4595-48e9-b945-aebe959ad3cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208772, "uuid": "c0faf736-6685-4149-a67d-4355decf2323", "value": "BREAK UP.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8417fa-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198982, "uuid": "3a63760f-5268-410e-a935-a7178fb7ce79", "comment": "Malware payload (Gafgyt)", "value": "24270380786cb2352246cc3f35d8472b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198982, "uuid": "e4411ce4-a43e-43b1-b56a-54259650c3c7", "comment": "Malware payload (Gafgyt)", "value": "08e91cf8083fd711c669cb38584391400ed72e4bb1f455afe3f5bd2190652aa1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198982, "uuid": "80420829-de23-4363-a75f-d2eb4ba034f1", "comment": "Malware payload (Gafgyt)", "value": "50101af507745c433b9a0e61e276e1baf8dbea0b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198982, "uuid": "5c30f8d4-d2db-42d6-991e-08d5cf38d14d", "comment": "Malware payload (Gafgyt)", "value": "f0ce2ef7795b82944d1ac2e99de5a4e3b4b2d8b2b32a89beaf7c832c881bb906d73e5de1490da66ca32b8499c9564278", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198982, "uuid": "24671357-8aa5-4fd0-bde1-9464c26e70ea", "value": "T1D5931A41F9408B27C2D227B7E78F439D37366A54A7D7330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198982, "uuid": "bd43ebcb-1c12-4650-872f-cd6b2715bf12", "value": "1536:EIkg9VQPALeMTEb82Mm3xDKMsF0rOLcvTNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQPMTDWWFGTNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198982, "uuid": "31465a8f-53ce-43b0-8219-f4d7fcdae45d", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198982, "uuid": "74cfff14-e5cc-4c41-8e64-df2a1f384f31", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198982, "uuid": "8c20da24-4425-4322-af92-f204a464ecae", "value": "p-p.c-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5803327-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629209437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209437, "uuid": "7abeb7c4-04fe-4587-9009-704775ce5916", "comment": "Malware payload (RemcosRAT)", "value": "fc2aa23708ca8bbb8a7ccf43d5217587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209437, "uuid": "fba67cee-7d07-4f0b-9aca-b7c48c06a1c5", "comment": "Malware payload (RemcosRAT)", "value": "09302de63f9af9e91a6e8bdcb5336360506d382f58bfeb406597f4716f8bc80b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209437, "uuid": "f9585028-c412-4ca2-966d-9b8b70c23cf8", "comment": "Malware payload (RemcosRAT)", "value": "7805b6918f792aa47f6d0e4a0272520a7be7835f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209437, "uuid": "0ac53b9a-25f2-48e8-bc9f-d74ba842abbc", "comment": "Malware payload (RemcosRAT)", "value": "00e8565344b5ea1ca7b15a10b0ecae376564be835329a69ab59e28546f726422ae733b3aacc73d603d915725c6e115d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209437, "uuid": "0b6d4df6-7982-41db-a2ac-dcf5edf00de8", "value": "T1E0059C396143D0E2D161153346AF80F887283E2C5B2F89EE63743BB727756AF641763A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209437, "uuid": "d31a6920-c94c-4990-84e6-2995b61f320f", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209437, "uuid": "17b8d2b3-d8a2-4c87-aacf-d976db8b0ace", "value": "12288:M6Zq93RxXt5OBNy7nS0g0sJOgVMkOZLoENsBbkDQrHdIVyK6R:M6w3x9mCpY7hENhKHKV4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209437, "uuid": "e1c75729-c416-473b-9fb7-3d6247629849", "value": 821344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209437, "uuid": "7af9807f-85a3-482b-ae34-2cf4c1f6e4a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209437, "uuid": "af8da8da-e39a-438a-a8a8-bfa84d929515", "value": "PO816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaf7d20-ff29-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629184079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184079, "uuid": "98833364-8556-409b-8747-dba118471e3c", "comment": "Malware payload (RedLineStealer)", "value": "900b814cafca092d94d11fe5770b7a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184079, "uuid": "3e9279bc-2d66-45ed-b86c-1f37f1eb353b", "comment": "Malware payload (RedLineStealer)", "value": "0930b9b14719ac06b5b7153b68ae2d32b4e4f5007a6314f06465b8ffc0c99698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184079, "uuid": "543a7e83-9bd6-40af-a652-e5d9f8f8aafd", "comment": "Malware payload (RedLineStealer)", "value": "36d3a9f19fa9ddea3e45b388daf80e00e920572e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184079, "uuid": "f24a7deb-fa77-44fc-9ff3-cc87910d5301", "comment": "Malware payload (RedLineStealer)", "value": "21429f717a1fd9894584a22421befe32578ca30106afaa8b23fbf395faa29a0b9c1bc75045f54418ee3d86a8cd3feec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184079, "uuid": "449443b9-1fa8-4575-a2ad-76e3b2aa5ade", "value": "T1BE54F12136A0DAB2C496453654B2FBF55A37FD15EAE0029F2715FE2F6F343D1422A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184079, "uuid": "9488baef-279c-419f-acb9-a4b6fed4f5a5", "value": "477c037bd85187d535326c948fa8e5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184079, "uuid": "ba122e44-ec05-4f00-8b7f-5b7f710bd0f1", "value": "3072:JASSQE+JsLrP8vZllaWT+BCoUaO+vsbMC2gNXtzgZZBcIgCaxRm7BNSkRbQuKT0M:Jtgmxf+Mode2+Xt2ZBctw6lbpJbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184079, "uuid": "c785aefc-2832-4fae-923d-74a4e0993e4e", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184079, "uuid": "811a0e82-9292-417a-bd43-4ff6e113723d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184079, "uuid": "8213ba86-48b7-40b5-a1af-0005ce0e1491", "value": "900b814cafca092d94d11fe5770b7a79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8c8adf-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629207065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207065, "uuid": "355ca813-4094-4da6-9ed1-b402a1f44139", "comment": "Malware payload", "value": "44a71bfc675386d692f9c999f3829c8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207065, "uuid": "49960051-e4d7-4369-b617-7e6d79fbd1be", "comment": "Malware payload", "value": "0938352aa544baf8939184b41aa37f1cc09839e77508180654ac6ba5e39e1c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207065, "uuid": "2aacc69a-f7c6-40f6-9a4a-72704b942f36", "comment": "Malware payload", "value": "8b40dd4d09703697bf1c39c966c32afea0a843aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207065, "uuid": "825f9340-133d-4d1e-a871-a6704a50fdd0", "comment": "Malware payload", "value": "b0338ea6f524bd6e78b803d552d2d881bac00741aaabccd00158cf926c8b58c2649fe5339786e9ce610307245953169f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207065, "uuid": "9a2e95db-004b-4ab7-9ab9-0750c858df41", "value": "T1B8147E2AD50C524AFA9B6AFDCD187BAFF0E5BF171F019285B6751EC12712BB94D02302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207065, "uuid": "31e55af4-8e47-47a9-8a36-966287236481", "value": "3072:DgB/po0q3LGLxHSlPMhRwB2E6ZnG7E8RDJkiA/Ia0MIrJj++yyuzACKzkfb3LHnu:DgB43L2gPXU4A/x0MIrJYZKzkjLHqlmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207065, "uuid": "9f78e0e4-0c2e-41ed-8b9d-5fdf95f2b1cd", "value": 190984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207065, "uuid": "d1655c7e-944d-45cb-9a8c-d054833a6952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207065, "uuid": "0bce6461-89ee-4fb3-afc1-66f13b3ed405", "value": "VieFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b189fa-ff36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629189597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189597, "uuid": "cf365e3f-ecb6-4bd8-a7c6-63e0affd12fe", "comment": "Malware payload (Formbook)", "value": "53d55c75030ff7d58afd45080fa00dd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189597, "uuid": "a26995ca-1a7e-4401-a982-34650c52bd42", "comment": "Malware payload (Formbook)", "value": "0a27390d4913479f0929cd8ae68ca7f1e7f5c48139e3552677cc19a27d42a935", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189597, "uuid": "b0eacfb2-607a-42d7-9a87-85f851373aa0", "comment": "Malware payload (Formbook)", "value": "491f757c4131847c8c64247191c8c4d3619be5ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189597, "uuid": "3e7d7372-f5fd-42fc-bc1d-ff6816f17292", "comment": "Malware payload (Formbook)", "value": "4c72590b483042cf8cdd8ee977d3ca2250ad6a3ca111c46c1a84cf9c0972b8af5906219b9b13f39bf4b123a2d9170fb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189597, "uuid": "5b736f03-c93f-4244-92e6-bbe0ca157f2c", "value": "T169F39E32D641C030E2B242F5F66D1B7B883E0D352259A0A6D7E15AE16EF06E6F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189597, "uuid": "0d7e687a-8db7-4200-89ab-90cd0ef41499", "value": "3072:yyBcst6tZJAxgC2oWNd336/Ktt0OWNXRJfUqZhEktnS1AVL+Q:yJrjloWfnMKtCOWNXRq8znSm8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629189597, "uuid": "883ee4f0-018d-442b-a3d0-c855ac740e17", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629189597, "uuid": "54a7e93d-15ff-4f38-8588-3ca2cdf80290", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189597, "uuid": "e2de31c2-11a9-4e26-9dcd-bacb6a4044f5", "value": "53d55c75030ff7d58afd45080fa00dd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30f29ff-fef8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629163047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163047, "uuid": "0644ed95-0967-46ce-83b6-201fb69a17ee", "comment": "Malware payload (Formbook)", "value": "12c75354419de477cb232296a15c3ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163047, "uuid": "7f7fcf3a-55d5-472e-bd52-2f1866341b1b", "comment": "Malware payload (Formbook)", "value": "0ae1df4d50a7ed640973980699737b85e8947baef0087c511b4b1ebf8bdc22ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163047, "uuid": "7db9d842-2797-4b8b-b1a4-7f719f89fa03", "comment": "Malware payload (Formbook)", "value": "868c436a7d99cbe3c350d395ad9debeece5d3b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163047, "uuid": "9570f9fd-bb00-49ef-bae8-2d9433dcd8a9", "comment": "Malware payload (Formbook)", "value": "e75d91a009e18f329dd0fa840b2e587ac2fb0258aefe3d17590d709832efa15899d7a3d1c13bacc46458d8f20cc99ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163047, "uuid": "18590e4f-ea5f-4ea8-a628-d6ab9c1d71cc", "value": "T11105CF7071A78996F11F8AB42578BC5403B131B3F9C68A391B5A514ACFEDE983F4824F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163047, "uuid": "d8b0db41-d608-4b2e-b4a2-b721c8596d3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163047, "uuid": "d73e66a7-0cca-4888-9dcc-86467e557a53", "value": "12288:85SWb/bWXdIaIikhD2I6l8tTVN+71iID+fVgS+77uf8hjr5JOEPpBja:3Wb/bWXdiikApORNw0IDO+bJtHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629163047, "uuid": "5525642f-81da-4133-b193-6b763c857894", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629163047, "uuid": "f068422a-c3b4-47e4-a99c-64b96c3557e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163047, "uuid": "4642e9e5-5db4-4567-baeb-2ebf3f3c38bf", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b3c217-fefa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629163889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163889, "uuid": "cd4dc462-29b1-4d60-afc2-3551f24495e0", "comment": "Malware payload (Dridex)", "value": "f2741d93212ada7bc29309d42cb5ed58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163889, "uuid": "04882ff8-cf6d-4299-b287-d7e45b06ee61", "comment": "Malware payload (Dridex)", "value": "0ce153cee62b38b17c88da46eca6035a17eda5314da73cca0b22535bf04c90ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163889, "uuid": "1b3da671-01f4-4126-a1e8-f20eb1769da8", "comment": "Malware payload (Dridex)", "value": "67599ed19beda4b7766a407a8a7d912dcad78fd5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163889, "uuid": "5d666a60-9cae-410c-9a29-faa961999385", "comment": "Malware payload (Dridex)", "value": "31a99195f58c34e365bd326fb60ee1b962d324addb07660840d717da7b3d08725568aac560ea5de9435b13ec8e5d4f31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163889, "uuid": "1ab77fbb-ef96-41c4-800e-94bd5a67d241", "value": "T1E1140237DA492D07C10CE377AF271DA203DA46809346B5C956F13E9D3AE8E7607F605A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163889, "uuid": "9dc6350a-da1c-4023-8fa6-12123b9b575b", "value": "6144:kogkLjLhEIlIYaXjJensv7s1tW3qVN/Xk:BDLZJlI9XjJdetyYJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629163889, "uuid": "1e5c30ca-7b2f-41ac-acfb-4d6b5b4cd73f", "value": 206080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629163889, "uuid": "c278064c-85d2-4eff-9ae1-d732665a204d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163889, "uuid": "202a86ff-25ed-46ee-9a15-907f67267c28", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.25482066.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6078fc13-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208785, "uuid": "e2996072-c6e9-49fa-898b-bc90d8f510a6", "comment": "Malware payload (AgentTesla)", "value": "3c2a03e5b2c7669580dd53de01adc4af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208785, "uuid": "04a09dee-ae8c-4ae3-9ad1-994e19706e51", "comment": "Malware payload (AgentTesla)", "value": "0dafcbc8b3b1b215757d519f2c3cb4789b6d01e8cfa743d4397c97c4cb461d11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208785, "uuid": "20e71782-eaff-485f-a270-5b7147b15a10", "comment": "Malware payload (AgentTesla)", "value": "778ba63595fbea872d767c3ad820fc7ef917c07b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208785, "uuid": "46a37d77-5605-4c5f-a7c0-eaffd8b33852", "comment": "Malware payload (AgentTesla)", "value": "35e2de9e192cafe5e2434700a0fcff714417bdeaf0517b62bac14801883de03f81288c7f61537360491ebe87c21819e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208785, "uuid": "ae9a4668-39f8-4157-8cab-b34e53cafe99", "value": "T1FB2562381B782567D265D23EA7D0861BF04086DF3412AA57D4CA2F67B3126C2F7E722D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208785, "uuid": "5257b54e-ea7b-4457-9245-b491426619c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208785, "uuid": "219826df-4e6a-4ab7-a82c-2656c6256f6c", "value": "12288:2yDc9F3nC0Py3gAhHEJbjJEKPkj55Ds6OxgZ68HtQ7h3EQc/eFNZW4vdvM5:Wa47gLNQ7hUQc/+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208785, "uuid": "d3f3b367-5d8b-45c6-ac2b-277423e376f9", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208785, "uuid": "7836d7c1-848f-4693-acd4-2c50e5db3b7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208785, "uuid": "05235044-eefe-4a08-9f55-7ae0f22ba07c", "value": "RFQ#170821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b894b0-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629209114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209114, "uuid": "dc5f045d-665d-4a58-aa43-cf36939e920d", "comment": "Malware payload (Loki)", "value": "f05124fcdd4dbcdede0e398fcce85ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209114, "uuid": "15f564fd-792b-496d-8c6b-aa5de6a73735", "comment": "Malware payload (Loki)", "value": "0e20f3d09159e9617d92f6363e80ef28d929e975deaa2883bd98b5956eb17708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209114, "uuid": "fbc20496-629e-4f57-84ab-4523de798c46", "comment": "Malware payload (Loki)", "value": "5f83804885626447baacb9edc388c114a1d0faf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209114, "uuid": "5c989d58-e6b0-4357-a306-65a8ae72085e", "comment": "Malware payload (Loki)", "value": "f72782c9b1fe8c79302ecab8834b8743642f76a3b73c8ee2233d0ca9587fdd57063ee335674a0ea0aacd52961470361b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209114, "uuid": "a88eb718-41b4-4569-acc3-037e3b6b0746", "value": "T170155E3C2BB82667D065D63EABD18613F04086DB3411AA5754DA0FA7B306AD2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209114, "uuid": "95cdbd29-457b-41e9-a913-47bdbb6268f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209114, "uuid": "81c34adb-f3b1-400a-880b-d8de5f376c33", "value": "12288:1fZDmaEJbjJEKdqcMSFWRZ0eeLrfRE9EnprNZMS9dOZ5UP83GUTCDc9F3nC0Py3x:9ZDwqV3RZ0e6YYrNZ+W83G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209114, "uuid": "00f7018e-a89c-41a2-8a9b-3d71112077f3", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209114, "uuid": "a75297bb-869a-495a-9693-6b9e48735001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209114, "uuid": "179aeab8-7a98-493c-bad6-155ac9f7b6c0", "value": "PRODUCT REQUESTS.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da21302e-ff8d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629227028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227028, "uuid": "cdf237f1-e45b-485a-9033-6981faa108ce", "comment": "Malware payload", "value": "09407691eea18679315764d36b68ca7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227028, "uuid": "b2843f64-cbd5-4d7f-9e5f-1cedfe5e4522", "comment": "Malware payload", "value": "0e6a5a8e25fbcd47b9e4f7a7657523554e4461e5a314ed2b0a32fe7d97d00805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227028, "uuid": "7ee50486-4ba5-4139-a2e7-dd38b9fb640b", "comment": "Malware payload", "value": "42aff4c36734f2a3b9bac0cf957d73f308a1d3c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227028, "uuid": "0d8fcc18-7995-4c1a-b8b3-675049b12ce2", "comment": "Malware payload", "value": "64ce25b2e98234281ea91541cf43e56f58c000dc593a8a682cc3eb432eb128a4759f88c26b8d60d88f7503de50cb9235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227028, "uuid": "72ff377d-2517-435a-b845-f964fe6fcc3f", "value": "T177351242B7D28872D4B329315A3B6B107D3D7E201E39CB5FA3E44CBDDEB54906125BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227028, "uuid": "40d0ced7-9947-4b58-9a70-0b89d28828bb", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227028, "uuid": "e2c2762c-ee30-4ff9-b981-77fa50291b1c", "value": "24576:rAOcZAh60fYdsWHrA33og7y2KjFVhoc+hP9Thz9I6w:tw0fYdJM33PkVhmZ91q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629227028, "uuid": "9d857897-3466-4194-b6f8-106e8ae02ef4", "value": 1120820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629227028, "uuid": "e2cbf0ca-2888-44cb-966d-19e733447631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227028, "uuid": "c952e1f9-52fb-4dc4-bc0e-6b05bef3e42b", "value": "BK7489583093410.JPG.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad1731c-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629198897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198897, "uuid": "ace655ed-8088-4a21-baaa-12aac01f9d97", "comment": "Malware payload", "value": "1ab42de12a10cb3ef2be88ab2ef1a9b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198897, "uuid": "6d0f5d15-9740-4db2-9f81-6a0f3f88d5e4", "comment": "Malware payload", "value": "0f4e3de52e7f4401dd1ebaedf8f7d872fd175668e53f29340d6f97eabfa21479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198897, "uuid": "51efad13-3422-4658-ada0-86b20ebcce5b", "comment": "Malware payload", "value": "3d5a67da6c369237cc69b52558f7f9b0e9a21b67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198897, "uuid": "ab12712c-1688-4054-8f87-d5741b2209f3", "comment": "Malware payload", "value": "69b87bdf49870c216ca040e7ada2424fb1ccb6515d9f62ef923c03c32602909da8e86524993a29c314a59473f168973b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198897, "uuid": "7dd4cfa2-cf91-4e08-8d8b-84bce9df6508", "value": "T16055FA3815B47B3BE17AD339DEE4481BE6E4B45B7311AA1670DE13670743A02B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198897, "uuid": "cafccd18-dc48-498d-9748-b056c5264e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198897, "uuid": "09f42a95-8cc6-4361-9acf-4730af1c2a4b", "value": "24576:JGmgxc6c3zz1qZrDioA927nBucNYZMiRFFnldf++OFDphtcFle5GmUo2L9IqVpdg:yZrDioA927nBucNwvFBT2NFDWFlwhURG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198897, "uuid": "b7f43480-e056-44bf-9de5-a7be1bfa674a", "value": 1355264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198897, "uuid": "4a4660e5-8bcb-4961-8a61-1d431b859c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198897, "uuid": "bfb8618d-b7b5-41b6-82c9-dd910d1cfda6", "value": "1ab42de12a10cb3ef2be88ab2ef1a9b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5391b17-ff9e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629234321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234321, "uuid": "1add9f28-8cc3-4e81-87bc-ae361f4ebfac", "comment": "Malware payload", "value": "e9494d101cc843d976253909a9556a2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234321, "uuid": "856a08f9-3426-44c4-b770-7b91f8a6ad09", "comment": "Malware payload", "value": "1002becafd60f661d120a0e08c60c9dc3d68b9f80e879d500bdaf1b081b4515f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234321, "uuid": "10ac33b5-3f8e-4d19-9d98-56804b31f58d", "comment": "Malware payload", "value": "21f2391e2ba88418c235f0d8048e641534c5fe73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234321, "uuid": "544c48c4-119c-4889-a816-8d646f614bd0", "comment": "Malware payload", "value": "56d572f34015d010745228c3d73bb77ce22b3be547b6147a23c09315f9c2d5e7a29346d7d7e51878acbd56653142e9f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234321, "uuid": "74f654da-bdb8-47c9-8cf1-e9e9111ea9ae", "value": "T1CE03F23963592093E559547003A12A710D3BDFE1B41BCCDAA7A07791AD1E4FBBCB18DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234321, "uuid": "ccc4eb64-24fb-44a2-9185-1e5783af0a9b", "value": "768:zPWl1tts6MBUxAnEF+q0RhlGYLDg31LaJ4EcayJgGlzDpxYsz:6l1tttAnE8q4h82DSC2VrYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629234321, "uuid": "9801cec7-beba-44d6-9db4-bf156ab1ec23", "value": 38812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629234321, "uuid": "ad13535f-9f26-4799-8486-19545ef0e187", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234321, "uuid": "f5c7e326-63c5-4168-9d28-c3a286fad5fe", "value": "e9494d101cc843d976253909a9556a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3599bd98-ff89-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629225033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629225033, "uuid": "a7dfd801-8824-4784-a326-6babf44a64e3", "comment": "Malware payload", "value": "d0441de15ee097a591ba043d2f05874b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629225033, "uuid": "665b82c0-712b-4d0d-8a69-040fb710c525", "comment": "Malware payload", "value": "1023f3d6066726ed1d25d096550ed9a1c02303558d52b7ce67f080766f8c88ec", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629225033, "uuid": "fdf9e780-74d8-4e13-a1eb-e10d4c41f345", "comment": "Malware payload", "value": "0e7ed5029b649cd171ff1c037d95a639103f8845", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629225033, "uuid": "9237d649-9d1f-42bc-9903-c71b9b9f01a7", "comment": "Malware payload", "value": "3624dd93e81daecc47c4777479b5931fe7af3fb1decc82d269ede18df2acbb84a435c49cac739e305547861c40b80d6b", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629225033, "uuid": "fd60521d-c919-4ab5-b5ac-792c68d785ed", "value": "T127A6338DB0D30209FDE6933601B27AE8F00C55EF4F056859E61BD598095E2CAF7A5D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629225033, "uuid": "0455c6f9-27fc-45b1-ab6e-2d6c2ebfb3b3", "value": "196608:e4/yWBv6PO3oa2OHnx9yRhDs4neISURHHrmEsb1idz98Wz:eBYMO4a2OHx4srIZLCENOWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629225033, "uuid": "074443b7-236a-423b-a8bb-b7fa5017ba03", "value": 10200825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629225033, "uuid": "400df71c-e4d9-4441-8809-4494a1f568f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629225033, "uuid": "77a56acf-f65f-43d7-afec-8f9bbe6aa63f", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25cea77-ff26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629182803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182803, "uuid": "98233fad-fc42-4b63-8a71-ba20d6bf424a", "comment": "Malware payload (OskiStealer)", "value": "b556492c8d162c4180c0c6a5c07e6abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182803, "uuid": "4e9d93f9-83fe-4b8a-8d32-bbcf3773dc77", "comment": "Malware payload (OskiStealer)", "value": "10410848d808e42758883ff2045ac5b10d16ad3d4155771483f0aba1f245a6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182803, "uuid": "72dfbc52-a3c7-4885-a384-0633c6c6a4ad", "comment": "Malware payload (OskiStealer)", "value": "eb369158b45401422f550ca727c2b5a610bc7ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182803, "uuid": "342cf492-c5ab-4530-8769-99beed96dc9a", "comment": "Malware payload (OskiStealer)", "value": "32334b4d08d0fa24ad20757a85e899d12b2dd80a760dfd32c5db1e58a7c5eacdfcff3c311b30bb5fee1a7c454a9bf18c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182803, "uuid": "56629307-e650-421f-b196-2eba670b1689", "value": "T1D2E46C7D3150B9AFD13BCD36C4580E15F66068A7A3CBC613E0532959D83D7AAAE402BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182803, "uuid": "ca98f46b-d601-4993-b30c-cb49219b0da8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182803, "uuid": "6b1d12d5-b20d-4a3d-8d26-c759d846fa80", "value": "12288:NXJNqcCx+8+/iMuzbe3hO2dVy3whNMgfTNBnefBgyC5+Wyco3zzpUdv5ho:N+e/UzbEhOqVqwzxQfWcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182803, "uuid": "f3cec9d0-8da1-4d08-8571-e3c18db68014", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182803, "uuid": "34f0c0bd-2dfa-409f-9cdf-23c78effc53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182803, "uuid": "18be587f-de13-4d86-a1bb-abfb3e5557f5", "value": "SKBM-160821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4195557b-ff35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629188976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188976, "uuid": "93a092eb-95cf-43bf-bae8-21ae457d4946", "comment": "Malware payload (Formbook)", "value": "cac20ff1d7d3771a47333ecd02743541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188976, "uuid": "a44fae3f-479e-4929-ae65-70f541c4eb31", "comment": "Malware payload (Formbook)", "value": "10dc7778942ad9eddde8186d0fdcc43d4bcc9c39aa6f5203ebef85729eb02163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188976, "uuid": "c348f21a-66b4-4ecb-a915-cf83e475074a", "comment": "Malware payload (Formbook)", "value": "5117d9d149428508ec032127e87f44a96e9ee381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188976, "uuid": "70d8e178-9660-4807-afca-740c8f62c67d", "comment": "Malware payload (Formbook)", "value": "1b87dcda0e5b35b5134f51e0a92dfcd8a74ede91ad33b818ca50150927cc28d3f77f6de320a0c741c383492ae65f217c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188976, "uuid": "40fb670d-ec9b-4020-b525-c83a6fb9e33a", "value": "T1CBA49D01A681C021DC3B1B75E5B989F0142E3E75DB3965DF2B887E787BB30E21532A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188976, "uuid": "f3ed2451-f4e3-42b7-9c7d-1b3c5bf3b4e2", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188976, "uuid": "1e7568d4-6a87-49a4-9bc0-f44f482895bb", "value": "6144:4XbKiUWFogpw0ltD7mRS/iJKjyjmvQfNdhfNvHVTcQA7oaFKxMjTXiCIK:4Bcgpw0ltD6eyjoGdh74Q0P8xMjTSTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629188976, "uuid": "b2e3145f-69b2-44cb-b48b-1aa16ba341e8", "value": 461625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629188976, "uuid": "37aaff96-e940-44f0-bb95-9e6bc40d732e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188976, "uuid": "81201872-b04b-41f7-b765-a554d2a518c6", "value": "payments file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca80495-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209020, "uuid": "0af05304-80d0-458d-9cdc-8a30e34387ea", "comment": "Malware payload", "value": "d0802deffd30ecda52ee2b162bf8c7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209020, "uuid": "b27b2e2c-dec3-4a24-be2f-81288f782e0f", "comment": "Malware payload", "value": "10fc2dba5b841e1c3f62eae0a724fb015d26081137aff097d4edc332431c5cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209020, "uuid": "fc72f00f-aa4a-4da8-96c4-0d4caec6cd8d", "comment": "Malware payload", "value": "fae2995f234b4a1a1ec3d1ea9ff744ef40086715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209020, "uuid": "3768336f-fef9-412c-b502-9f032609c1dc", "comment": "Malware payload", "value": "b5d64b1bb686680de750a0c55c69b7560e999615fb4386102a38b7274d981f1b7516de77735f1990abf4e6a12ee67aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209020, "uuid": "56996f76-74e9-4a32-bead-c5fa90ee59ee", "value": "T13155D93815787A3BE17DC739DEF5480BE6D8B49B7211AA1670D613770702A02B9933BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209020, "uuid": "7c616272-6d65-4a34-a79b-74d79731b5b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209020, "uuid": "484f7637-cf8c-4524-9e92-ad366af36ae9", "value": "24576:4sCOwCcgcezd02xGwIlFnWVhJuXYajAT4H69:WlBADEY0AsHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209020, "uuid": "a8a2c96e-a7f1-44ed-b416-cfd30dece896", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209020, "uuid": "cdbccdca-172c-425c-8a80-f03449ab8e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209020, "uuid": "d0b037d2-aeb0-4c4a-a78a-01594a820051", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424ae688-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208734, "uuid": "2a5a56e2-cfca-4f8c-a25c-cefe64e0213a", "comment": "Malware payload", "value": "c6e20ef043876b45c12220787df938b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208734, "uuid": "bd078e2b-c814-43bf-bd89-6a0d2ce19a4f", "comment": "Malware payload", "value": "11b5b376bd15899203babde144673bbc3c8a0dc3916cfe81bc9755494223131f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208734, "uuid": "1ca8fb55-34ec-4513-8186-31fe3a0e913d", "comment": "Malware payload", "value": "1a4086371811729ee8b16ff3d04ac0931e16b1bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208734, "uuid": "1aa1c8a7-ed4b-4a39-85bf-448224cf79fc", "comment": "Malware payload", "value": "e0e2e0c1a2203a5583e473b4be4770f5cf55e930e940a2fd908b6efc86a5891258f875573057f9cd26fb1932c6813e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208734, "uuid": "b10c26f2-073c-4c2b-a905-7d77275651c6", "value": "T1F9550B391D7839BBE279C33DDEE5481BF6E4B45B7221AA1670D603670703602B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208734, "uuid": "0f671098-515d-45fa-b1c0-ab8b5771f347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208734, "uuid": "2614d38c-576f-4635-8a89-5b162cf7212d", "value": "24576:KD84mcUcezS2ITlgFnZEmL7gDSyDx+zs3uCwKUmFU:/9BBKSajuCwEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208734, "uuid": "11c8ba87-6959-40cc-9829-bec31a482a6d", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208734, "uuid": "1ef4cda3-8151-4adc-9ac9-2e06c3c0a5cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208734, "uuid": "1f2fd7ed-0839-4bff-bb45-4ebf7ad64c9f", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372b8f89-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208715, "uuid": "9c3a0732-18ed-4775-9e2e-45ee99a8de24", "comment": "Malware payload", "value": "b08d36eed72bfcad7b40f4ff6be8d57e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208715, "uuid": "b2a0e5c3-2bd4-4544-8039-1b61b956ce00", "comment": "Malware payload", "value": "1222f09f4a0ff0a957ca24c2bd9f2bcda878ca6c6246ed28b9632387666e7277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208715, "uuid": "9287d95b-94b2-4883-b602-cb1f027b9f11", "comment": "Malware payload", "value": "ebe7865eaed9bc48805ab2b4f15a7c2dbdba94e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208715, "uuid": "b4993a1a-7055-469d-b22c-cef195f44974", "comment": "Malware payload", "value": "5465dfecf48f6088465169e2239f327a1f83db4d85b968c6d9eb4e340a64814c44895ba40e7225eb014022022ff264f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208715, "uuid": "0cef324f-c922-40f5-8255-8ad4e0415943", "value": "T1DB45D83816B43A37F179C339DEE4481BF6D4B55B7215AA1A72DE13670342A03B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208715, "uuid": "dcbf4491-03fc-4653-b56c-6638260f0e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208715, "uuid": "fbdcce00-ec24-4f30-960b-fd6367b83ba6", "value": "24576:mIH047cIcLzuHqMb98lsjFnUrpxzSSwMbGdKi33r8Z:0GpBobbGd/3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208715, "uuid": "b8f3b203-1d0c-4b7c-89af-55d624797ef3", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208715, "uuid": "e0155a6c-09d1-416b-a044-39646a5f9d1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208715, "uuid": "e350e463-26f4-4167-b63a-39bbfbcc37d2", "value": "Statement Of Account (SOA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7609c6-ff15-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629175435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175435, "uuid": "78fbf01d-be9f-454c-bc8f-dcf4ceb9ba19", "comment": "Malware payload", "value": "536723f20ffbdef38bb91edc2cd925a8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175435, "uuid": "7f84c752-6721-4973-8034-e025ffe7d4cc", "comment": "Malware payload", "value": "1223a5c291a190787108f5e43889d1a8acc5cd117774c9a7377d9064b338d0b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175435, "uuid": "08358ce3-d9e7-49c4-b9c7-87569772d825", "comment": "Malware payload", "value": "fd2870c1c9c92f4feb448cf72f1e20f13cb06bed", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175435, "uuid": "c52e2cb0-c0d4-440c-9ecc-091c67b01b15", "comment": "Malware payload", "value": "8c678d1da09f80f68c13d5652dffe630adf3a58db86a5495173f20962a0af87cbb3e0da20864c01a5cc4674e01104d47", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629175435, "uuid": "1af31479-0c80-447e-833f-0989fd437d5a", "value": "T1A731FAB65569E902D3D823F8BE294DC5695546683009E3FE5A88F4073724DF4CC0787B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629175435, "uuid": "e08e47c8-663d-4075-859b-8345b0902db7", "value": "48:5iwgcZRvap5D8+TrOHr5nsRRtOxOtNNTL5KDNhR7C/PiT:5iwgR2Hr5mRtAOtN11uNSyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629175435, "uuid": "cfb48770-0db4-4578-92d6-7fc4b3ef019e", "value": 1673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629175435, "uuid": "cf4c48de-b3b0-4b8c-afc7-3d4fa3c3c08e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629175435, "uuid": "ce52caf1-fe81-42c7-8118-375e4737b23a", "value": "update.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d122bf0-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208725, "uuid": "64e2a503-9ade-4d24-b969-7f39026c0fae", "comment": "Malware payload (AgentTesla)", "value": "26fe528a4109d767bb515805a935feb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208725, "uuid": "825fd1f0-e0ac-4872-a0d0-38f18d916450", "comment": "Malware payload (AgentTesla)", "value": "128030bd65a0160f4b879fa29b9bc70c926413ae8451a1943e8a2af08969b47a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208725, "uuid": "74ee673c-1a6e-4610-a97e-e35d1d2d09f6", "comment": "Malware payload (AgentTesla)", "value": "006283d3ce45b30963a3ee7c6d71cfe198adc5aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208725, "uuid": "11bd7dac-21ab-4e97-aa00-22fbf8034e29", "comment": "Malware payload (AgentTesla)", "value": "12d54d6bdfdb886ce750317043931bc52abe163f44f562de178bdaf7eadc669ab5850682ca4147016d1ef84090ccd76a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208725, "uuid": "4994cf86-0748-453c-9772-fcb8cb519c02", "value": "T1F8940242B668D1ADDE748833E18AC60307177D344DA1A993B5EC373F3B72A47905BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208725, "uuid": "bf5450bb-6133-449f-b274-7e17e4004381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208725, "uuid": "9c8e612e-b83a-4440-868e-7b328d63abb7", "value": "6144:hiZyHrCrs8Mb3iT48w6xCi+IyHlQFNracr7rscvmO8tdfCDnmXiS4ehiwQJ:hiZIrQa3itw6kikqFNXvlvCtViqhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208725, "uuid": "0bc508a2-d555-4285-b6ec-d9f220a5cee0", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208725, "uuid": "0797bcc4-5579-4fc5-a944-2141324e5959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208725, "uuid": "de4ea060-f877-471a-a954-e2ed793fcc97", "value": "MV DRYLOG TBN.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0c6691-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208935, "uuid": "776e9f73-6e9d-4c78-8ea3-843c652a30aa", "comment": "Malware payload", "value": "8ccd364ce46d6464b67edb7d7b80a4e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208935, "uuid": "ac154b30-beeb-4907-a592-4c5402f73b83", "comment": "Malware payload", "value": "12a8589297e56fc863c7c37209870ff00bf15dcd21f90be9539e3332727761d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208935, "uuid": "6649c7c6-aba2-414e-ad9b-647fdab20838", "comment": "Malware payload", "value": "f18683e26c19e087908d96ad116a73d9b84f26a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208935, "uuid": "f6a738e2-cf4a-4ac1-a811-10e3cdfae072", "comment": "Malware payload", "value": "10157db17d712044ae5259990b1780bf36e2b5aac4441d8e5f9f474bd721d3aebfb226a12f69d29a8aa442882de9bdc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208935, "uuid": "703637b7-1a42-4dbf-b9ee-9e22a25fb6b0", "value": "T1CA84D002A6C18036E8B3183642F95235583C7B36071F4FEF57A949B99F305E27A35A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208935, "uuid": "985f6a9a-ac47-408d-9e87-5706e65413b9", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208935, "uuid": "3e97e949-6608-46a8-8f63-71c34c8aecb2", "value": "12288:fbY5q4FBltDIQywiNc//0Guhs1xzidbg/2b2pHy5:fbOvBbnrD/coRiq/2KpS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208935, "uuid": "eb1d9f36-ed0e-456e-b1af-a970d6e3ab1b", "value": 402461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208935, "uuid": "540acade-d2c6-4730-8982-c25af88f9bf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208935, "uuid": "563a65da-ac94-41bf-aa5a-68e2597ddf67", "value": "order_list_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabeb761-ff5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629205581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205581, "uuid": "a4d3e432-b4e6-4a39-a900-075943d5b04a", "comment": "Malware payload (AgentTesla)", "value": "1e621a8a257d325510d24f67ce352123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205581, "uuid": "da42426e-673e-44a1-a951-9a7451c6e22a", "comment": "Malware payload (AgentTesla)", "value": "12a978875dc90e03cbb76d024222abfdc8296ed675fca2e17ca6447ce7bf0080", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205581, "uuid": "b61914cb-e46c-48ea-8946-ec750c29e505", "comment": "Malware payload (AgentTesla)", "value": "f32e0824226e0e9d387f56c3f05f3d64481005dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205581, "uuid": "a7f88b33-a29f-4ccc-9f70-cda37cf8a184", "comment": "Malware payload (AgentTesla)", "value": "01387be1294a898bf6a0caec4851fa8ee9def34687d6597e37b15aadacc0db1d7a69a1fcbc82328e1b026ace40fa0170", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205581, "uuid": "38f1576c-df73-451b-afe6-ae61aabf27b2", "value": "T13EF1F82AD7BC4672D9B60F3A5C5763400A7DE71A9E63CE9E6440100F9D233154BE3BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205581, "uuid": "6a19c3a9-66ee-4a75-a2d7-e8e6f727446d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205581, "uuid": "472f6904-7441-4ad5-a9d6-e8e616020e01", "value": "96:1D0Rq1Ip2w7Is6IlqBwLr9yLFMsyRekL3LWv9JebK2PJIxpAU4/bLIHAzNt:ZI3J5l0wLrYL690kL3Lg9SK2R/Ugb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205581, "uuid": "7819b176-9588-4291-916d-a5fc8db09e86", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205581, "uuid": "ae1b92ea-4e14-41cd-8f55-ae53013a053a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205581, "uuid": "12428d23-aa65-4bac-9322-cbf4c2829899", "value": "PO NO. P0008005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b9cb9e-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629208709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208709, "uuid": "ee15c5b0-9789-4bdc-9de7-0925447bb6b4", "comment": "Malware payload (AsyncRAT)", "value": "a63c33079aecbb0087c1350f0d3b70cb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208709, "uuid": "5896e238-9df7-4a4a-850b-d636660b3165", "comment": "Malware payload (AsyncRAT)", "value": "12f2e964639c39076f29196264c1dcbd3792eaaaa77aca14986a802a122b341b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208709, "uuid": "c405b1b6-8126-49b5-abab-7b9f810fdd25", "comment": "Malware payload (AsyncRAT)", "value": "0dc3d2eb3337120d74d5c18193d7d9a73b068da2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208709, "uuid": "21f87188-9d62-4ccd-a08f-5ac096ea1e6c", "comment": "Malware payload (AsyncRAT)", "value": "bb5534aaccbcd39c4b084b3d6a4f298733ed6d181f0cefdcfcaafe926857799d32c0112765b7578dfce756d63876f5de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208709, "uuid": "6c28db5a-87c8-4a93-9bac-ffd07e5760a3", "value": "T13C04CFD4A78B94D6E47D977DD8A8A43F5BA1E67EE4B0C28E370583D82C895532CF40C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208709, "uuid": "fe5cecd7-5315-425f-8aaf-7f85be73d85d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208709, "uuid": "8f21b8fb-38cc-4bda-90c6-2a482f873e96", "value": "3072:CoAAAonanPKMWsYvJo2e7pitRsXFt+RwumRE6Q14vmOw38a9Mm:CoDn4PKM/oJte7p+eY9OQ1qoYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208709, "uuid": "2f702093-1135-4628-9dfd-569f04a6cb05", "value": 175984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208709, "uuid": "72b2b7b2-11d8-4ed4-8548-69e216a58431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208709, "uuid": "30fb4c49-ecc6-400d-a002-d3dbc9714d51", "value": "Invoice Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397b68b3-ff1f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629179513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179513, "uuid": "6589a723-eea0-473f-bfa3-aef176242882", "comment": "Malware payload (AgentTesla)", "value": "21d7d98fdc0b06b811168973d03fe1fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179513, "uuid": "3391618e-eaf5-4816-b092-7620f01ef99e", "comment": "Malware payload (AgentTesla)", "value": "13199c91fc7d38719a0481806fbd2578a520d97bb4e71bd20ba409c6d02081c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179513, "uuid": "c61809b3-30bf-413e-8528-bd29a15de8bd", "comment": "Malware payload (AgentTesla)", "value": "7af717a004ee4aae6d9c50c204b4fc3c1e0b76e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179513, "uuid": "5c9ac8ca-1bf0-4f54-848f-63ec54052a89", "comment": "Malware payload (AgentTesla)", "value": "8eafa6443adab917e2f0316c68564d4d2a8fb2683eae14f43b969aa75d7fef23e6f153a875db56507c709c8b9c06ad2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179513, "uuid": "a293c06b-cfca-4768-9bc5-d5ab1c0e21d0", "value": "T1B0D42304B67D2095FFCF3D2819F6EA52A9A711430ED5E807E301ABBB67527067B4311E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179513, "uuid": "563eeb96-e2f1-416a-ab12-70dd8ea3b784", "value": "12288:UivyIDZq+/ml9wXk6KRMa4h9ayGBeDBrqEQOd3zHJzVGKiacoG1Bu:UiKkZqH9w09RMLhQOBPQSVGScO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629179513, "uuid": "d8770589-1050-49b1-ac2c-91593dd32730", "value": 632494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629179513, "uuid": "cb76460a-1d62-43e4-84e1-4d3f2c0b9efb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179513, "uuid": "be8480f2-a0f2-439a-ae86-c7bee59b3645", "value": "STATEMENT OF ACCOUNT#JULY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cef29cb-ff1f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629179546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179546, "uuid": "e0ddff81-78a1-4ead-a0ff-42db9ff584c7", "comment": "Malware payload (AgentTesla)", "value": "285936f41db2a4c6f1e53d53cebe8ca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179546, "uuid": "98d5cf2a-bd61-4d0b-b7a4-f81b19e57dfd", "comment": "Malware payload (AgentTesla)", "value": "134beff82c6589909d752825bac7d755d4a64ea092bacaf61b569fa689f8cc21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179546, "uuid": "3028596c-b512-49e8-9d74-c594be0c199c", "comment": "Malware payload (AgentTesla)", "value": "ff8001a42c222567c1dbecab62748bbd96fa16f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179546, "uuid": "59c41686-809d-4a59-8580-454426c2c27e", "comment": "Malware payload (AgentTesla)", "value": "df92d307a679a55a72ee8569c9a752ebc50a8434fcbb94023ebbfea4c68a051c266b68c02043b3e8fb7c86985cab9802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179546, "uuid": "843d0481-6889-457b-8858-4c9a84d6ac21", "value": "T17DD42304A67D2095FFCF3D2C19B6EA52ADA711430EE5E807E301ABBB67527067B4311E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179546, "uuid": "6359d798-11bc-4a0f-a072-4f33c4c607a9", "value": "12288:mivyIDZq+/ml9wXk6KRMa4h9ayGBeDBrqEQOd3zHJzVGKiacoG1Bk:miKkZqH9w09RMLhQOBPQSVGScE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629179546, "uuid": "0e33d9de-0759-4f87-aac6-0caba8deec59", "value": 632490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629179546, "uuid": "2fa08a09-85ff-49d4-90fe-51932b426b2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179546, "uuid": "474b1e85-9179-4494-98c6-5108636ed701", "value": "SHIPPING INVOICE#J09674.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7499f2b0-ff12-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629174029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629174029, "uuid": "37071a89-e904-49e5-b4f8-e6463e1f9031", "comment": "Malware payload (AgentTesla)", "value": "d9e01803d80cbf7debc80e2a976b35b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629174029, "uuid": "473c2d9e-95ed-4194-b2ab-723d46e6641f", "comment": "Malware payload (AgentTesla)", "value": "150326a929a49208bbc0e158a9f5d6072e99575949f8f71748eb9fe12f3236fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629174029, "uuid": "98b046cc-1505-45a0-b46b-d09b3f863c40", "comment": "Malware payload (AgentTesla)", "value": "5eded30d825883605270b819403748702a90b499", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629174029, "uuid": "ded121b1-c148-455c-830a-b0a958bb4a4d", "comment": "Malware payload (AgentTesla)", "value": "ac4a8037487f4296451f094351bac0bcc94143e29fb188dc4a2532c3a4fe2915567f39da9bfb0e0b04a7d6db35af1c29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629174029, "uuid": "cad092de-a292-40fd-8b00-cb92adb99df4", "value": "T1DC55073955783B27E079C736EAD44413F2E4A85FB220E9597CDA23EB0652F4271D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629174029, "uuid": "ac68e0a8-1c14-48c8-b839-0d075db913ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629174029, "uuid": "fda0312f-dca8-47f6-85f4-bf07ca3db0ba", "value": "24576:hNgMq3blhBwBa7Dpp57o5tUenmkclBhcSVL83GoQUl:kL1weu5tU3hcmunl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629174029, "uuid": "a4fa0cd0-e4f6-47ae-8276-dd67b2cc87f2", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629174029, "uuid": "b2f2058f-0d11-46bb-a603-264ab0af0952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629174029, "uuid": "86f317e1-705c-488c-9acb-7cc08a073e2e", "value": "NEW ORDER FOR AND BUSINESS RELATIONSHIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e92df5-ff08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169634, "uuid": "091e472f-9cf7-4705-8e8e-7479e3f975e0", "comment": "Malware payload (Mirai)", "value": "62752aa8e32729d5cc4a6c6492b02054", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169634, "uuid": "d87d072d-7bdc-4c91-8546-bcf102a226d9", "comment": "Malware payload (Mirai)", "value": "156964bc897c69f43f63106ddde3cbe1ffdec214469af9594b365881356c755a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169634, "uuid": "3699096e-3c25-4134-98e7-d86633ea0cb3", "comment": "Malware payload (Mirai)", "value": "f214a11fbcd43d379c39f67a39af53c232980334", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169634, "uuid": "933531d4-dcbd-416b-a300-881d844594e6", "comment": "Malware payload (Mirai)", "value": "c29678b7f9cad0fd30aeab57e109786d324c809117eb9a524dff2802a07cecc0bbfc82cfdfdbd008e32a9b6e77a8ccb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169634, "uuid": "bc66ed29-d181-4512-a0c8-68b564021a63", "value": "T14B434B5172280B1BD0932A70353F4FD09BBEEAD021D0F686B99F9B968535D334546F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169634, "uuid": "6e79ed98-23a3-43db-addb-d1ae5b6444e1", "value": "768:zaVVRLWYgnvRYDCi1jAZZkXWorKquPduNZiT+eN4T9qKnZY10ULv:EVUv8CiNPG5TH4hVna10qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169634, "uuid": "4616607b-b923-4a06-9522-a449578ab3ed", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169634, "uuid": "e6865a8f-46e5-4bf7-be61-6e1f60812328", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169634, "uuid": "295cf750-469b-4d02-ac81-73b272c22b17", "value": "62752aa8e32729d5cc4a6c6492b02054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce046b5e-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209398, "uuid": "514103d2-802e-4705-8dea-3f43768b6b9a", "comment": "Malware payload (AgentTesla)", "value": "698643ab3b33f7d8b0e9c6ee03516f55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209398, "uuid": "401a3535-a793-4fbd-a35b-01d043698a13", "comment": "Malware payload (AgentTesla)", "value": "157a7015deaecff257592d153bc1d565c83eba88656567dad347f32b860c988f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209398, "uuid": "f6cdbb66-5c71-4e15-9633-252461bb49b1", "comment": "Malware payload (AgentTesla)", "value": "b6bf623fb2bc2ee9f814ff48feca5dcc828b217f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209398, "uuid": "bfe55d18-6034-4416-abb3-5c6b7ffd611b", "comment": "Malware payload (AgentTesla)", "value": "c2f383ed7d6681592135610245e22e12a3d70e6b32a837f68b7533330249ad3053677b9d32cb231b777d1719340f26d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209398, "uuid": "bf825eda-b41c-4d8e-bf70-2b4dcba8173a", "value": "T18625603C1BB92567D065D63EABE18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209398, "uuid": "a0a4fe10-e69e-4d2c-a4fe-690f4f14cca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209398, "uuid": "231bc0e3-1bad-4edb-b7fe-22f756322168", "value": "12288:yK4CDc9F3nC0Py3gAhsEJbjJEKu0rvv5eG64WogOtJms5iSZjkQKiUR2hOfOmnnI:cX0rvv5ZtJLYk5UkwOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209398, "uuid": "be453799-ed54-448b-abfd-392f9a61aec4", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209398, "uuid": "9e05c065-7632-4ff4-8590-a0f9ff29fe2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209398, "uuid": "5c425c91-0a0f-47eb-a18f-6b870b65db38", "value": "SHIPPING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0212d08-ff1f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629179793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179793, "uuid": "7a98d935-a3ff-420a-bd94-c4ffaace3d3a", "comment": "Malware payload", "value": "95f178016932373ed9bf1f558bce672f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179793, "uuid": "e0420cd5-88f1-424f-88b0-b9e2971f96d0", "comment": "Malware payload", "value": "1614c60e8cede89796b4c6a454a90d63ad2aae6485654d39d3e22f00f24198cb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179793, "uuid": "41dbbda6-fa79-43a4-b404-8eaf9f24b380", "comment": "Malware payload", "value": "0d454c2785ea239d54bad8ba08510621c6003ac3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179793, "uuid": "e3a4f20f-8963-4f3d-ad5d-9d88a0867b44", "comment": "Malware payload", "value": "49d9f4156a497035348ef69b41909d0c7034ea3bf0e6bbea141c6de9df01116ed8e18cc4d70712d8d16b64a9878aa49f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179793, "uuid": "ebe738be-ef9e-418c-afd6-565855a1b63a", "value": "T1ABE42369CE3A2207BA0D7677448D6215E98DD1B262F47C7132B448F91FEFEC50124A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179793, "uuid": "3c34d199-5c93-44cc-a422-60f4373886bc", "value": "12288:MrnuTF+5GrxtnSVlIgvEu7x89Zn7Coo/CWn3BiQpsyBUMFeK1uYLJ1:PnvngmIEuy9BWXqWn3BfZBUJq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629179793, "uuid": "ac91639f-2417-48c6-8a5e-dd09b0220fd1", "value": 657857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629179793, "uuid": "2655d53e-3eae-40f5-bb6b-1e815bcf751a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179793, "uuid": "4f246e64-7859-4fa4-9052-bb772a8dd30c", "value": "SHIPPING DOCUMENTS.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192da221-ff55-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629202652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202652, "uuid": "7b06ba0a-57d1-4478-8302-8253064bc54a", "comment": "Malware payload (Gafgyt)", "value": "78b53839235e035bb6027b3748803a6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202652, "uuid": "593b2e0c-fdca-4ce3-a496-b23898fd03c9", "comment": "Malware payload (Gafgyt)", "value": "163b4462b8308c551d874084bc9010ad8008547a7a0274db9f9b5084eb00fa45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202652, "uuid": "dcb5caf6-7296-4dc3-a6f4-a196bc81f450", "comment": "Malware payload (Gafgyt)", "value": "79f329fdf2b536c7718952a2c970b5a73dc87f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202652, "uuid": "ba1cf744-f626-4d51-8271-27182f7274f6", "comment": "Malware payload (Gafgyt)", "value": "8bc410276446de09883724601aa40bec59c190eb4931a6d3ece84dd7d3df3fbcd974d6872cc5645503280797182f1ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202652, "uuid": "df49dfda-ec9c-467b-8efd-61dde6c89fcf", "value": "T14F930892B901DFB6F40ED77A04D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202652, "uuid": "cae2c0e7-dd9f-401a-8269-fd988e503950", "value": "1536:4wZjhxpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gTd2f7vTmQ9VqXjewf2Le:Rpp09W6KTG/IB6Yy36KYfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629202652, "uuid": "f319dfd1-22a4-4cbb-9590-0be24ba841fa", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629202652, "uuid": "42e9ee82-6a61-40b7-bbaf-bdf6cf616b8d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202652, "uuid": "e4aab9ab-237d-437e-b197-60c046249611", "value": "78b53839235e035bb6027b3748803a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7016cd89-ff9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629234581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234581, "uuid": "c5f3c609-2570-4465-b015-5c18565116e0", "comment": "Malware payload", "value": "a579d36b4480f51509080fa53646c5fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234581, "uuid": "0615cd48-9afe-4583-b62f-e178707da283", "comment": "Malware payload", "value": "16465d9449e6e4af62bd2fa3bd56e94aee5fdc3ab9789d137f3d56bf40d4adfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234581, "uuid": "48f4f4a4-6201-422b-a6d2-eb53345b010c", "comment": "Malware payload", "value": "ea9345d02b5deaf3f6a9cf43d8e037f8f71166db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234581, "uuid": "7f4f7a7e-c958-49c3-b597-64d53407505b", "comment": "Malware payload", "value": "6b2cc9b4403e3d461371f175edf9a30d268ac2507acfbfe15807445e85811b55599425d4efd96c9f5b0734cb401c08f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234581, "uuid": "8b497220-69d5-4239-be85-a96aaa4e466d", "value": "T15F03E00BA0ECAE87DF8E4D3C719D15122D6C82C1F65F5B6C479274C4BB1B60BA1AE874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234581, "uuid": "5629bfbf-db46-4aa6-9a97-ff20a6ed4423", "value": "768:BCTCqdab2OtrIAQEN3TB2ueO57meRm/iWR0:Iab2KsAdjtfae8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629234581, "uuid": "cb554c57-89fa-4936-8227-796ed345c7b7", "value": 39148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629234581, "uuid": "cb6ccf89-793f-47dd-8bb5-5b146e7530f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234581, "uuid": "1ca4f538-9a46-4b89-b508-ac2498f7033c", "value": "a579d36b4480f51509080fa53646c5fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaca24e7-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209446, "uuid": "b3a70115-f8b0-4ec6-b279-9266415a37b8", "comment": "Malware payload", "value": "976c961da38c43447d93afe6bcad47c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209446, "uuid": "a8c524da-361f-443d-89b7-d6acda1dc77b", "comment": "Malware payload", "value": "179bafd2373934a0907bc2294d869cf098d20143b2d662fe97b6f3399582e4dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209446, "uuid": "49a565cd-1de2-4a01-baa9-d40f33372c00", "comment": "Malware payload", "value": "3f215e2a3f09b34f907e19a67fbc2e51d69b1f36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209446, "uuid": "f71c1557-fe96-4101-8efd-c9197dfabf99", "comment": "Malware payload", "value": "9af0f5eec8941c0a842b72404b66037c50e631905abef37c2190d15395de237c3a1a132e40a3412019905e95bb9fecbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209446, "uuid": "48f6040d-9f98-41c9-a85d-43c48f0c7adf", "value": "T1A2051C3C1BB92667D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209446, "uuid": "70248e86-538c-4cae-96dc-4476df960fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209446, "uuid": "b3522265-8bab-4992-88e9-b01d30f34d35", "value": "12288:dDZtbDc9F3nC0Py3gAh1EJbjJEKaZlqUbWdfYjq245gJUmOnrhloBS:dlqrR5iJUpFloBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209446, "uuid": "359750a8-6d05-400d-a6b7-c8d9c50eabde", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209446, "uuid": "de15fb2b-99ad-48a0-9bf9-2e33022cbce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209446, "uuid": "45e26001-b9e8-4796-abb3-0a513d9989d9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dc6c9f-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190303, "uuid": "e7bca4cf-0b8d-41f5-9bbb-6d1c0399245b", "comment": "Malware payload", "value": "82c07508949bdfa7feecc47cd9340d50", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190303, "uuid": "3c5c6294-8e65-490e-8619-64d668a28108", "comment": "Malware payload", "value": "179d4a0de7714471fd9174f1a2d923c5d473848d8c3a49275cbb7676dbd0b51d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190303, "uuid": "f363a7c8-6dad-4533-be7c-8966ea5b79c3", "comment": "Malware payload", "value": "d1efbe7382a46d79f9878834d3a32b197fb8e60a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190303, "uuid": "d8b1c4cb-91df-4a71-bc1d-e35c76cac8e8", "comment": "Malware payload", "value": "dc60af7f678354e3c1dec7fde178c5be5627c4defaa526e5d5955a6c14078e6cdfe8dd7e6ae68f8b3f9cff2c5dc0c672", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190303, "uuid": "97290594-062e-4f48-a013-a8f5830f5941", "value": "T1E14512E258060B6AF111BE3D9D42A3699D688CDE7AA1C693633635331F307E0167EF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190303, "uuid": "cc15f667-cfaf-4e62-94aa-910e20257f87", "value": "24576:i2QdVyWd8hrYPVAJ4rn27vGl/Lzeofhhl:i/dVyk8hs9vnfZLqsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190303, "uuid": "362dd329-fded-4e84-b6ff-2bd5b05941a1", "value": 1228600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190303, "uuid": "cb3d7769-f07b-4a95-a026-6463aeb3fcc6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190303, "uuid": "e38fff71-dbb8-46ac-ba4a-8d925316dad7", "value": "A0_74737HDHD9_VN_BK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9d48db-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209508, "uuid": "a861173f-61f1-45b8-bbcb-84ab0314a244", "comment": "Malware payload (SnakeKeylogger)", "value": "229fc8af13dd6426cdd18ff1b3ca4198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209508, "uuid": "3d82100d-31a0-4bc9-8663-5af6a9c1801e", "comment": "Malware payload (SnakeKeylogger)", "value": "185b0943e47ff2499a805f751a20dfd58ef018e9e20f170a51cfd9d009992803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209508, "uuid": "32e2eaa4-b21c-4fd4-9e1f-cc01f23f57db", "comment": "Malware payload (SnakeKeylogger)", "value": "777a6477ce223ee70348d28c1a789d29b8a6d1f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209508, "uuid": "a717a4e6-ff84-4657-8c7b-ece8a8cd9907", "comment": "Malware payload (SnakeKeylogger)", "value": "54a5a69b34117315365e0cb60e61be0bffb58cf17046674bc785351b31d115351d085c4d7f3f58f574be3e7659a3188e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209508, "uuid": "00ed1c6b-421a-4aa6-bc42-577f0e1e4691", "value": "T17DE47D2039FA511AF173AFA55AE474969BAFB773360BE41D149103CB0723F40DE91A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209508, "uuid": "d88d6fd7-2673-41b8-8886-4ab5832bb3a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209508, "uuid": "808a3323-6ae7-40d2-885f-25968fb471cf", "value": "12288:cp0tkaHe+/8gGVNgEeTCy+5y4/QhNDtFwI1CP3snobfYG8/jSueTZiWNMIuWbyS:G0t1PLFwI1vnOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209508, "uuid": "099f319d-781f-496e-8f48-a5d8ddb69903", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209508, "uuid": "b46fdeca-9345-4dcc-8877-dd87211f2028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209508, "uuid": "3c79cf03-f7fc-4545-8773-58277af11d9b", "value": "New proforma invoice payment #SF 02693266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d314da2-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629229851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229851, "uuid": "aa6fcf70-b75d-4617-8075-1ceac5774ac0", "comment": "Malware payload (DiamondFox)", "value": "141f2f0295414b069c74a1be852a05f1", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229851, "uuid": "e5b742a9-9487-4ac0-a429-9e5b0299831d", "comment": "Malware payload (DiamondFox)", "value": "186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229851, "uuid": "b1a28fd9-7fb0-49f9-b7f4-38eb4687c4d5", "comment": "Malware payload (DiamondFox)", "value": "4f397e56fd9fcc37d8fef315e4949adb90ff8e17", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229851, "uuid": "f1f042d2-f396-401a-a8ff-c537ec08ad76", "comment": "Malware payload (DiamondFox)", "value": "ea726ae2ed5f46cf8b06acbef2324b0f294051cc60be17239fb13abaa54411dfa472a88b20fa57748a60f12adf2cdb4f", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229851, "uuid": "a88c0866-832e-4b85-86c9-d3bfcb1fd0df", "value": "T1FAC5335C6BDE91A7E1250D3F1A126210FE6487662063480C5BDFE62EFB6F1CD4A2D8F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229851, "uuid": "b15967f1-67a5-4fb8-bf56-05220e4fb449", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229851, "uuid": "d2624d3e-4be4-41b6-b8c3-899563dc0f12", "value": "49152:9g1zPYCrGa7uHLbUlfL2hS2oXlBusU6qz0JJK/70x6ajn42BuLsJcyLUHJ:yxYCrGjjSB1y6hE/70AWnvwsJkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229851, "uuid": "e6943f92-d454-454a-830c-a1ec1bdca389", "value": 2590372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229851, "uuid": "ccb904ef-7092-4f78-8d0d-f042ec4392af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229851, "uuid": "767c9d33-ac7d-4789-8dec-f5812da1cc50", "value": "141F2F0295414B069C74A1BE852A05F1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eca65be-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208728, "uuid": "6b9856f4-1ae9-41d3-9f1f-0f6b2148b3cf", "comment": "Malware payload", "value": "9cac7b5220fadfef0473cff9488a5fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208728, "uuid": "e2af9046-ebd3-45a5-a68c-65f2c7ff4985", "comment": "Malware payload", "value": "197c2e153b66c220f1c82f3fb72742262297377ea9a5456270bd4b95dc5f672f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208728, "uuid": "931d4415-4264-4360-8d6f-37874d9f59a8", "comment": "Malware payload", "value": "032054e3a9ae4b83ba1b4acefed115e82922c615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208728, "uuid": "48278688-eef1-4271-beb2-332a7b454646", "comment": "Malware payload", "value": "410b629c023fbb94f69d1dc6d75cb41677a7d1b1387a20f32408e7fa5f9686193372c0efbcfbff68fe26fb12b09e2e40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208728, "uuid": "10d9ffb4-a8dc-49f3-acd4-29c45610caad", "value": "T149550B381578793BE17BC33DDEE5481BF6D8B46B7211AA1671E613670303A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208728, "uuid": "5a9f8720-e98d-49c0-94e0-45048240b56c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208728, "uuid": "fe9f3de9-402d-4f8a-a114-423cac643bc2", "value": "24576:vxMVqcIcOz/ClIK9eovFnMHjlgg4tmr1JiOVNhjwlf66pU:gLvB0g/O1hVLjCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208728, "uuid": "859729a0-754f-494a-8e7d-c3062a8afcf2", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208728, "uuid": "d29ad95d-8efd-426a-a803-bfd287d85558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208728, "uuid": "8a8e9a4a-307e-45e4-8f47-413ec576a52c", "value": "Hesap Hareketleri 17-08-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee32c67-fef8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629162772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162772, "uuid": "5a6a28e2-ff55-47fb-8fa0-cc6379524357", "comment": "Malware payload (Mirai)", "value": "6c90e1de4abbaf6d729a359276f0d271", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162772, "uuid": "61272445-7ef5-4b7e-b0b7-a5e1dc274309", "comment": "Malware payload (Mirai)", "value": "19adf5749d87733bfc4ef54d0d4e05ae1ae7b77aeb30ac88ca5a01a77d3c1438", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162772, "uuid": "491f03cd-aef8-4d98-85eb-8a108aa5b8d0", "comment": "Malware payload (Mirai)", "value": "c1eeca5315be2d9b240e0a54c37eb518d81bfe37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162772, "uuid": "abfaa7a9-6f9a-49c0-b0b3-96fe04d76fb6", "comment": "Malware payload (Mirai)", "value": "c3b9efbf9a9e4239c5bfff96e1a91fd1bc2caf36e2f921bd79a21dc11843d3e7fab1f3e21db974ae64e38b13ed710057", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162772, "uuid": "a1d39a30-9af8-4525-aaa6-9f44944ffa01", "value": "T1DC533BC4A983EDF4EC1515B63077FB325B7AF03E1129E987D398B623AA41B02D50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162772, "uuid": "bd469e8c-0da9-419b-a6de-0c4eb543db43", "value": "1536:YarLVDRSBCWnNFeayIFY3JMaJdBKLgUmFW0Wf5M3l9P:YKLVD4BCWN0ayrJdBIgVYfu1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629162772, "uuid": "d6494c50-b6a2-4bbf-b4b4-d96400406c07", "value": 64336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629162772, "uuid": "9ccc8592-e78f-4214-b19c-26e95e3bae70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162772, "uuid": "13ff2f65-f2ed-45d6-806e-3bb3d2faa1b1", "value": "x86-20210817-0112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f06b1f-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212288, "uuid": "bd50856f-dc60-435e-912b-6ebcc7bf1f6c", "comment": "Malware payload", "value": "792a5f4fdd464eebfdaffff8a519d933", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212288, "uuid": "e046bd0d-f16b-4a92-8c48-075171559408", "comment": "Malware payload", "value": "1ae62dbec330695d2eddc7cb9a65d47bad5f45af95e6c8a803f0780e0749a3ad", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212288, "uuid": "95a32953-8c6e-4cb6-b779-1634e22516af", "comment": "Malware payload", "value": "f3d98079a14afe3f0c46cff92c95937e7db6c13b", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212288, "uuid": "220eda46-39f6-4678-9bf4-f300db2373d5", "comment": "Malware payload", "value": "b1975765550370764fa74f9acedbaef9a4a06299366390128da7ca818023d36ecd73b0748a5d5ae85d71c97546f0bc86", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212288, "uuid": "6a94e434-cfd1-4ffe-8bb0-ec55b330e588", "value": "T1C3B31746BB83DAB3D44311F111A64B264B32FC3A9827D946F36C7CB19B661C0E62677C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212288, "uuid": "eb082437-1e7a-4f83-97bf-50e33b7c9cfb", "value": "1536:fDCk6EuxxRehXZ1Tntlf40z78fs47JrrUDWLUmShgAo:fDpu7khXZJ4mGRwkCOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212288, "uuid": "46b27013-a5da-4aff-9b3f-14dd0782e3a4", "value": 114736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212288, "uuid": "dace8036-10e5-4c0c-a92d-6093079bfefe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212288, "uuid": "210e5a66-e0d0-49e8-883c-999cc77f526e", "value": "ew_linux_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66b812b-ff95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629230404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230404, "uuid": "87a96109-f681-49a1-bbdb-57bbfc8ff745", "comment": "Malware payload (Mirai)", "value": "951d8b6c98049aac1458effdf54e9d01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230404, "uuid": "f90f1a5a-8ab4-47c8-9dd1-982313be4e03", "comment": "Malware payload (Mirai)", "value": "1b6f14b6968c043d373e8ad495150db435cd32964433295162a130663970b4a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230404, "uuid": "ffea7b8a-cae9-4799-a856-8e6f8a7328d6", "comment": "Malware payload (Mirai)", "value": "17311b352c3e700128d4acd8979fc6aa91d79ba9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230404, "uuid": "ec12f016-1242-4b0c-b36b-ce8aef2f7ddc", "comment": "Malware payload (Mirai)", "value": "0c7d0df851177cf56580c1e3d607585a6d2056b9c792cf0fd852ffed4dcb7cae2d2545c52df3210b818af3d1981e1b9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230404, "uuid": "62471eb3-cf6a-4775-886f-cc51a0d49ea5", "value": "T180D2E1B549EF6AE0C06566F72D6E790A0C58B3181254CEFEB75C7B38C013B186A67253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230404, "uuid": "1b0a0959-64c6-44b7-8ee4-95ed0bf41924", "value": "768:j83Ndbqdv1XSiRxPHmn5ArPk7nbcuyD7Uryqp:A3jbqfCiHHmmAnouy8mqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230404, "uuid": "78ac36c7-ab5f-48d1-9709-edd790163d46", "value": 29148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230404, "uuid": "885ecc79-f633-467a-9d9f-1a30ee7cc013", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230404, "uuid": "eefee950-3948-4bfd-a289-1963230f9182", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f284941e-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209030, "uuid": "426bb146-327b-47b2-a440-2990be8268d0", "comment": "Malware payload", "value": "f5ab2962733474c9b5d71fa8e02e6137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209030, "uuid": "560e4aa3-ba51-4ca8-8c21-d14a9d282250", "comment": "Malware payload", "value": "1c0dc0f9340283e13877be7e7cd5490358cf5164618909302cfb6c9e93e9c297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209030, "uuid": "3b6ac5f2-1bdc-4d64-82d0-2c522c0b0aeb", "comment": "Malware payload", "value": "ed53ec9a635c2fc35a647d31005ca8fefbc32ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209030, "uuid": "c810076a-424b-4a7f-a6c2-dc191b729519", "comment": "Malware payload", "value": "4592beca36a01871a877ee7356f19d50b7b07df7e396969798e99f2e8ba27ba66848e6ddc08b4b72406470b33a6fff9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209030, "uuid": "fa0f9d3e-fc41-48d8-b7e0-0b68960f9005", "value": "T14C55F93815B43A27E57BC33DDEE5480BF6D4B46B7211AA1A70DE03670353A42B89367E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209030, "uuid": "4548e0e5-70cf-4cbb-913b-a1a7f9e5c7b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209030, "uuid": "7bb7f56c-70f1-4efc-811c-1b0496180a9a", "value": "24576:GzelQcacWzmu8Mg7EGa5cFnDCOHgVIP6rOe8vn0J0i5gs8K:trZaGBfH0IP6y/oj5gsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209030, "uuid": "5799f0f1-3d01-4eaa-970a-63abd86de026", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209030, "uuid": "22e00c04-8a4c-4627-944d-292f147daece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209030, "uuid": "ff44533c-4aa4-4592-bc10-213accf757de", "value": "PO Order_E20210059_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571ff730-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629164101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164101, "uuid": "44ed1ed6-5fa3-44af-9db2-bca11cce6583", "comment": "Malware payload", "value": "e557e609d2dddcf4ddb28062d142a5fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164101, "uuid": "19b15088-2028-4ff1-bb2e-d71e9dc09de4", "comment": "Malware payload", "value": "1ce97055a36b68819da35897b9230cdf3df6ec1b40d784e40be323972f55b2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164101, "uuid": "d56a1bf4-55e3-4f9b-9b04-c68160d0c31a", "comment": "Malware payload", "value": "dcc01f65d630c54d0fdf233c335ba551e4f89d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164101, "uuid": "53ed43c2-a143-4344-a9fc-3361e0ef0685", "comment": "Malware payload", "value": "2b0f843a426ae36dc2f7b13295743308df7f71229d2b682c5811c8db0d64a2ad46ff1ed49c5292d8b056c693231ce754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164101, "uuid": "61381c0b-caaa-4488-8b97-e6e98dcbea4e", "value": "T1DC029404BBF88005F5BF1F346DF65B21053AF9865A32D65E6D84814CAC72784CAE1FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164101, "uuid": "2a5e2ccd-22f9-4903-99ac-f48706551af5", "value": "192:rMIlOiU6O2sw7eIZw5b9BPItoDBlghgf7biro+Y:PlOVw7PZw5b91jDBlNmro+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164101, "uuid": "4bea8f6a-4077-461f-93a0-f2f75aea4711", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164101, "uuid": "0dfd4c72-f803-4d2b-a1dd-343862f29f24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164101, "uuid": "3eadb7d1-0d58-4408-aa7f-b54d2f9224be", "value": "e557e609d2dddcf4ddb28062d142a5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633e23dd-ff6d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213084, "uuid": "f83ff665-f788-4b56-8a9c-81f580714e77", "comment": "Malware payload (Mirai)", "value": "4b3bea79d45427c2c0995bb3224268c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213084, "uuid": "89ecc045-bb33-4d45-9986-78f604251a5e", "comment": "Malware payload (Mirai)", "value": "1de13774e5dbc86fa44be4315db6cc4dc9febbaa7d2619aca2966a0e64ebde84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213084, "uuid": "161109d8-32ab-45c0-9560-46afa98607e8", "comment": "Malware payload (Mirai)", "value": "3242124c2916ac8efd0509ac81bc1d5f0b26bd09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213084, "uuid": "6dfeb99c-1184-4e60-8c89-ed5162940058", "comment": "Malware payload (Mirai)", "value": "61b50f04b31c9e82457d4da26d4bb933643a0178efe82ff1a4f1ab2325be1507fcbe1db0fef0ec171040ccb8716aead6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213084, "uuid": "3d19bb5a-1a19-4526-ba16-601fab1d22ec", "value": "T1E7E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213084, "uuid": "df5ae451-547f-4ae6-a631-11e83d1864d1", "value": "3072:OaRBoUm6Oq+lozL5hdyrzhsURxuZq+1uPNd5R:OaRBoxq++zL5hdyeURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213084, "uuid": "7925b102-711f-4401-85d7-bb7216314c76", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213084, "uuid": "9856ce75-be78-4f1d-8024-c4c8cbff5078", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213084, "uuid": "260be6ff-17d9-499e-80f1-062434578a34", "value": "4b3bea79d45427c2c0995bb3224268c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e83f95e-ff2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629186367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186367, "uuid": "6d37acf3-ca85-4faf-8a35-1b9e92f9612f", "comment": "Malware payload (Smoke Loader)", "value": "adc9a70c22fae7e3338ba023b7579f33", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186367, "uuid": "56232593-3baf-4510-8e61-b94921ac9df4", "comment": "Malware payload (Smoke Loader)", "value": "1de3d9512c8002784f0902e99bd319b8a6c9544b91bbf6db9ee6031f79e3c0d0", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186367, "uuid": "b59c3dfb-7b8c-48b6-85e0-3cf4dcd47dfd", "comment": "Malware payload (Smoke Loader)", "value": "6c7d0552991beb27e0ae477a0bb4c3027b414f21", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186367, "uuid": "f143505d-ed1d-46be-b564-1fe4531ace7d", "comment": "Malware payload (Smoke Loader)", "value": "c1f28c820b60bc517f09092eae667324733f0477999ce75a9f2fa30a3423b54f3312e89420f8f415905270f1bceefade", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186367, "uuid": "58a3a3c3-16cc-44c5-98cb-571a224e91f9", "value": "T1A3546C30A790C035E4A70DB4A9BD8378643B7DB15B2451CBE2D52BEE1B346E8AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186367, "uuid": "de79332f-f49b-41b8-90de-be2f53af10ac", "value": "ef24e2f166ae9439e57f7d9921c9b1aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186367, "uuid": "cba89267-5241-41f8-979e-71f277ff3f49", "value": "6144:ASzTNSqW4Rf75wto8kbJlNAxIGTU4aJ4kl9y:FTUqW4d75wu8EAxVUXmkl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186367, "uuid": "b184bf29-c3bb-4603-b8e0-9d565949fe08", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186367, "uuid": "7879bfad-eb56-494a-904c-047011100575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186367, "uuid": "9d2aafe4-e8aa-4b46-ab5a-27ced823f5c0", "value": "adc9a70c22fae7e3338ba023b7579f33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7010e05c-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629229856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229856, "uuid": "481eddd3-35d0-4683-abaa-943ef4455a44", "comment": "Malware payload (njrat)", "value": "41d2bc2f99c931544191a407a64d93eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229856, "uuid": "489c04de-9340-4dd8-9b12-9e416c58f66e", "comment": "Malware payload (njrat)", "value": "1e39e682bcc7bc56e68b22787bfd53e2346f67bd1dad4cc374b65a8e54b1b0e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229856, "uuid": "1d0db5d1-caf1-410f-baee-e88617293f48", "comment": "Malware payload (njrat)", "value": "7773c4947f7f8e1b7e4c5a79a519ef0ef73c71f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229856, "uuid": "351823a9-4a59-4575-9420-aee76a3aed8a", "comment": "Malware payload (njrat)", "value": "882952de6d24e765447f49a4d90468e94813aa6eb8d20e661a71a2def4fd181ff0f21b4f73f8f035d7f976517a926041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229856, "uuid": "dcf62f94-effc-4cc2-a5a8-e6808dd949d8", "value": "T196C3F1CABE985C85D0BC0574952A561103B0904B0043FE3A9CC1669B8F6B799AE4FFFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229856, "uuid": "0aea57ac-23fc-474c-a319-c47e2bab6005", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229856, "uuid": "8d1e3d73-5516-4451-b5c5-e68c3f0e4811", "value": "3072:UyBb0FxOikfyMhCUrAJbc8d+XNslVV/xzkSKV:DikfdrAdc8djwSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229856, "uuid": "cdf8cf3c-4889-43d4-9afe-fc65b0259f0c", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229856, "uuid": "d8a9d0d6-8cfc-4374-9410-cf0454ca4494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229856, "uuid": "3ff924f1-0e28-4bad-82cd-92a797666a51", "value": "41D2BC2F99C931544191A407A64D93EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64060f2-ff4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629199453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199453, "uuid": "2c19f918-a74c-49f0-b258-780936946f94", "comment": "Malware payload (RedLineStealer)", "value": "5d1a5b4da52d692c1fd21995de5d5bec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199453, "uuid": "cba52f34-a55b-48be-b463-6a445162ca5e", "comment": "Malware payload (RedLineStealer)", "value": "1e9e09473346cf68f9acbda0a70d9eda25de85a9ebbed81b1acc38e303e83790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199453, "uuid": "aed50453-825c-4418-b73f-e15d923efa92", "comment": "Malware payload (RedLineStealer)", "value": "afa7ca5de294eed0c22d39f9a152e4a4a3b78b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199453, "uuid": "cbe58751-4f29-4ad0-a39b-3a9b77e2094f", "comment": "Malware payload (RedLineStealer)", "value": "477ce5ea5e90a27b613c3f97daa3854a254414cd4bf2491a5c7d4bf5df4599b608217f1d86d1de847ad19611e6bd2bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199453, "uuid": "fa9b3534-13be-482b-a26b-b75eb9812ef6", "value": "T12F749D30B7E0C035E5A711B495B6C3FC65397EB19B2491CBA2D42AEE16347E8AC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199453, "uuid": "8e022cee-063e-4f13-b05a-3f7381d8a450", "value": "35155166d938a506dc8c83222d11c045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199453, "uuid": "b27fe9b1-99d1-4aff-8623-8cbbef67b722", "value": "6144:sN8RjNgxgHmHAHhWt9YwdI2h9dI/LJIOU6fUzjlSaaQd870PtaDD4NUrLZxieV:9jixgHmHAHhWt027KLJ7aXEP7KtxNOzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629199453, "uuid": "0bcd8de8-48cf-493a-b8ba-22f3d5d69ccd", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629199453, "uuid": "615f5fcf-fdcd-4cfc-b12c-6ebacd6f123a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199453, "uuid": "096d7fde-6f3f-4c7e-a700-3c6cd2a2657c", "value": "5d1a5b4da52d692c1fd21995de5d5bec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8d0d88-fef4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629161345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161345, "uuid": "b2d01609-0e42-40f6-8d8c-eb531ec33291", "comment": "Malware payload (Dridex)", "value": "42a0492f0a8ed4aefb38e2dadc6d7b38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161345, "uuid": "4277fa71-c167-4698-b527-b7913bc2cab1", "comment": "Malware payload (Dridex)", "value": "1fefdcda163e59dfd4c2f6a47ddee95cbdabca1a8528daaddfe759e025e4d5ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161345, "uuid": "c0a94977-f985-4879-b8c5-326ed588b082", "comment": "Malware payload (Dridex)", "value": "59d1e2849113bcb746ccd8d5b61dd4809e69123e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161345, "uuid": "3d66a8a0-6b67-46f8-8c18-9e0914386ed1", "comment": "Malware payload (Dridex)", "value": "a362f4f68f675aaf56e7162aff5f9515d29e88aefc29dd41ee007e3c76260f4f07211f3733ace5c85982c6f83a2d1c53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161345, "uuid": "b5ab97be-ab38-4f28-abe1-8b024575be59", "value": "T19D24F22AEF452D07C54CE77ABF1A2990134B1217B345B2CAB9B03E196B5C9B60FF950C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161345, "uuid": "2b72323b-8c67-4c75-845b-34bd839f09f0", "value": "3072:TJ/ogkBdPxNLhq2pNwaxokjBkcW7SJxwD6jQ4pNkt9wI+BZB4evCj7:1ogkLjLhq2pjxZ9WwxwD+Q4qt930RvCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629161345, "uuid": "e3df90ae-cc41-4f6a-bcdf-d13751cfe400", "value": 209774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629161345, "uuid": "38c968f7-3482-4989-be35-9144be10683c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161345, "uuid": "9638db18-78ef-4499-8527-e5c0350dbd3f", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.24069.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5783df4-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209008, "uuid": "2fa786ac-3b5e-419f-9b82-c01b88074773", "comment": "Malware payload (SnakeKeylogger)", "value": "aa069cd0c4942ccf4416b434930abdc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209008, "uuid": "b378d374-d7d0-4d7d-add8-cac85329cd9d", "comment": "Malware payload (SnakeKeylogger)", "value": "203754c6e511e0678e98b709deb230b6ee0a7c83e5c368a3c2e3e2bcc692f80b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209008, "uuid": "2bfa0494-4876-4660-bebb-b80ac79a0a22", "comment": "Malware payload (SnakeKeylogger)", "value": "e335ebb8ed5dbb536e5323dc55d0c9c907587c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209008, "uuid": "214e27d1-98dc-4ae5-91f8-738adb83bb3c", "comment": "Malware payload (SnakeKeylogger)", "value": "1c64794f630448060777775484636730870e39e2f6575e9ffb6121eebfb926b92892bd136b5f2089eeccb5e9054c6f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209008, "uuid": "373de830-3a7b-4db2-aefd-90fe59a683d8", "value": "T1A4F4AF707108E8B1D56B89B97334C221BF7DB831CB0AE8CF10CA5EDE65B2790947659E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209008, "uuid": "fff5bc8f-1720-44d4-b32e-19b2eec0ca42", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209008, "uuid": "078a1b2a-4f71-42cf-a864-af2231a297e3", "value": "12288:vdKqRTBltDn9lzAKp5yNMzljAYxudZC9QmRItTWzbR0:vdKCBbplDp5FljAxY800", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209008, "uuid": "f25daa9e-30be-4872-8a82-31177271895e", "value": 781690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209008, "uuid": "9e669e01-821c-4ede-b5c0-f562e3f923b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209008, "uuid": "033d65a8-3634-4123-8230-e2eb1d228a68", "value": "Yeni sipari\u015f _WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff7d5e6-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629206905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206905, "uuid": "77c256ad-69ab-4572-9a89-defd4b0c6a9b", "comment": "Malware payload (Loki)", "value": "83c7ec1def021ee27063f1edb7973d6c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206905, "uuid": "a3964bc6-1711-4469-9650-ed3b22682c77", "comment": "Malware payload (Loki)", "value": "20672b210682cb6629d02fc62cb8cf81a78df1e61093df3019d3a2e4fee38105", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206905, "uuid": "185f1632-f795-4066-9afb-9a08f4cc2e6f", "comment": "Malware payload (Loki)", "value": "59e984de3be5dae5c0b37d939dfaa7c70b50dd32", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206905, "uuid": "a24e4ed9-40a3-4156-88f9-4898a41dde7d", "comment": "Malware payload (Loki)", "value": "8dfcbded6a9dae3078aa22cfc501c2a4d424ea6e7b6105d8a5078657aa4638c8aea65dde41a7e76fc8be1882703f90fe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206905, "uuid": "5322bf51-7f73-4aa2-9e66-e2668524c5b2", "value": "T1E643C9ACD18B46A88F4667B4270F2F45058CB52DF78996733678AB355BE2C37802397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206905, "uuid": "a2e0dab0-ee33-41b1-a25b-fb1e43ddfbd4", "value": "192:YLDelNmeLtFTmhuomiXDEwvHo3ACGnoZuznnw6dNF1RVOFXr1nHC3xJ7/nZfvym:JjdhFmzXJg3Sn4u86dNFnVOF1i3xhp6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206905, "uuid": "6f527d79-1df0-4882-92c3-0ba0521c76ad", "value": 56823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206905, "uuid": "6fd18b85-3712-4ef8-97d2-4609822dad28", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206905, "uuid": "234dbe31-fb2c-4b38-81d0-8b93ee7175df", "value": "SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075ee3dc-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213360, "uuid": "02070ee2-c40d-4362-a43c-27744f5330c1", "comment": "Malware payload (Mirai)", "value": "a314fe0270bc9217822e33ce129f6d10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213360, "uuid": "0ae4afe6-1958-46f0-add2-f5a325760a1c", "comment": "Malware payload (Mirai)", "value": "210244c4efa3fcb02eb914420c7d4b39eaf15841f7c19133e9029fb1429bafdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213360, "uuid": "fc7c432c-7cbb-4122-9b14-b7269a0cb9c0", "comment": "Malware payload (Mirai)", "value": "0492e2085776ea95d32774a4c25ed1f1d0079db9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213360, "uuid": "13cd026f-c777-4d30-b355-dd9b1a906856", "comment": "Malware payload (Mirai)", "value": "7ae5c50dcf02a9c475a5497032960879afdc04b599d06fe4b1e7fb9430ad2f950e1a8611dbfbabcd42d5a210cb055349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213360, "uuid": "b0fa7424-c835-43b9-8ea0-f727e420d67a", "value": "T1BCC32A97F800DE66F40AEA3605D70735B630FB750E531A72A3573AA69E362E07827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213360, "uuid": "bb93d04a-d14b-414b-a157-334fc8c208e7", "value": "3072:+MT4bzt9BCw4MwTz/IOy+AmJ3sPmpe+3mvI0PDGnSQNER:+MT4hDCw4Mwfy+ZJ3SI3mvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213360, "uuid": "7880cce7-721e-4369-807c-b1411a7c87ff", "value": 118302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213360, "uuid": "f759b4d2-38b5-478e-b86c-7c5a46ac7eef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213360, "uuid": "dd4b8000-5709-4560-86b3-a04a4a677088", "value": "a314fe0270bc9217822e33ce129f6d10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44eaf0fb-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209168, "uuid": "0e7cbc41-a8da-46eb-a9f3-a7589b38b7b7", "comment": "Malware payload (AgentTesla)", "value": "dc65e4202e85e049d7d54870f3746f32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209168, "uuid": "74929615-c955-48e6-bae8-89048314cf7e", "comment": "Malware payload (AgentTesla)", "value": "219d72f76107e3313c1429c9dccf1823df0308c6310458ede62d3d0d9b6e9579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209168, "uuid": "157e68c5-5565-4f81-81f7-5848d450c70e", "comment": "Malware payload (AgentTesla)", "value": "516d49d203e57427370e1a390e899596e2a722f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209168, "uuid": "f5da84a9-ac7f-4b2d-8f42-0ac167a1dab0", "comment": "Malware payload (AgentTesla)", "value": "fbd0034ed97f9f764a148fa2bf197b19fbe95ba2d80d6acfab25edb686d58405d49d232f3025d02e7ec85d46f797a7b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209168, "uuid": "120b75ea-f957-4873-a5ac-aa7d564f4045", "value": "T1FD155F381BB92667D065D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209168, "uuid": "9d6b4070-36b1-4ddd-ba76-24f0f0bce3a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209168, "uuid": "8b1e8e02-e251-4268-88d1-c85cf4fe3570", "value": "12288:pwDc9F3nC0Py3gAhIEJbjJEKMUfX5dPCryEZwen+Txos9xrsx9xNh50lE:0JdEaPTO+rwPNh50l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209168, "uuid": "d07c7c41-e442-4c89-a9a5-31bdaef21609", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209168, "uuid": "f2633d14-b687-4f10-9fb8-a03a57644df0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209168, "uuid": "a83a0fa4-c606-4c4a-9671-a0d5a8be75d7", "value": "PO 704491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ee6810-ff51-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629201028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201028, "uuid": "cfab6e20-5523-4882-a010-f7fc61a0ce68", "comment": "Malware payload (Gozi)", "value": "c62763c8dd7c8bd3d94240bdc1f8eba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201028, "uuid": "49c7666f-5f35-4e21-a2bd-639a3617e201", "comment": "Malware payload (Gozi)", "value": "21db22341a086b1942852263de93d3c761fabf6233b9ea00b45983ac2c2b1774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201028, "uuid": "2327e462-b4e3-479d-8a6c-50d914718e77", "comment": "Malware payload (Gozi)", "value": "3cddecdc77d50b35cca9fc878d6656d8dec73174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201028, "uuid": "0e609302-dff4-489b-ace9-226c50006d2f", "comment": "Malware payload (Gozi)", "value": "1c784ee1b11c40be3e91883dcbf9bc86afbed4e5c06548fb1f90b026f458a11f11b18431176cc6854436c056c3e65fb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629201028, "uuid": "2b68b96f-3ebd-421b-b317-9c0440e58541", "value": "T11F346E6AE2E50A95EDB7D679CE93C617D7F234491B64C34F13B0CA966F43321B218382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629201028, "uuid": "40e1bd4e-ddb2-49f2-882a-7906b70a7315", "value": "6144:tmnZO0GDlypHAT/cxkDyPFXkfh+3m33c5TWjak4SQS83x:tMZOrEpHAT/cLPF0Im3s5TWjaCB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629201028, "uuid": "ecd90f6b-5587-476b-8cc6-07d871418c7c", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629201028, "uuid": "6388cdee-c1d8-4011-b3b6-ec5e8b643601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629201028, "uuid": "014d2491-6677-433e-bbdc-5b4cfc17c18c", "value": "12068f00000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626a6058-fef7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629162402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162402, "uuid": "6d7feebc-9372-44ae-99cb-ebcca04a3058", "comment": "Malware payload (Dridex)", "value": "686934b578a0670a3cfe05a66db3dd69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162402, "uuid": "12c374b7-ecb0-4e1f-a1c8-125bfcebc738", "comment": "Malware payload (Dridex)", "value": "22125fcc284dbb800f213dd0d59443a61a3eebc16b97557c5ec092326d78df12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162402, "uuid": "d1ad48ad-19d9-43a8-ae82-235d4c70bf7f", "comment": "Malware payload (Dridex)", "value": "d60ff89656f0ad1b554e3216cde5b4242d172f23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162402, "uuid": "d7d7a13f-67a5-459c-b47c-5d65da6f4300", "comment": "Malware payload (Dridex)", "value": "2c651ceef968f3ca39b0d312a248e7c4b9fcb0ea7aa34edc7ab84356539643c866cf93d1100ee48c6b700e897c328ac5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162402, "uuid": "0e84d3b8-1093-4fd1-8d4b-46063e02f094", "value": "T1D0140127CF896D03D14CC7BFFE0B2CB0138E5584A701B4DD59B12EEE5B686651AEA04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162402, "uuid": "bf770b8d-745d-4033-92cd-3ef6c55d22c0", "value": "3072:1J/ogkBdPxNLhpvkCCPRcOeFHWPYHunVG4mqVQZZ1ztaoQKL7LduIZecGi4l:rogkLjLhFCPRZPYHuqqV61xaoBL7L4Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629162402, "uuid": "cf963e06-bd36-4252-be6f-5108596a957d", "value": 205216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629162402, "uuid": "a21f90a4-f919-4770-b994-888161e7ac3f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162402, "uuid": "1a1023d7-5430-4f4e-8c71-b331f6a13386", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.36718710.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa7923e-ff6f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1629213982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213982, "uuid": "4b976d4b-1c2d-4375-aeff-7cb129c9b316", "comment": "Malware payload (Hancitor)", "value": "dee18056e6b4c47bd6dd796d993de94a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213982, "uuid": "72e200cf-fecd-483f-932a-d430539b7b33", "comment": "Malware payload (Hancitor)", "value": "221743da70a514a7edcbebd741f7f325d7f10f6cc576be93ba17ea0d4299b5a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213982, "uuid": "758de028-4233-4334-b1f3-1999a53a1020", "comment": "Malware payload (Hancitor)", "value": "a813777d59ddf9ea58803a70b8b1142df1d62f89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213982, "uuid": "4413f064-3d4d-41cb-ac77-472f0e34dc1f", "comment": "Malware payload (Hancitor)", "value": "53caf9a91ab6df50d8dfa30cca0ba268586c5b53e50248cf132e0871266ee5bfbc67c266b6a3b60683cb7eecfa1d2bd1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213982, "uuid": "a9f13830-cbb8-4c88-a27a-1217b980fce5", "value": "T104A4BF01B692D131D5BF82368FB9D999822C78110B245CEFB7E8297F8FA54E36930717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213982, "uuid": "ac01d67b-6e75-47b3-bcca-8d9b64f3c264", "value": "b5c8b00b20212cbaa80913ec989d9bf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213982, "uuid": "c9e674d8-73ed-4168-85e5-7c0f43e31498", "value": "12288:ZCgz28Ovep4u0UK/mZRW/6D9Io2y5wYazTg:ZCgz28OWpj0JK86ao2y5RazE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213982, "uuid": "233a9483-a006-46a0-aba9-56887901efc1", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213982, "uuid": "8745651d-5297-4ad3-ad49-60bbd9ba13ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213982, "uuid": "4a561100-21ae-49d5-9d32-61ef5856cc86", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a371252-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209928, "uuid": "b3efba63-be59-4128-aca7-636185dca535", "comment": "Malware payload (Formbook)", "value": "5fcbfeae2b818e9eab95723a87460401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209928, "uuid": "ce45a697-4508-4c2a-b79c-252ed1029ee8", "comment": "Malware payload (Formbook)", "value": "22a3ccdeb9ae4b196461cdb81c895ae891e2149af03e44b6ce86c2a1bf062947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209928, "uuid": "fbd84da0-f057-476b-ae64-0a10e7cc83a1", "comment": "Malware payload (Formbook)", "value": "dc1a7b697d898f801cd24199fc4691717c39e8f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209928, "uuid": "871401b4-572d-4e31-a94d-5989581c00ff", "comment": "Malware payload (Formbook)", "value": "2ed9ff72e78bebf03acf3ad7540e72d352f96e4faa9afdfd7e17cf328a0c4ad5fc4e801cc7d0e7a28d79677055f422a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209928, "uuid": "a0444785-9745-43be-b142-6355f96722a7", "value": "T1B5D4F111BA57C9B1C8A302B105F4D721156CBC7307A44DCB7FA84F6DABB16C0D6B1AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209928, "uuid": "3e35acdd-83e2-4adb-973e-490af7eb7f07", "value": "ff42c22be7db6fd997a1f31962592e30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209928, "uuid": "b7acacb5-6835-4bae-a519-448d4d112f1a", "value": "12288:/U/Rmv+TmAXNzNxECRygNVl/GYlqPPMbQ4Z6hg0t9VoQigW:/Yme9P58gl/GhPPU5cgyX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209928, "uuid": "a2856121-d1ea-47fe-a7b0-bea140a2b5db", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209928, "uuid": "40f611bc-6dae-4f8d-b1f3-ac9b09890233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209928, "uuid": "9a247d92-2f47-4b5c-a1c0-db4bca73b945", "value": "5fcbfeae2b818e9eab95723a87460401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d8c6c7-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208661, "uuid": "ade7a9a7-ca35-4d00-a48d-07040b9ce8dc", "comment": "Malware payload", "value": "f34fce58fbb298ef89530c3650290916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208661, "uuid": "0ffa4517-6981-41cf-a9c8-63880c0178a6", "comment": "Malware payload", "value": "23917f72fb892384ec74a5823e5a39e9ef06c155c1d11fecb22129478c4763cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208661, "uuid": "3514da3d-1694-47e5-ad0a-f98b5b4c19e6", "comment": "Malware payload", "value": "8c8b465a3de335705ee2e7ac103e72c654896e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208661, "uuid": "3e482df8-b6d3-4048-b3a6-5b2651b01cd6", "comment": "Malware payload", "value": "efd094ad9d596ecc37509f6dccf45ea5374124b9b3c7096fff18d7ebff80ac69ecace304fed8098bf286ab339325a61b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208661, "uuid": "d47c49c8-1bc9-4a5a-b820-70e91b6f2574", "value": "T18645D83815B83D3BE1B9C339DFE4481BE6D9F55B7211AA1A70D603670707A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208661, "uuid": "5b4ea709-ef59-4524-bf3c-107baa52ccdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208661, "uuid": "b263b1e5-d330-49d8-a5d9-959cf5c53063", "value": "24576:wXqNUcucWzbmQJWmrFnKaXUBVWC1VPjUFReTByps:AlBDEB0KVrOR2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208661, "uuid": "3174ef82-985d-45ec-b144-dba0b3de72de", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208661, "uuid": "f6737754-62c3-42d7-ba27-f34e427078da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208661, "uuid": "c8c94a97-b8fd-45e3-847e-f3b3a70f3774", "value": "00001- 00199002021081700.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b195c9-ff5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629205591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205591, "uuid": "e380d4e0-e0f2-496f-b3e3-0455043e025a", "comment": "Malware payload (AgentTesla)", "value": "bab1561967b2204197a4de03fd4df46b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205591, "uuid": "e9bbdc33-d512-4a67-8160-7899c47d7325", "comment": "Malware payload (AgentTesla)", "value": "2395f4b974b5cc0187790f20461810d8b2f175af60f3f25089c46954d9a14dda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205591, "uuid": "da3935bb-141f-4421-9bb9-fe102daaff35", "comment": "Malware payload (AgentTesla)", "value": "f6b23a5ca02ab6cfdb31e99620be15976d78d3c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205591, "uuid": "2cf189bc-3496-4e43-aa1b-422d0ee0db15", "comment": "Malware payload (AgentTesla)", "value": "15765f3b47673070596bb8cf72065c1e88156a629014c408547caa2e86d494917b543c740e3092997c563b8c7c93b30b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205591, "uuid": "100ba1ca-e2d6-4dce-a37c-be2b3c61b01d", "value": "T15944D516A3109710CB5E417FC016C11861B19F33D73A92BF5996F8FA1BBE1CEF92A894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205591, "uuid": "ead471d4-0204-4e89-a553-a1c565b68193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205591, "uuid": "63647336-3b04-4c73-86ec-af423234b906", "value": "6144:5ikf3U5EJZUwEHg/4eBAGDaOJ4Q2fsc14rzU:5ikf7PtXAEaOJ4N1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205591, "uuid": "fd965da1-2c1c-4e4d-abdd-734d41e05e21", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205591, "uuid": "4ef45ba7-dd9e-486f-b533-c963a981f38b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205591, "uuid": "7285442d-f60e-45aa-bab7-424290f70a6d", "value": "New Inquiry 21411JA20pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c69b6c-ff1d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629178727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178727, "uuid": "f95d1392-6943-4067-ab5d-a708750fad9a", "comment": "Malware payload", "value": "ffc980f4d9a4971c25593a33a0f82c29", "object_relation": "md5", "Tag": [ { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178727, "uuid": "6b3a2b5b-9bce-40b4-a3f9-c7aa80de4415", "comment": "Malware payload", "value": "250d8872d725fcaf0c37fbacb9cf7a6f1a9c19c00204edd67e610fdd3d105295", "object_relation": "sha256", "Tag": [ { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178727, "uuid": "ac56a5ae-f886-44f3-ab95-71995d38f9a0", "comment": "Malware payload", "value": "cdbac24edf189c9aa898917cd49674ea154b3c55", "object_relation": "sha1", "Tag": [ { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178727, "uuid": "abec7ac1-fe5a-47c5-b72a-3d2966749d20", "comment": "Malware payload", "value": "f1e77facd5dc06a343a26b48198f482d83114f8ce9ea9be41b359fe72b107e084b0b1289dda12eef97645a041911913f", "object_relation": "sha3-384", "Tag": [ { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178727, "uuid": "b80fd958-9677-4fd2-b782-11663ce26d11", "value": "T162413CB2802D1F1186C94D5686F1332BAD0D19F94311583D59F67CB55BC81FD1A32BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178727, "uuid": "886339fc-6e5a-4b7d-a557-1b1576c4e4f4", "value": "48:XXJQM50kENKynzYToOB6AzX86FSNi5FWsSf:pP50kENp8oozX86QNi5FWNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629178727, "uuid": "248c1759-2cf1-4f4a-99e8-7b58c08a7a55", "value": 2109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629178727, "uuid": "b6a85338-e728-456f-aa19-4efd07240c54", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178727, "uuid": "20840f47-11a4-4df0-9640-5f53ad155188", "value": "image002.wmz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b30a09-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209354, "uuid": "3b4dc974-58a1-41b4-93bf-6cf9c4669b78", "comment": "Malware payload (SnakeKeylogger)", "value": "48f0dcd7a717dcf35e55c93e7d14b033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209354, "uuid": "186d214a-441f-48d5-a9d6-111f57989f8b", "comment": "Malware payload (SnakeKeylogger)", "value": "252225cfd4ec7a7b61e5138d1587a4a212909f596004b8a157fe9f0ed4c6496b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209354, "uuid": "cb6b3e97-e004-4ff9-bfc8-b5a96d191d88", "comment": "Malware payload (SnakeKeylogger)", "value": "e6b8deaca3504b4e8f7c758f0d6ee3fb8dc45f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209354, "uuid": "b594af18-23a1-491f-8990-0b78d1bb8c87", "comment": "Malware payload (SnakeKeylogger)", "value": "88d59b817c4ba7510eff4449262d5f45d498a408e2c5d346f6bbc28cbdcae509f39499141c99418e1a35560e8192139c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209354, "uuid": "22216590-5a86-4ba7-80f6-a89a84240e7d", "value": "T116153D3C1BB82667D065D67EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209354, "uuid": "eb75c38c-0fc0-4457-8f36-5fd39526496d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209354, "uuid": "59517024-2b3a-4675-a772-007f2f81a770", "value": "12288:PrDc9F3nC0Py3gAhXEJbjJEKYNafJdGDAPYDs9BvmE5/PNUD69e:oJAJMmgVIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209354, "uuid": "3420eec3-0be5-44b0-8160-537700e80732", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209354, "uuid": "7ec8b43b-aabf-4b91-a255-bc2843d756dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209354, "uuid": "6f2f9a9b-fd0e-4ee8-849a-350683fc8fd0", "value": "Ej89Onwmb5KAIJD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15f382f-fefd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629165085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165085, "uuid": "74a9575d-6d83-409f-839e-1fc79c4dc32c", "comment": "Malware payload (Dridex)", "value": "f6241843013cf4d4ff9a6e110bcb64f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165085, "uuid": "09f428fa-293e-4a2f-a9f4-7921d83d385b", "comment": "Malware payload (Dridex)", "value": "2586e3b1b27e0d6c485b4a7ac404c2d4c281c868bfb9ea4d31416553588300b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165085, "uuid": "2a8a86a4-44c8-4042-9927-6364a893d891", "comment": "Malware payload (Dridex)", "value": "ac6233b7e548211f4932f92271c4352e2ba20180", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165085, "uuid": "4cef3550-53ba-4cb9-ae88-893417014b34", "comment": "Malware payload (Dridex)", "value": "f61bcf9b73c7b191e48a3e8be2bd88f3a1a06d33b086134852b9db5ca85518983260e093de66f7f5828a0f08d5ef1fc3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165085, "uuid": "086fdba4-f1ee-45e1-8254-c36f71978204", "value": "T17A44F1496A13D95CFD5F6C794CDE28B16FCCCDBE05403A7F61B1660CEAE02E12C6A891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165085, "uuid": "658c8562-a7dd-421d-9525-f3b6f31fc813", "value": "6144:SbtZbAPPimNA/kjoitkq0ZBJ6o4Wp2wWdpEfJ1PcR6ze9:otZbAPDNAcMa0ZB88I1zEfJ1E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629165085, "uuid": "98f73b30-bea5-4473-87d9-f705672a84f6", "value": 254668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629165085, "uuid": "43e93f4e-68f6-45ae-bacc-eaecd3a3220c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165085, "uuid": "3cbcfdc4-59bf-47d4-b7de-a878d6d989d4", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_99584.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531ee0ee-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209192, "uuid": "88145fe1-5301-4905-bed1-53bd3b7ae202", "comment": "Malware payload (Formbook)", "value": "29a1e8d93a1e5a6aa3e8d8cf5cfe6aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209192, "uuid": "f099358b-699b-431e-9d2d-5aa10257dc49", "comment": "Malware payload (Formbook)", "value": "26563dccfc02bb19e03b7c0ed406bf1a8b55dabdd44148fe04e35ea00bd6f138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209192, "uuid": "7e43df2a-1755-44f4-b49c-541793eeff17", "comment": "Malware payload (Formbook)", "value": "a9c9728f69f862e06d0c2a59e3fe0575b756957a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209192, "uuid": "b41d5ab2-2e54-412b-b828-7588a0940266", "comment": "Malware payload (Formbook)", "value": "7006f6c75de38bec641e6edd1d5ea736eb2da3755ae6c3599a42c59eaf9a0b39809fe9c338ee9581057c0f69795b2a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209192, "uuid": "1797d576-6507-4c9b-a763-c427c827e9a0", "value": "T1C6257C7CB295B08FC933C83585481D91F5AAACE192C6C223A0633E6BF57D357D94826F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209192, "uuid": "55fc9635-4289-453b-989d-5dff0043d46f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209192, "uuid": "11514053-d03b-444f-8aff-11222a08a204", "value": "12288:8cwHzX/s9e/DHTsi9XyOCTRkWZuEDBvT3R0ggIFdN31QLp+C7Ce4Xyms1N6tDI5T:kHDWCNpq+WZXTRm15ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209192, "uuid": "07c11543-9950-46df-9730-869beb0f0d51", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209192, "uuid": "bd6f7bd9-5e1c-461e-9ce4-8a75aaa81df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209192, "uuid": "935bd6ee-f8f3-4003-a3d9-25b563c253e6", "value": "scan0119_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8cdbcf-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629206951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206951, "uuid": "736c7948-b614-41c5-823e-e3c180fc0431", "comment": "Malware payload (AgentTesla)", "value": "ca10193ecf522d56001fccd8d7cd95a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206951, "uuid": "5097d82d-c3f0-4127-9ea3-cfcf2289c7c9", "comment": "Malware payload (AgentTesla)", "value": "265f1f9fa804f36e130200510d7130c5396aca52dd5352601dacf118e21a30dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206951, "uuid": "d4140da9-c59e-4495-ba96-7da2c6844f1a", "comment": "Malware payload (AgentTesla)", "value": "3f0276f238ae3a08fe8fbde17036edab9f8b5e69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206951, "uuid": "c6476da7-9b36-43c0-9bfa-7a2ffb22ec6f", "comment": "Malware payload (AgentTesla)", "value": "b7aeff919480afdf86debe363db88cb06748dc2b00234576bfa4836fab4936e4fdb8d68ec9a105eaf866d8ec700e7c24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206951, "uuid": "fa403118-a2a2-409c-80cc-bbf75e621afb", "value": "T17C451233A8B68F5BFCD221B600D7752E84876C1DAD4704C9BD386389607DB6C4D49EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206951, "uuid": "3e43cae6-84da-420d-94b4-3f44c0018d75", "value": "24576:gwoOKdk5y7NcJ05su9hF1m6JKOxtA2jpTATzOsmO93YL7O+:SOKfnsufF1TftTiOsF85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206951, "uuid": "ff808a39-ccba-4e54-b6b5-f4b9eba617bd", "value": 1234216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206951, "uuid": "7287f75e-779b-43ec-ac8e-501cf7bc25c7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206951, "uuid": "1928645c-b5d7-48c6-846c-915ff91dfe41", "value": "PO - NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042fcc98-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629229675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229675, "uuid": "be227d2f-9eac-4e1e-a2d9-53626ad01e29", "comment": "Malware payload (njrat)", "value": "1c18ca0e92414c51be525d8d878a46fc", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229675, "uuid": "06d8d7e7-0184-492b-9367-fc930667ad93", "comment": "Malware payload (njrat)", "value": "27958b8a764468a860ef5bde824385593de4105e4190718f5486ee4bb87059be", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229675, "uuid": "816a70c7-3184-4b0b-a260-b8c349d21625", "comment": "Malware payload (njrat)", "value": "977c6558c421ac83c48bc4d0113d7c8964f36854", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229675, "uuid": "b50f7787-1e31-4838-bb7e-34ce8a6890db", "comment": "Malware payload (njrat)", "value": "8e84fed3e044e9872e89f4afa318cb28645f114ab4763ac0e79c0ee74061187a35a353111758e31974e7e04b92d1a6a3", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229675, "uuid": "646a92ea-f235-4239-9bd3-71cf77fecdac", "value": "T187D18D71C5834EB3CB6924B608EF2790066047310495C8F7FEC25A3C8E62A7064C71F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229675, "uuid": "002c8ea1-542c-4605-a01f-03b077515cac", "value": "96:PVJbm5MVkQilP1o17uUNIiTaJOjBuBOcNfwyG3ObgmeB36CRh2:dIMG+tT2OWbfUOUmeB36CP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229675, "uuid": "9c5e0d29-512a-4d17-aada-6341059b3619", "value": 6766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229675, "uuid": "6eb2c1a5-ca12-449b-a055-d56a6746e3cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229675, "uuid": "4dc7f116-9599-4e3a-bac8-f0cc0a5ce7ac", "value": "Pending_invoice#YT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6c92bc-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212272, "uuid": "b5a6fb12-48c9-4f4f-ba7a-ea993fd40578", "comment": "Malware payload", "value": "1976dfaa8a10ab420711f5ff0dc02432", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212272, "uuid": "2e022993-076a-4a3a-a5b8-49eca03546a0", "comment": "Malware payload", "value": "27cd70b47588aa0a1c8d737cde89fe8de1351af49aa8f11378a1e26a40f268eb", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212272, "uuid": "4453a2de-bfd3-4ae0-a95b-48876c023811", "comment": "Malware payload", "value": "d4c5b664a9b1a6134149b51d6aaca0175a8429ca", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212272, "uuid": "ad2a6637-425d-4ca7-910d-9bc09638f330", "comment": "Malware payload", "value": "166e4135eb0d911a26101e85ed315061f95f3f614af42390596a748c099bd58d175a4773d239757ef0a14dac86423dc4", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212272, "uuid": "f2249812-8fc7-4b7d-b266-7036ac59b4ad", "value": "T1BDC3E946FD009F27C5D361F7FB9E429C7B262F69D7EB3102A8296FA033865D60936211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212272, "uuid": "26482902-fa19-4328-bdcc-d7baeb965698", "value": "3072:89rgBHcif0HfdSaJ4bJjEZP5d8Z4h0ifO:8Rm0/UO4NjEZQZ4SifO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212272, "uuid": "f2dfa200-86bf-4384-90f9-feff68d6dd41", "value": 128896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212272, "uuid": "ed16afb5-4f47-441b-a4f3-ff3fb54f154b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212272, "uuid": "2b50d51b-963b-4ae9-9ab7-6a683aa9ea93", "value": "ew_linux_armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fa3711-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629210005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210005, "uuid": "0eef1623-764d-4305-b559-929e6e911011", "comment": "Malware payload (Smoke Loader)", "value": "7419091482bffe6ddb3ae66608db0517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210005, "uuid": "0d90238f-7bd0-48d1-a496-adb104822447", "comment": "Malware payload (Smoke Loader)", "value": "296cb7c456c55688de080e9940722307f1ee92acbfec61696e21ec985794a3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210005, "uuid": "b68ae33e-23dc-4001-9c60-b84556b3a869", "comment": "Malware payload (Smoke Loader)", "value": "d251b92a8424f0a9a888835026a2fe9d641b4471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210005, "uuid": "f245c5b2-6925-4314-9972-917b3c89edf3", "comment": "Malware payload (Smoke Loader)", "value": "3e0ac8c91d78e0f45703e507a1c8683b489ce974bdfe5ee37a2f1851c84308307b82fbbeb9b8da63aff8585a3fecd865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210005, "uuid": "26efc0a6-192d-4cc4-992d-73e2069457b5", "value": "T15DA4C53774AC532FE136827074780236A2E19F93E8D9C926F8C3ED5D94712AD25806EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210005, "uuid": "9448220f-dd68-4311-8907-4d6b3702435e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210005, "uuid": "f5ec6c51-c6c8-4569-bffd-077865758b90", "value": "6144:h+QJVlqRsUEILFlhT+jMC0aCiaoKPtbq8zh91vq2VIbJ8W:h96EIZm4JHbzr1v2JP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210005, "uuid": "ae0d2892-a54b-4500-9ebc-b3c3bf6c7b14", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210005, "uuid": "eca9fef9-166c-443c-8067-9616cc4edda3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210005, "uuid": "7f87b865-ebc5-4e84-8862-87ffb4f88b6b", "value": "7419091482bffe6ddb3ae66608db0517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c24d1d5-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629192752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192752, "uuid": "e8331a19-352c-480a-9134-35ed6601114c", "comment": "Malware payload", "value": "738047024e2741cee1cd2da5be5b50b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192752, "uuid": "d1b528e8-2065-4f28-84bc-9062f6167af9", "comment": "Malware payload", "value": "29b6472345fb0eaf95759b22e748fc893ea0537c79fecb9ff4fdfb70d642dc88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192752, "uuid": "7e8d6183-42bc-4d1a-b809-537ebbcaf428", "comment": "Malware payload", "value": "7de01094a5bffd81aaf8aa9cabdb43688aa12d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192752, "uuid": "343d1fa4-2947-4d50-adb7-56c4c1745530", "comment": "Malware payload", "value": "5f709f4705411e25437a911525b6a836f90b72c1fcb88bd03ca19923338a2f99a11ccb383ed73272ea2cf51f419f458d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192752, "uuid": "fa0a8c89-4391-4e2f-b8ed-3fd506cc1397", "value": "T18074AE30B791C035EAA731F459B683B8662D7DB04B2471CF92D52AFE16346E89C3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192752, "uuid": "42ab51e4-d2c2-4724-8d3c-8b3aed12908d", "value": "617bb54b6d8ec8aa7b0fd7d08ca3c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192752, "uuid": "8044efd9-3c51-4ed2-9ecb-0b18afb2d08b", "value": "6144:mFM9NCYOqCUgr4pvYiyJvz0mVYjzksGdYnIVG6exbHKeLnfTvkmDfaxMB:b9kYOqYr4pvY/0mNXaIVExbHPnfTvExM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192752, "uuid": "d31592ce-7339-48cc-8361-389fb5df79f2", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192752, "uuid": "93e97034-64b3-4431-ab74-60c6493d6776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192752, "uuid": "9e793829-b488-4be8-840a-1d4550a86a3b", "value": "738047024e2741cee1cd2da5be5b50b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aee5093-fef0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629159437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159437, "uuid": "fd453ad6-9721-4ca1-a8dc-2b88c4710cb1", "comment": "Malware payload (Dridex)", "value": "801e6e6f95ca3a3a2371a12c858743da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159437, "uuid": "115ce50d-12ce-44e5-824d-e2f057a6f847", "comment": "Malware payload (Dridex)", "value": "2a0780bb39a505e05fcabb926d76b78a6aff3d67c380e152ada4bc6c86bee220", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159437, "uuid": "bad5686d-d972-4a00-bc61-76183385cb9d", "comment": "Malware payload (Dridex)", "value": "046697670007ef44391600c35aaf31849a2169d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159437, "uuid": "af7b1028-e8ff-42ff-a4ef-406e5d1349ac", "comment": "Malware payload (Dridex)", "value": "0a90af816f89cc5545a2c6f1edff9365abc45391d1bbdaf8f128cbbf5d8012a6e05c27366d49913e907fffea28e27835", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159437, "uuid": "9738ffac-f1d2-45b9-95bd-73634964b6d7", "value": "T122140227DA145883C97CE37E7D17397817475A06830ABAC219B36D5B2F4CDB00BF6899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159437, "uuid": "fb7f24ab-4d9f-4fa9-9825-5faa52c793bc", "value": "6144:QogkLjLhMQQXqK0QQ3wSQfT3omxUw6O/Wk:FDLZMQvdQQbQDovw6O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629159437, "uuid": "d25d31e1-67e3-4c8c-8195-950ab5959ba9", "value": 208455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629159437, "uuid": "b94484e9-c81e-48ef-a35c-d433b4a75b98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159437, "uuid": "b2ed171a-9da2-4062-973b-c6428b8d10c7", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.767737.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db39f59e-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629193099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193099, "uuid": "c377831f-234f-4468-ac58-dd60634f1441", "comment": "Malware payload", "value": "81d05991f57ed00cb5867fa4db1c547b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193099, "uuid": "232d6b17-d311-43ae-9929-5dd62cc53fa8", "comment": "Malware payload", "value": "2ae317c37c90eb6c1c5d339715f872a9bca3e11383f5f731d9a6a4762ea18527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193099, "uuid": "9c2e42a6-8afa-4e1d-961e-c7bd75d09e44", "comment": "Malware payload", "value": "3bce209e3049065032dec97b957f2fcd4752481d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193099, "uuid": "dc09cd3c-8809-4e7b-a24d-b08c1afbaf7c", "comment": "Malware payload", "value": "a6c584e1d61c47f12a4a3053497ed235efb144e3cf4e1285c7c01d19003da5f76b74b3a27c79757a304da309db809889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193099, "uuid": "6e81b2df-ed05-4a88-b917-fe7faa78cbba", "value": "T15D55E93815B83A3BE179C339DEE4482BE6D4F45B7211AA1A70D647670703E42B99327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193099, "uuid": "980b5934-c4c9-4312-8159-41e1330a9dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193099, "uuid": "3df44ccf-5801-4939-abab-bb71513e8242", "value": "12288:iuy4HK+oNucccOzCM/x9oDrkFPteNvSE3piP3FnsDc9F3nC0Py3gAhwytLcvSHP1:E4q+oNucccOzCJrK9FnUC3qb/UxoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629193099, "uuid": "4a3fa2df-fee5-42e7-8adc-dc95bedb77fa", "value": 1316352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629193099, "uuid": "922edac8-e92d-4e3e-b2f2-a7e1bc3b9994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193099, "uuid": "fd6438d3-5116-4fad-9fad-f3aac3b5c5e9", "value": "RFQ 18758 FOR CPUW-1022601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bdba7d-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629208871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208871, "uuid": "c1111e70-f1ae-4bb5-90f2-f7a906261298", "comment": "Malware payload (SnakeKeylogger)", "value": "8edfe38cbf13f841e5983914eca9eeec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208871, "uuid": "7732b53f-f0e8-46a7-91fc-a26718a985cc", "comment": "Malware payload (SnakeKeylogger)", "value": "2befd6abf2afb0db8f739d7b1bd55b33761add7f8122ebfe61c1617adc937d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208871, "uuid": "2494e04a-8640-459e-8cf8-b0b000f9670d", "comment": "Malware payload (SnakeKeylogger)", "value": "684a84499b620cf15e54fd7d072fdf2b127e15b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208871, "uuid": "87d811f6-bec0-445c-917a-ace50d256a9e", "comment": "Malware payload (SnakeKeylogger)", "value": "3da569bc1b1595b28c1980a82ef3924e252f9d656a0de04de34409b7608b364fcf958aa57438441ee8897e2fb2f6416c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208871, "uuid": "d5a65960-ff55-4a94-a3cc-58ccf7013c13", "value": "T17EC43A243AFA501AF173EFA95BE47596DAAFB6333B03E05D109103864723E41DE9193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208871, "uuid": "b36f2507-6469-4a37-9439-4959c3a3ae16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208871, "uuid": "b093438c-2082-447d-bcdd-92007a07a68d", "value": "12288:/Pi8douzwNbfyPw2pE1YV+zVdm7Tn+tQV+m1nC1upjFsDbiKM0YlA:/Pi8YVDvM0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208871, "uuid": "5c7cb514-4350-4e2f-ad76-75e09ef59b65", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208871, "uuid": "bc2c5079-a482-4cfc-bc5c-354f4abbc470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208871, "uuid": "4888ebbe-b2ac-41c3-845a-e50a80835777", "value": "QUOTE PDF-SCAN-COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1ff3e0-ff99-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629231893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231893, "uuid": "122ebc87-60df-4a91-9d4c-e2f7f2f8d97c", "comment": "Malware payload", "value": "412d339c2e37fd026026e546da1c2edc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231893, "uuid": "062d1f88-613d-4e3d-85ea-7218f8cd2dda", "comment": "Malware payload", "value": "2c4e274d7f501b5f26ad77823d62f5c1ff7945cb1045072e80d2de5efd562d2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231893, "uuid": "e42a38f2-ddbc-48b9-a791-7605555bd930", "comment": "Malware payload", "value": "174a98801c9312f3b96cfc2aead00f93ef1d4cfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231893, "uuid": "487c3d40-9701-4cb5-8f69-677b4621f0f4", "comment": "Malware payload", "value": "ad00cc00fc3f1a49605d3a137cdbb30a18273a4989c94749fa65ff407d290c222572366f8b1f5f0a0f7c94fa82736937", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231893, "uuid": "18f1d043-9c80-4555-87f9-236fb7bbabee", "value": "T1C1941710157B180B50E3DB795CCCD8FBE98E6163262E36320261A7AB674DE60DD0B7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231893, "uuid": "d5258e92-6b7a-47c9-9fe4-9aa7bbd8fb8b", "value": "3072:9lzAQEeUcIYzCg1APIx1IWy0iwMCngbV7lZaIiuvWlCIY+MtjrNF+tv4EcoSx:JIYDZ1owZgbVGlC0DvBcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231893, "uuid": "dc3045a0-0a95-4e3c-8a67-3c5801208321", "value": 445312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231893, "uuid": "f5fe5c46-f88d-4ecd-8aee-9d5661193278", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231893, "uuid": "9022e942-0381-4a3c-a7da-5702f3ae0106", "value": "PACopy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da17a36-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190392, "uuid": "8a7feb7d-d970-4cd8-bab4-1c18eaba5c06", "comment": "Malware payload", "value": "a8c5dae9b56580be14e5c7b2fdd941ee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190392, "uuid": "67b5a214-7758-4ed9-af40-9fa2d22e662b", "comment": "Malware payload", "value": "2ce55497d0c655d5cf3bcfe086bbc8e1a42bad7e01c6625d068e8e184cab7fc2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190392, "uuid": "dec26952-9f05-4c8a-94e5-cab1a70992ab", "comment": "Malware payload", "value": "2a1b0edfba33c8c563897ceacadd3af5495fe9ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190392, "uuid": "a2922800-f184-4013-9d09-9850b2a1c828", "comment": "Malware payload", "value": "888a3e62629176d5f34cae7cec4e275d020c28a01cbaa7bd4121260c225ba327a5b0b501fe810a68ba1f0cad86ff496d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190392, "uuid": "b10ae3fd-5f79-4ba5-a437-cf18b073adcc", "value": "T19123306CC0AB01D88F862BB4672B9F85058C766DF784E133B67C53312BD1D76451A93C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190392, "uuid": "960bb7dd-3eab-4125-ba07-86e4f1db375a", "value": "384:hk9Uc2MT9BxcOpZCeLM6uRuXsSQa5M1lD4XD:hkrTbxceLMRyUlMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190392, "uuid": "a0e365b0-ade8-4c7a-8a6a-543e35d6fefd", "value": 46158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190392, "uuid": "e5862d80-135e-497c-bb07-41a7f0486f85", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190392, "uuid": "6a8adb99-e542-41b9-92d5-df32cc565557", "value": "Shipping documents for invoice PMB20-04140415 for 15.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c461003a-ff48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629197356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197356, "uuid": "231e5c0c-55ac-4c68-8cdc-cc5869fe4d59", "comment": "Malware payload (AgentTesla)", "value": "9abae3bc98b5d5fce33b492d3d2effac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197356, "uuid": "547ed790-9a89-41bc-b9bd-50413c465e9a", "comment": "Malware payload (AgentTesla)", "value": "2e46a6ce05c0d8320d16a8912d485595c6b8764b058a418110f1ec019d5bbafe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197356, "uuid": "ef455adf-df60-4ef3-a238-a02347c798d9", "comment": "Malware payload (AgentTesla)", "value": "c930d49c082f9695643ec2e90b6dff5b521d82f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197356, "uuid": "3034fe9a-30f3-4d66-823f-1387265c8f77", "comment": "Malware payload (AgentTesla)", "value": "379393b0a0be3984f14d37160ef1bd84780ac9c17650da7a0cc0200b2ff16b9a6254451e20ae7f34bfb47e779dc01449", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197356, "uuid": "07e11ea6-d1e5-4952-8e10-e45d019f4880", "value": "T1E2A302115B7BD97BC4F61F7BADA3232103FFA9624560E71E369C50460C827911563B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197356, "uuid": "20c5cfb5-2a94-456c-a556-7b732a40a765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197356, "uuid": "faee3ff3-3667-4279-bc5d-203c103de59b", "value": "3072:tRm1MianhLB7XqSl9Q8IGuSdjnOiRs3/3pEPoLFO9:Znpld/BnlE0QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629197356, "uuid": "4bb92108-0e3e-4ba9-b23f-2afd27bc00be", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629197356, "uuid": "1e53b251-14c3-4d55-8606-5fb11e72d3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197356, "uuid": "4b0557b8-9b91-446d-882f-39f4d61a7c0b", "value": "INV 0003847400004857 INV 0038474789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407bc722-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208731, "uuid": "4d6d02f1-0d76-49fb-919f-1a996d54c3a9", "comment": "Malware payload", "value": "97c20303ea4df2c269d2c0f3b92e7554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208731, "uuid": "b8830143-0e68-4898-a029-a89688cc9c43", "comment": "Malware payload", "value": "2ee4b51767f02d5c786e67f2cea119ae371b6b3a14ed28d6cca9a35c0e3aa4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208731, "uuid": "2c62e7d0-4079-4684-ba25-48e7dad28bac", "comment": "Malware payload", "value": "b6a712c14bb21221cad17460c15a1a364948a7d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208731, "uuid": "d50b55c8-861e-4e3a-a7a0-7dbb80531b4a", "comment": "Malware payload", "value": "d2ea31679172806789a89e986f9640074179dc71a7e19e8bff06097cd7c3cff2c4db1a0c9ce6afc874107a8987a3353c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208731, "uuid": "a6393b13-edee-4ffc-a971-a73c846e50bc", "value": "T1DF45C83815B83A3BF179C339DEE8485BF6F4B45B7211AA1670D607670603B42B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208731, "uuid": "1dd39b55-f4a2-4a94-a0f8-e4c9d722fd78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208731, "uuid": "e64fc940-d188-4390-9a77-8457db6093e3", "value": "24576:/QUQTc4cXz2MroMlaI/fFnpfTUejMRZwNB9IW3:VffBlxQlW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208731, "uuid": "697c3b60-60dd-4946-8ece-2c9a6e62e7a1", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208731, "uuid": "ef35d3fa-3d50-422f-a0a4-dfdaf245c971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208731, "uuid": "8b4809bb-d2d1-4b47-9fa1-c6c309ad8d46", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c305baea-ff43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629195206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195206, "uuid": "7c594e8b-8a70-4c87-b946-5c5ba81e0501", "comment": "Malware payload (SnakeKeylogger)", "value": "35f1d0f2f60b193c004a81b219c0dcc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195206, "uuid": "688bf406-ddbd-4043-8130-19ffa5a53d5a", "comment": "Malware payload (SnakeKeylogger)", "value": "2eebd46329136de964b1869f44ca5b69d1773f833249e638f14373e81719dc43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195206, "uuid": "d48cbe86-4dae-4fae-a251-5acc52101fdf", "comment": "Malware payload (SnakeKeylogger)", "value": "9023606c91ffc1e644de2a8c537372600cfcacfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195206, "uuid": "b5bc08b7-3c4e-4289-ac80-40a52f4def24", "comment": "Malware payload (SnakeKeylogger)", "value": "e8a0d4ae2650fe29439be218e85c6e39d2a5f1b605d2752cb12cbfe9c921f294f8084d96b6e5370cf312310503c20e6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195206, "uuid": "ed2fff51-fa65-4d6a-9394-570dc9db0944", "value": "T182154D3C1BB92667D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195206, "uuid": "456d5268-33bb-412d-a1ba-fb1638696c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195206, "uuid": "c2c1664b-321a-4517-a4b2-581566ef196d", "value": "12288:utDc9F3nC0Py3gAh5EJbjJEK1aR4Bglb2pJqdxpyJJkyamcZHqncmjrUAqZS:TaRbbM0yamLc0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629195206, "uuid": "764f76ae-d7a2-4d71-975b-2253edefce8c", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629195206, "uuid": "f3faa13f-8bb7-4c26-8f63-47c70d06c253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195206, "uuid": "a592a045-b13e-4e85-ad80-d60944fb0fed", "value": "35f1d0f2f60b193c004a81b219c0dcc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e76adc-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209013, "uuid": "b2ebd086-6b22-4e1a-abef-18d9b69a6a79", "comment": "Malware payload (Formbook)", "value": "c01f5fcff2e5ebfa74526d5f4d563ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209013, "uuid": "44a6db56-c940-4246-bb07-3b3718c99ed5", "comment": "Malware payload (Formbook)", "value": "2f36f2e2951a2540ab138afc8ac70f8bb37b83f01199434e247aa6716e1eb47a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209013, "uuid": "86b46909-a8d0-45c3-9fa9-3c51f77d39e0", "comment": "Malware payload (Formbook)", "value": "2766d97c1380d8044183641c9a369ea12613d196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209013, "uuid": "88dfc789-c468-4c34-a45c-618f4de74bae", "comment": "Malware payload (Formbook)", "value": "8ed8507bd55ea63cbe6ba4084dfa74e5759949669c4763eb703913086a670f2f2c59d232cef37fe7e9a69ff7a8afc7f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209013, "uuid": "d3567aad-43e7-472a-8238-543928af4d1b", "value": "T18625703C1BB925A7D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209013, "uuid": "78373451-314f-4363-98ac-9caebdaca521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209013, "uuid": "4305d5fd-78f7-4dad-9a8e-13f4a9010ed5", "value": "12288:78Dc9F3nC0Py3gAhyEJbjJEKKLaH3cMdP9l+FQI0pf50cceXcRtWgi6twM6hyy17:QMmXREcRcRwg5whdVwI/Wzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209013, "uuid": "5702f5af-3e45-45b3-bde2-6f176b7ff8fa", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209013, "uuid": "87faca35-8399-47b8-a1df-b675647074e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209013, "uuid": "a3e064ba-4972-449f-8f8a-2ee677a78065", "value": "YgAynTdpcncdnG4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cfa6b7-fef1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629159859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159859, "uuid": "13fe63d0-7b1b-453d-a124-8d632f5b201f", "comment": "Malware payload (Dridex)", "value": "5f7d4c528118c0267430cc7d46cda209", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159859, "uuid": "da81b647-6469-4c90-94c1-d712e92626e4", "comment": "Malware payload (Dridex)", "value": "3064da0c37dacf3b3545ab95e7c436124f116a1d0a60f23982715cd15d7771a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159859, "uuid": "92fe5814-deae-4a86-a278-47ae0bf82d92", "comment": "Malware payload (Dridex)", "value": "8afd3900015c777610d5aca48513d40c04bb1f1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159859, "uuid": "88c908d2-e05b-4944-aa2c-9274cffdfc48", "comment": "Malware payload (Dridex)", "value": "4de48270b8ad82967a1feb460e41e0f34c5ef95444e308a591190e00356c4e7364bd2e2dd238f0a02446c4fb373f5838", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159859, "uuid": "88edfa70-9cd9-4141-ab1d-d917b6bfb3d5", "value": "T1B9241267FF048D13C11EE3B63E6339B183912A45570675CD89E12BE96E1EBB60BD901C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159859, "uuid": "6578e053-ede9-45ea-a70d-74c777cc18f7", "value": "3072:aJ/ogkBdPxNLh5EN+TiH1KH5DdW+d1Cjfn0JarA7nwKN2lB5vkn5QQO5nrVbIn:MogkLjLh5HMsZqj/0JkKN2z5Mn5Q9Fh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629159859, "uuid": "cac98a62-33fd-4cfa-80d3-63b7e4385677", "value": 225666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629159859, "uuid": "af71b297-b6d8-4171-be0b-cded678b165c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159859, "uuid": "cef92ef8-a097-407a-aab9-66edba920a27", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.5072886383.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de93e5ca-fef9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629163469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163469, "uuid": "0b7804b7-c39a-4130-a021-a04eccfd0394", "comment": "Malware payload (Dridex)", "value": "e5cdc150a6144001cb690f8ed61650a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163469, "uuid": "dd5fd94d-2828-44d9-b015-53593c690e24", "comment": "Malware payload (Dridex)", "value": "30a212f7df0f6d48055f32e62ffd55dca59c0f1fb9791061ab0b32b1f6597527", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163469, "uuid": "fceab2df-c366-4df6-b232-d758f1f31558", "comment": "Malware payload (Dridex)", "value": "259a85ec4c144037f92ff0b858feba15bd4015d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163469, "uuid": "18f5def8-7003-48fa-aff5-4c0f6f519852", "comment": "Malware payload (Dridex)", "value": "89fed053b78f57eeac77f64eb62e6b4d0cd3a223852fc27115c51c6bdddb98c09d5ab4bde13e34a2a3f56b719a38de45", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163469, "uuid": "0f8e5a57-2c2a-4183-9fb5-e6eb1f0e8f98", "value": "T114440213DBED6D53C45CD37EEE1238A103595A06D30AB9DC09B22D6A7B2C4F687B901E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163469, "uuid": "b9806860-1bf0-4237-934a-42855ed02115", "value": "3072:fJ/ogkBdPxNLhuPMlzmBxYSFb7BosvD2JfgKNXDIWyRD7sgmVR8cFXfKLqq9xtOI:xogkLjLhuPMVwfb7+BfNbtvKL7YWyQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629163469, "uuid": "0f93da9f-e929-4784-b476-3c0a1c1dddfd", "value": 277180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629163469, "uuid": "5a68584b-f2e6-450b-8e28-ab762a787229", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163469, "uuid": "a71e76bb-aa77-4860-824c-d2190d879c63", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.990404.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bad0f4-ff21-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629180601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629180601, "uuid": "a1120a83-2a87-4f8b-9eef-c41913112fb6", "comment": "Malware payload", "value": "5233627de3c47be2156f99cc68720377", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629180601, "uuid": "3b0e5abe-1994-4df5-9138-9008cd831292", "comment": "Malware payload", "value": "30b7915569dba9d1a98a25fade75997c07558cfb5f7fd5e23fdc8945ddf22e50", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629180601, "uuid": "3f5a459d-7109-4a30-a5a5-7db3607e284d", "comment": "Malware payload", "value": "fcc19db31d01aac0d32e7630e401fab2e48dab13", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629180601, "uuid": "49373986-a987-4398-8ce4-cf3a63afd65d", "comment": "Malware payload", "value": "069d6e941eaf0559887c2acb19a8200719bcbed6c647f73a346ca0c13e2e237f576fb2f96c5b77729aba84bf7610209e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629180601, "uuid": "e5f6093b-09a6-4563-900c-2076b499b924", "value": "T1144512B9BD971B92DE0D2772C04BD0C1AA9EBC538FD15E9146ADF11710709FEBAC8221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629180601, "uuid": "3a0e8d7a-5c06-4671-8c71-030fa97139e0", "value": "24576:GKnEzWxQEjBrL3VgEFiDGoOt/pXLwnCNRAScWjWH2DYPT9:GSEziB3lPiyoOJp7szSiH2DIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629180601, "uuid": "1652d6ac-91c4-4564-861b-b2109eb6e287", "value": 1213832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629180601, "uuid": "331ebd23-9ca4-44be-b7d9-2da03ff3358e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629180601, "uuid": "f9c0d31f-1d07-491d-9687-7644a6f30412", "value": "shipping documents(CL&PL).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b1a0e-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209523, "uuid": "343533fc-429d-4ca1-a5be-4b5e49d009d4", "comment": "Malware payload (AgentTesla)", "value": "9a4a36f1e90ad49ce88ec0ee8dbaf87d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209523, "uuid": "3aa3ede9-3123-4a38-b7aa-61b4b3c5e24f", "comment": "Malware payload (AgentTesla)", "value": "30ea10aa89d15c5f00404c8eef3c3281cce5d9cc11f835112eb8d01687385134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209523, "uuid": "7a56e63a-0190-4453-93e4-bdd919bdd838", "comment": "Malware payload (AgentTesla)", "value": "18f91493c56cb1e2f9191b192f3ce1ff6f104073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209523, "uuid": "b720436e-99d5-47df-ac51-7d44a84d11df", "comment": "Malware payload (AgentTesla)", "value": "484470a2914c8166523d2809062be1049b75219f9d06bd81b02178c83ebc33ea868a297917f213046306e87205255cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209523, "uuid": "f72a0662-3ada-4542-9181-92b4891df5d1", "value": "T11725703C1BB92667D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209523, "uuid": "2b1674d1-3c1e-489f-9ab6-d040d023a9e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209523, "uuid": "4d815f73-0477-41f4-8ebd-881a9f5f4d77", "value": "12288:VzRDc9F3nC0Py3gAhGEJbjJEKwNpaIGL4wlpDayO4B3tJD1JLy74GgEueW3M5vGx:B0piL4nyO4B3m4GgEueH5v7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209523, "uuid": "af22f2a3-2564-47d1-9e5d-a4d539da7989", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209523, "uuid": "90f2a073-1d16-4279-b2ad-23d1130d2d32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209523, "uuid": "3027ea6a-2c73-40ec-9837-e9d81711f0dd", "value": "ez0yYNLkd0vHtUs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08c6786-fef7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629162614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162614, "uuid": "d5040dc7-fbbf-43c7-886b-009a96006819", "comment": "Malware payload (Dridex)", "value": "0d9290adf0b19906c802608ce09e58f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162614, "uuid": "22ba5372-b079-479f-bf5b-b4dacd7d614b", "comment": "Malware payload (Dridex)", "value": "311423b679bda5456edda983aa0bfaad45dc5cc36b918bd9d69d0f0f5c4881ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162614, "uuid": "b032267e-7681-4fa2-8597-2d8f01f338a6", "comment": "Malware payload (Dridex)", "value": "a3a9f1cd5f07341334f9799fa81c0827de830fae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162614, "uuid": "eea5a654-c93b-49fe-bb59-8d2b4ca269d4", "comment": "Malware payload (Dridex)", "value": "0ba0ee099da1cce4ad586eb1d763782fdc300b07653043ee497d3b5f0ae5c95c5ea405b1006b6d057fd4629830d6a4fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162614, "uuid": "94949f5c-f76a-4fa3-8b73-9739f1b72ab0", "value": "T15C441217EE949403C55CE3F5AE673A6007185A016F09FAE961711EFE6F2D46A02EF02F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162614, "uuid": "ee97ef3e-8531-436b-8452-84de7915bc75", "value": "6144:QogkLjLhaay2JZwO/dRzrJJEiEx1q5ya3z3wswR:FDLZaafVdR/EiJgsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629162614, "uuid": "282855ab-a8ea-4648-9918-8eabc9c84ab7", "value": 274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629162614, "uuid": "0e1e60d8-f8aa-4691-9f75-4b600946abd2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162614, "uuid": "87aa96aa-0114-4adb-b2aa-1f27ae523770", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.01179155.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a3b3ac-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212389, "uuid": "855ba230-03ae-4b2a-9d72-5b673e878d3c", "comment": "Malware payload", "value": "321ef3954eda5ed5028a749180f3edd5", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212389, "uuid": "faa37958-9066-4c74-a50d-d0c858cfecf8", "comment": "Malware payload", "value": "3141ce911e3da8b0bf9744ef0603f7fac55be157eafc54995a752759882da1b2", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212389, "uuid": "5c656877-0759-44fa-a9c0-077115d2e5d1", "comment": "Malware payload", "value": "2fe9d96da7934a5a984485b8b40c0153048d6b9d", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212389, "uuid": "acab0929-d0b3-4ba1-a72b-e97b6155a416", "comment": "Malware payload", "value": "eee000f5b53ceab651ba7bc572f2d206c1076261b038d607bd6b47017821817316fd0896ed9d10b633a0f228f049dbb1", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212389, "uuid": "84ee46e3-91a6-44dc-bf7f-20ab65e842e2", "value": "T155131A07F10799F1D6A543F354DFDABFC361FA2288126E6AFB0E8B28B7275115C2A104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212389, "uuid": "4c7d63e9-7d50-494d-80d6-48182795d8cc", "value": "7d99f0b8a05142805a486bc9d5f4f034", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212389, "uuid": "a237dcb6-1f68-46e4-b0d6-bd1d10d9ffdb", "value": "384:1LegHvv17U70dznVlKdZBgekfKpvExKCdBwDxfdSsdFrlUTvBpu6g7omz3emYerA:9H1ldyd5vExtm2YlaBitzOveC6nE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212389, "uuid": "11d6d9e3-b7f7-4f51-84e3-d290c547b9a8", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212389, "uuid": "8d0a7567-69c6-4d59-aa33-fd62eb640d85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212389, "uuid": "0f787cee-4266-4c20-9164-9ccb745eb7ed", "value": "ew_win32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4605ca-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208944, "uuid": "aabd7eea-2c62-4126-87c4-901799df8938", "comment": "Malware payload (AgentTesla)", "value": "ceb070c517a347870a49a7a4cadc4eaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208944, "uuid": "d10a9945-3065-497d-b3b9-4474f673ffbc", "comment": "Malware payload (AgentTesla)", "value": "317d1a71b0b186812944940241a087e4c93cb1a305a98838d60b8263881c7446", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208944, "uuid": "599290e3-5ff3-4d25-819f-549f78a7357a", "comment": "Malware payload (AgentTesla)", "value": "54a670366ef16dcd3a6c651f2ac5c3b56b778348", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208944, "uuid": "c01e72f2-c657-4242-9089-50426ddd3136", "comment": "Malware payload (AgentTesla)", "value": "59ebbaadeee64a407a4f3054a5ec118cba07aabfe472d2ee8af92eb8ed3ff7b475d10267ac62b7947c89d4496c2e486a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208944, "uuid": "8f6158cf-f904-4f0d-be97-584c38e0cef0", "value": "T1BB25813C1BB92667D165D23EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208944, "uuid": "9c2e2e06-0c76-447b-bd8b-fe090bc4ac3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208944, "uuid": "426ba077-6ff7-42b4-a6e9-e330681c078f", "value": "12288:VUDc9F3nC0Py3gAhbEJbjJEKSnLD/o7w/sY0cloSBbATUHIqPZQgKA3vJs3NDYud:ILToS7IqhPKky3zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208944, "uuid": "c2d0e9e5-c4e7-4c4b-9a72-6fd70eaaa526", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208944, "uuid": "56f93efe-a985-42be-b045-886fb8363b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208944, "uuid": "6ab5da43-c7dc-49fb-bf79-18a8ead6bd56", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c6b7c5-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208740, "uuid": "c5a11e98-a191-4be9-a94c-263115e5bd56", "comment": "Malware payload", "value": "b70ee70ba2aaa2235bd67ebff40be841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208740, "uuid": "e4f2b021-e65d-4d1b-b9de-443a4bc8ce31", "comment": "Malware payload", "value": "3192c98facdb63d12e5a738c8fa8d683afdbead30e2605b55785900ac5a15a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208740, "uuid": "abf8dd19-00c8-436e-8c4e-210ad0543214", "comment": "Malware payload", "value": "68e8a648b61ec2df5bd75f88b10a95427aa5506b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208740, "uuid": "8c4702e4-7c1b-4eb4-a8a6-8c60110be3fa", "comment": "Malware payload", "value": "feac53b4ad68a9c87c1602e050eeb45c996c3849a4e38a010316d3463b5533fffaccbd4136ca0490f8ef1afcf855e181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208740, "uuid": "7678e9de-d3dc-4942-8f22-585d47f70938", "value": "T12755FB3815743A2BD179C339DFE54C1BF6E4B55B7221BA6A70D6176B0203A02B8D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208740, "uuid": "21c128b9-a3f3-4eed-b089-87e7f83be36f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208740, "uuid": "18cb913a-ef2f-40a9-8931-ada44b869a7e", "value": "24576:phqF4cacWzg3x05FnHUNCMV32PV1MwEqtKSWZHnVehI:Oq5BHZMGV1MwEn/ZHnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208740, "uuid": "9abd0190-8e91-4e22-a737-75cebf10f8eb", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208740, "uuid": "eb4c5a12-7edf-4928-84a5-e511ff26ecdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208740, "uuid": "9795d89a-db38-4575-8650-a0a93f4727f1", "value": "New order- SPS-02-AESHI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffa927b-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212300, "uuid": "40a18c85-3430-4f7e-9549-0aab6395db41", "comment": "Malware payload", "value": "7a21e7cd0bb339b2d5533a3114ebc920", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212300, "uuid": "0de4e588-53bf-46a8-9de2-ac8fd65f247b", "comment": "Malware payload", "value": "31ff4a9756eab5f110bd19f1250d50cca5068054e99e73068929113aaccad0bd", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212300, "uuid": "1326ee7d-4020-44ad-9fdf-cb0528aace62", "comment": "Malware payload", "value": "46eb9f47d337920d5848e60fdebe67ef33fd884a", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212300, "uuid": "5bb8b9aa-1f6c-4ed4-a55b-4d33caf7a88d", "comment": "Malware payload", "value": "e14c7abc71c526c7562dbafadf4078c92c44d66e9aa1278f7ac54625a88ee19d86359316db043f640d2bc440dc362bdd", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212300, "uuid": "42548e8a-3e4f-4192-8bd4-4fb86fce0238", "value": "T12DD423BFA0DAB24A7512EB076752CB40163DC95A3B5E878E631888F6D17E247C7DD280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212300, "uuid": "d681efce-eaa9-4b06-a5eb-4bcfd9418687", "value": "12288:9O1ovBJLNs6kBN0nm/6cXrV81GlE0ENQ1wJDroYSO14VFA9Mt:UGvWbN0/KOkE0mQ1wJfoFXAyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212300, "uuid": "4cd19ab4-cfa4-4c4c-915d-d22672d4af2d", "value": 634455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212300, "uuid": "4b2f5a8c-0b4c-4122-837a-c87d5e4d0932", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212300, "uuid": "0ebbd35b-803f-428d-996e-cc483ad5138b", "value": "payments copy_3000 usd_________________.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d66f0ed-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190257, "uuid": "0ea2f02f-78f8-49dc-a860-875dbc6aa640", "comment": "Malware payload", "value": "18850ee78056e286b1b2fdc4ac5cee71", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190257, "uuid": "ea4ad060-c1e8-49f5-b221-f075ba5fb3a0", "comment": "Malware payload", "value": "324905a06c225e3f6fb1a509f55044224c1bdecac3fc20a5f1c465a2730cad0e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190257, "uuid": "fabc6d51-c74c-4099-a88b-2e46fe84f8cf", "comment": "Malware payload", "value": "900fc94adbab40baab24f5ca3094dd77294f46a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190257, "uuid": "0731bf58-aeb3-4d0a-8a09-f3d4ea5b64fe", "comment": "Malware payload", "value": "e5c1c1141beeab165975f6fa356e1c2bb9b49e98e60068fdb2b817557798a131b9d1a490ebc2b088f8b22f1856d22ff3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190257, "uuid": "734f24b6-e4a2-4728-b730-3277e5a4fd7e", "value": "T15C8138592F581883C60BAAF2D0467E5F0397F10812CB1785F7AEFDF18F66B226A11418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190257, "uuid": "e5b1d1ea-4258-49d1-ada1-cfb334ae10fc", "value": "96:J7azZkFlZX8T5C/Hh/hlBOsb3LJq7WwBdQoAVQ:J7ASFi5Cf3lBOsILcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190257, "uuid": "a8656cff-0b2d-4eae-94df-fbdf3856c353", "value": 4047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190257, "uuid": "ccc901fd-0b34-4a77-bc17-b6dc18c667e7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190257, "uuid": "bf98e013-1d4a-4d6b-a1a4-3d053948f083", "value": "A88090F - ASTM A847 WEATHERING PIPES.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519f22a8-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629210048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210048, "uuid": "4ba76076-9117-4558-8dad-363db323366f", "comment": "Malware payload (Formbook)", "value": "c36a8f55e7338503e15ef4d91bb39eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210048, "uuid": "68a01ca6-00d1-4791-bc2c-56826950b4bd", "comment": "Malware payload (Formbook)", "value": "32bebc90eccf1fc02fa1f409233269a76243731db1192a827d31d3d1dab2f6da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210048, "uuid": "5efe29c2-ed27-4a0f-8c08-cd81a2e269ef", "comment": "Malware payload (Formbook)", "value": "58ab226cf75f26669dbbf933f94cb73bdbbf48ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210048, "uuid": "3f8c37ac-d4dc-4be8-9daa-8c3e750db12d", "comment": "Malware payload (Formbook)", "value": "5fe9b3e9e3ad4893fea8905c678ba3dd4de10432c00a63c3698bc2cbbf95c01238b1fc49ba58716b9f74e93b5bc3dfda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210048, "uuid": "d8702579-8e73-4975-b265-5d265efbd910", "value": "T168256F3D1BB82667D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210048, "uuid": "32763404-6200-465d-802b-f87084a0195c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210048, "uuid": "bf4fae97-8d6f-4ce3-b691-fb63ca400b79", "value": "12288:2+CDc9F3nC0Py3gAh5EJbjJEK6mYmBElDoTQkKdz5oD0/M1KE6tHbN8OA3xewko2:1q7mBE8dm5oD0/M1utc3xBO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210048, "uuid": "759106fa-0beb-44b8-adc0-9c530337f667", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210048, "uuid": "270e65c0-3bbb-4a1e-a8a2-d4180b4b42c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210048, "uuid": "04999a3d-b81c-440f-9ebc-28cf721d5a15", "value": "c36a8f55e7338503e15ef4d91bb39eff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bddcf12-fefa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629163680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163680, "uuid": "4948325b-7369-4100-b8aa-3a6002f4d57a", "comment": "Malware payload (Dridex)", "value": "e8ac0fce89ce519f99baeaec559664ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163680, "uuid": "18612340-d471-4b6c-ae8b-0afcae19b289", "comment": "Malware payload (Dridex)", "value": "33285c8c1773e88f9b90712a9b1b00620f5bc73f59629eee4e92f1d706f7c054", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163680, "uuid": "61e3dacb-e377-4e16-b3f0-6af0afbcc798", "comment": "Malware payload (Dridex)", "value": "54a9975e3246470d89a119a8b9b053954fb5540b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163680, "uuid": "795b8542-c9a9-4eb8-a451-3ca79f3614e3", "comment": "Malware payload (Dridex)", "value": "e1396cd702965865ad5a25796448251d6603c6ecf3e02b76cd362749545348dc28d160dd750b46d67cb59e82e1853461", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163680, "uuid": "85640b61-135b-42d8-802b-64e1a005c16e", "value": "T1DB340223EF181953C18DC2F6BE2B3D9003155A40930E74DA68B26FFB6F649B24BD552D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163680, "uuid": "2e275f1b-3124-4dfb-8b72-a6dd59c1e24f", "value": "3072:g4J/ogkBdPxNLhZxzcyArqcuzNJCofZVF4i1Ikcp2dSHnq2KgJ+a3YIq0TWyacy3:1ogkLjLhrzcJSSofHF4+SHqZPr3zt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629163680, "uuid": "1b83f3fa-89ad-4324-8a3b-b84df8974bb7", "value": 233347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629163680, "uuid": "540c9ee9-65b7-4e6e-a1a4-a1cb398eaef9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163680, "uuid": "4b878bac-ad08-45e8-ab60-98b42f3ec9cd", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.39686324.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017525ba-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629206907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206907, "uuid": "240d1020-2169-440a-a114-5f259b0bf5df", "comment": "Malware payload (Formbook)", "value": "7173396e4b9f015e40906d45a4e299b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206907, "uuid": "01566219-dc5e-4f40-8d6c-8d8174c572f1", "comment": "Malware payload (Formbook)", "value": "333a4f5801ceb9ba48d7bbbc0c3b1c1cc3855463182c902140129bc6ea26e716", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206907, "uuid": "71dcf4fb-0f62-441c-a2ca-129e11986c0d", "comment": "Malware payload (Formbook)", "value": "2d66f6d42075038a236910beb96a88b921d576a2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206907, "uuid": "9dec1a83-aacc-4a52-8f85-e2d468847779", "comment": "Malware payload (Formbook)", "value": "6e7c90ff8f70d1708c24f78dfa15a9897c4d20be0d7b04f7af4ec03823181e8970ec11ac42063da4d07c005d75001b40", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206907, "uuid": "a0cfa64d-80e9-4a0f-9697-81c9e9dba88a", "value": "T1A28370ACC49702A4CF856BBD6B172F85104C3A7EF7899832327C977867C6E3A512253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206907, "uuid": "c33924f9-4568-4a6b-a7f1-12f6d31bb41e", "value": "384:bfwlyFFoRoGneE48jAv22Ej3OlJSacrN2kPhkh/03O:b0y3gCmPjqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206907, "uuid": "677b420b-5def-44a5-a9b6-c14ff822cec0", "value": 84114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206907, "uuid": "1f8e9428-9f0b-4028-9548-e50a2f3b55f3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206907, "uuid": "e0e7215d-3e87-44ac-bdf6-e00402e5204f", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2047cb3f-ff61-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629207818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207818, "uuid": "ee55b3b9-ff13-42e1-a3d3-55553ce5f6ce", "comment": "Malware payload (TrickBot)", "value": "d6c057e338fd2884d4ae0ff6a5026eb7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207818, "uuid": "0ed66cc1-c4ab-4abd-90fd-3565fbc19ec2", "comment": "Malware payload (TrickBot)", "value": "336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207818, "uuid": "b2fd9a37-ab3e-4ffb-8769-f7b983424f7b", "comment": "Malware payload (TrickBot)", "value": "e59718e913ec2f993a4c08e8098e9af8f00663c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207818, "uuid": "2cf3cd79-5ead-4d9b-9a03-919fd5c93934", "comment": "Malware payload (TrickBot)", "value": "4cb0f643a1faae2693c30e19885a15109635b782ce9a1cb7c0b24b8c346931187fe1c4d1a020682e637166590e836111", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207818, "uuid": "a922a810-aadf-4549-8684-53aac6ea64bb", "value": "T16CE4D011FAD1C077C2AE06302F527BB967F9ECA16EB5D507E744F78F0E32941462A222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207818, "uuid": "bd8f9b11-0cc9-42e3-970d-6ae2bf21ce8e", "value": "0293ee5688b0a5f1cbe136d065e99917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207818, "uuid": "0060fc13-0ae9-4cfc-8081-7811073beedb", "value": "12288:zbxfY510CzWwF0quExYmSN+oMdFZEMgIeZxs7WNJaX6FAx:96WwWquEiJdMdUIFbX0Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207818, "uuid": "d0dce118-beb6-4bd2-a0b7-01a2fe5131e8", "value": 716851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207818, "uuid": "635451d2-597a-495e-8981-6233a0a59e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207818, "uuid": "f167fe81-5a3b-4631-9039-26eca1adaa69", "value": "plotterline.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a7813a-ff7b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629219019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219019, "uuid": "90e37488-2f09-450f-95d6-8e05c9399afc", "comment": "Malware payload (Loki)", "value": "e52bb3fd16b1b414bfef8462c4091b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219019, "uuid": "2790d765-e31f-41d1-9366-019fa17c9ed6", "comment": "Malware payload (Loki)", "value": "33bfe1bb962c7e2fb6653cad9a0826c87931d2faa8c1d05f8d2ff4a7dfa339ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219019, "uuid": "0a7f4c92-c9e5-40ac-8a57-5a7487dbf32c", "comment": "Malware payload (Loki)", "value": "1a63e9f5a7f89f49bdbe3687f92082806b84004c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219019, "uuid": "08f49e0a-7c19-45b9-addf-9b59352c6999", "comment": "Malware payload (Loki)", "value": "1307f997f9517b28ec26bc9e5e6f1cba852e4676790c2cf0fd5f37e6487d1789758352c192c9a45710079fb5135e9b61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219019, "uuid": "9189a5d8-4ae1-4e8f-9655-e64c60e4d1da", "value": "T11FA4C011B9C1C176C25325B3A55EE3BB5C247A315E22CC9BE3645EB1FF729A4A220F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219019, "uuid": "325ae6ae-f106-4f6c-8466-48beee7ff7f3", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219019, "uuid": "1aa6a9d5-3211-416e-ae0b-26149786ff01", "value": "6144:EdzkwTata6GOw94Jl/e5I7wjmzCcOeHt6OOwAHT+pATwyElL5DbyGowb1U3V8r61:WPT0m4G5I7wjmn6KHp8wVLBy3US18xSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629219019, "uuid": "5809908e-136f-4182-9307-05a7652a3a49", "value": 461610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629219019, "uuid": "5e3b7459-2724-4756-a406-119b8f9c94d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219019, "uuid": "1f79ab8e-f321-420d-b551-d12db6e797c1", "value": "e52bb3fd16b1b414bfef8462c4091b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1ae6db-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629207002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207002, "uuid": "66e8e9fa-3f71-4281-a842-d7c7c47a24e3", "comment": "Malware payload (AgentTesla)", "value": "cbd9a89da2ee738f1d41ae84326d0e90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207002, "uuid": "410f4621-d460-4855-8bb8-7059530293ab", "comment": "Malware payload (AgentTesla)", "value": "33d6f7cb183b6f72a95540dd214e5f264f5d682025480689237a8086095fb9b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207002, "uuid": "31800c6f-955b-4991-8b81-b20fd6241604", "comment": "Malware payload (AgentTesla)", "value": "e907ffd63426668426701c95c52885c1d4592757", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207002, "uuid": "05e0c720-a06b-42a0-8c47-c4b02799d229", "comment": "Malware payload (AgentTesla)", "value": "bd4fd34766527c0ca6598c7c78acb715ac27981408b7b22b243ebfef19c7a58f753cf7a71d2d6a0ceda93b67309a41c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207002, "uuid": "5c717177-b0cf-4161-8c61-de243a60f06e", "value": "T1BD45122979CF1E33EA4769B45B8776181789CCF06E22D68418BCB61C38793631E853BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207002, "uuid": "43fc8853-514a-4f9b-8ef5-e723372597e1", "value": "24576:Uf/vMa3dT4LK3Thyhd13uPyfNuQcBSmVHBgLCnQ9Mk1RfQzqOvdxv:UvMOdPhyd+KfUQcUcgL99ndQzTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207002, "uuid": "1aff6582-58ab-4d61-8b42-6d0e32e2c03e", "value": 1223160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207002, "uuid": "9d0777a7-76b0-47d5-b79b-09a39460da2c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207002, "uuid": "773048f1-4125-409a-83ba-9b1b0fa3c597", "value": "PO 12076 MM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3d113b-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629213661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213661, "uuid": "107e06e3-a6bd-4888-b4fe-7f5cee1cd303", "comment": "Malware payload (Formbook)", "value": "d28e832754867283edae12c876a4a0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213661, "uuid": "4b313256-2907-4ae3-ba80-5b1e1185d0ba", "comment": "Malware payload (Formbook)", "value": "34294970b36f4992917887fe30f5336caefc8a992122aff1ff9933010ce8ae89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213661, "uuid": "20c0f756-d575-4450-a5a5-5b22606e31cf", "comment": "Malware payload (Formbook)", "value": "6f4bf64aa3aa112034d84c5e8e5530c0ff3337f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213661, "uuid": "2257e288-cd78-4e7e-a175-3b5f7748c99e", "comment": "Malware payload (Formbook)", "value": "ad2a08c3c0d810ac5bf428eea7ca21bbf60becbd0fd01cab92eb5e81ea6fe31f6d6ac11390d7876ce7d2c9eadbee568a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213661, "uuid": "d9c925f3-de9d-4318-b65c-4b7ab101a180", "value": "T11794CF116582C03AC9A239F545F19179243D3EB1071E9AEB67F47E788B301D3EE21A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213661, "uuid": "10a8241d-2712-43b1-ab0f-d5f79e533583", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213661, "uuid": "55dd1887-19af-4115-ab30-2639814a797e", "value": "12288:t6vv93RxXt5OBAIyB0DDDDDDDDDDDDDz9MC63iUSSaSW0NDDseHr3Tv:t6X3x9dIFL8iUSL0qeHXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213661, "uuid": "721124e9-2981-4c84-a873-1bd5c5ae5835", "value": 425194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213661, "uuid": "39ade1de-d622-4e22-a0eb-1bebc5d92143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213661, "uuid": "8d35f10e-3aaa-4bd8-92ad-e5dc70d1c408", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcaa0b64-ff2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629186713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186713, "uuid": "a3cef4a9-07fc-4029-ae8c-c9828c85a8d0", "comment": "Malware payload (Loki)", "value": "87dfc60c54a1bd161cd5583ae0ebfc7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186713, "uuid": "ce9306db-3f61-4207-830b-4993751580fc", "comment": "Malware payload (Loki)", "value": "345f95df7ce5161df077e1c444e28874e380449f2b39e54800c7a2bc4e5e3529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186713, "uuid": "e5ded5be-26a2-4154-b3d3-0ee1bc2872e2", "comment": "Malware payload (Loki)", "value": "7dfa8ca16ad1bc23b2a9e547b7828ed6d913e34b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186713, "uuid": "41603fe1-0285-488c-90bc-c84f23f1f638", "comment": "Malware payload (Loki)", "value": "6604d90ca635ab33d01ebce0241011d84968620449854bebc74118c9d30f6b427e8fccc9855b75bf3ce4e6894405f6ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186713, "uuid": "93c089f3-a3f4-484b-8598-1af7774c5e9d", "value": "T13235C63915B82B27E079E365E6E44417B3E4A85FB225ED59BCCA03E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186713, "uuid": "15e07c9e-b062-416e-a2e5-8d1489691a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186713, "uuid": "c26935fb-bd15-4479-a7eb-4413079e9edc", "value": "24576:v5kHK3nFYqblhBlr1E/9wiV2ep3F1nL6OrG1rP:hk4nyC1l5E/9rV2i3F1nWOqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186713, "uuid": "51c3d7a0-af42-440d-9eac-6879013c97d3", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186713, "uuid": "b7eb51cc-d9d0-4730-b8cf-32eaa0a3db09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186713, "uuid": "7a43f6dc-e9f0-4454-941d-fc2b7873dcf2", "value": "87dfc60c54a1bd161cd5583ae0ebfc7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7892722a-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212261, "uuid": "8d6305c8-7ac4-4d1a-80ef-b33c6a22b8de", "comment": "Malware payload", "value": "731f403578367c78a2b9e76600a09dd5", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212261, "uuid": "fff57c84-c522-4905-8bcf-585282a1fa27", "comment": "Malware payload", "value": "3537b3eaad16d59c1f0c22d6cbcfe5a1b4542cc4f6a1e3135e26873c0dd4b06f", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212261, "uuid": "c5940f0c-18b8-45df-9434-6fc802564bc1", "comment": "Malware payload", "value": "f5cc94354104eb45f0f15e82816a55ac46b23fa5", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212261, "uuid": "5155042b-3a12-4fb5-a0f0-a097b1d497ae", "comment": "Malware payload", "value": "acb1cd0e53de712ec09cbc9b41b114624eeb1936b1544588d827e14e92ecffbddf351f20c206a1d9532ebe988ef12d4e", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212261, "uuid": "e8f73386-ffa1-46b5-9e11-075f5b4761f2", "value": "T154D3E846FD119F17C6D361F7F7DE425C3B262F69D7EA3102A8286FA033865D6093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212261, "uuid": "3ae1dac7-fdaf-4eff-93e4-5f668fb6eae5", "value": "3072:CrsZvxJMQG3lL4Kh8eJA21m58G/oSCuO:jMN1L4y8eJl48moSCuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212261, "uuid": "db29d3ff-7279-4167-b950-849948fcf8ec", "value": 132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212261, "uuid": "dd55ab57-c68b-472b-955c-f9f17261788a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212261, "uuid": "62c90dbe-9594-4b22-87c8-bbb4b5644e81", "value": "ew_linux_armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6a3c3e-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208647, "uuid": "92b39331-ad10-4f1a-b4d4-8ccc8378f739", "comment": "Malware payload (AgentTesla)", "value": "f135471fe77ed86ea0e1930d120bb7b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208647, "uuid": "e1a59c23-c238-4eb8-b419-e3dd9ffd8bff", "comment": "Malware payload (AgentTesla)", "value": "35e2bf6106a7af258db10d76a44aadd9ac5f2187fe46de6131129b94da9a05f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208647, "uuid": "b4f527b8-37f9-4911-8a32-24366909e85c", "comment": "Malware payload (AgentTesla)", "value": "cb8c3e7ce716ae3ba8864b2d6ee93e5e6d04aa36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208647, "uuid": "d227262c-b88d-4104-a621-ea3da5e39059", "comment": "Malware payload (AgentTesla)", "value": "058ec002b5515e5b59a108c29fc14d81ca2800c644c927bc9e439e68535dee37d5f66433b792e7e4481cde8b076e5763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208647, "uuid": "67cbf6e8-649f-4b8b-bfd0-8815aad304f2", "value": "T1A5E46B7C3150B99FC137CD36C5580E55F660A8A7A3CBC623E0932959983D7AA9E403BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208647, "uuid": "b987c576-3e8c-4bd8-97ff-633755aed862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208647, "uuid": "a1591820-4924-46d9-bb78-7a7919beb35c", "value": "12288:y3HdKmiTyLKvWhi8RQz2D8nKfNMWAmyAl4JJozJ6u3+OFcbCf2eJ2NexaHlg:y9LKvWhi524AgmDlSJMa7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208647, "uuid": "0b90210f-e356-4a7d-82df-5d8b0806a151", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208647, "uuid": "a488e2d1-7aad-453f-aac7-afe5edaac7ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208647, "uuid": "cf80c3a8-0db2-486f-acd1-089a2c8982a9", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c47a4f4-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629208724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208724, "uuid": "b293ec31-67a8-44c3-80b7-280bb2cd0238", "comment": "Malware payload (Formbook)", "value": "71b4c855323d26af21ea4989312db160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208724, "uuid": "df19af61-3ae6-4094-b261-1f1586864915", "comment": "Malware payload (Formbook)", "value": "36499f5c573a8752c3b566b19e52f3a235e73e4cdb7123f3452a007c945f7daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208724, "uuid": "557175ee-090e-45dc-9027-8a7846b635e9", "comment": "Malware payload (Formbook)", "value": "4a2c197f0a75e3e381ebb4df75ef3cbb5081a8ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208724, "uuid": "f9e10cb6-f345-485b-bad2-af845f8b20c2", "comment": "Malware payload (Formbook)", "value": "dc860958f29a342b4b23a0fe41566a07cc758c3eca1942395a704f54b6e64d5090928eef3aa2142a981815de292023b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208724, "uuid": "12f68cb1-928a-4dd0-9c26-c5e4ff6dfeed", "value": "T141D4F1213A81C4B1D92641311EF4E73191BDBBB20B6259DBF7EE0F6C5B325C1AB31296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208724, "uuid": "6ede7d37-318c-48f8-9234-1f3cd5ad10f9", "value": "58577023fa3560e544b0a319d4631c85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208724, "uuid": "3946864f-accc-4036-b70c-c1e84dae2779", "value": "12288:PMlneNP5lV0CZ/1bkdneOlcByuN60pUP5PgsqKmHf4Zh8y2Y8AtlJU:PYeLvZ/uNzlcHHqF3mHwv8EBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208724, "uuid": "7b496d64-295c-4d6b-8666-8d10ae5f1024", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208724, "uuid": "df56455b-cf24-43d7-bf68-ec2f3084b214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208724, "uuid": "494c5e02-060b-4c64-af55-15d2ee957622", "value": "Textile Requirements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7c566e-fef4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629161136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161136, "uuid": "eacf684a-74a2-412a-9026-64546a08a286", "comment": "Malware payload (Dridex)", "value": "3342624c6c8c4f5dab93bbb40aa8fda9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161136, "uuid": "7ec4499b-162c-4f85-994e-f26ecd2f9681", "comment": "Malware payload (Dridex)", "value": "369d214980b7c6a0964f4b2a411544f751185346ac63c95601395115015ba93c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161136, "uuid": "caa597e3-2ab8-424b-a3d1-3ce85f357aca", "comment": "Malware payload (Dridex)", "value": "21a01d739a80e45885206f083bb754228cc67c77", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161136, "uuid": "1d51bc7a-045b-4f52-af7b-647bd0be83a6", "comment": "Malware payload (Dridex)", "value": "dbae7b866df2b4983dcadebce8daae23804d297eddd75eda65615e44d36fa766b98eec53dcde3a6b2ab62b7231268230", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161136, "uuid": "05179c7a-8951-4b60-8703-deb4d3c38523", "value": "T179240207EE091E13D35CD37B7E12356403813D89560BB6DD19B26F6A2B249339BF611E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161136, "uuid": "17efc6ab-127d-47d9-91c3-986e64024eef", "value": "6144:1ogkLjLh/2ecFrwTsuyAq1zWSkjVjQb17EWFtD:KDLZudukACo+tXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629161136, "uuid": "cf3ebd0a-636b-437c-869f-44ad3f1813bf", "value": 217643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629161136, "uuid": "5822a8a8-e909-48c5-b2cb-be747b6a0ee8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161136, "uuid": "48d3a595-e28b-4656-be71-25b4a766300e", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.6589016.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79ab839-ff2d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1629185845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185845, "uuid": "5e4fd3f9-f23a-4817-9759-1dbe142b0ef8", "comment": "Malware payload (Socelars)", "value": "904139e1b11ef1f02a0facebca951e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185845, "uuid": "08fce710-8e81-4c71-8819-c7028ba187d8", "comment": "Malware payload (Socelars)", "value": "37303654589c7f3bb4bab82c801c81581da9b7e23050e9cc7f9bf39595268c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185845, "uuid": "2f041348-86b7-4fd4-9da0-cda3e9d46a63", "comment": "Malware payload (Socelars)", "value": "c2281342cc35e9ef603e675badb56be6a5a7b46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185845, "uuid": "48442b36-0b86-4ebf-a727-cb8a2e3ffa67", "comment": "Malware payload (Socelars)", "value": "8090a10e5691824a53c8092b876f10bb12b55047644be7237b7eca4b3e5e5b413107e72e4d80c7dd9f8002b88ccbec5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185845, "uuid": "518ac55f-3702-40ac-9bb8-0415ce08ab2b", "value": "T1B6659F21F6429036FCE300B286FE5B7E9D6CBA21031494D7E3C41D699E619E27A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185845, "uuid": "5d09dfb9-6e37-4c72-bfc2-1dc86c5bea43", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185845, "uuid": "44c6e017-ecd7-4856-9c22-d2f7973865e4", "value": "24576:pIVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QZYftzygdEtG:cFA1pvTMbOwa0TmUqMYEOFQOSIsQZYVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185845, "uuid": "1065078a-81c5-45e5-b4e7-09872800cbd0", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185845, "uuid": "7e721256-a97a-456d-9eb2-7f37f0bb0f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185845, "uuid": "06cf6545-89d9-4743-8cda-f5ab1f5859bd", "value": "904139e1b11ef1f02a0facebca951e37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5110b253-ff1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629177835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177835, "uuid": "fe611a13-36c9-4c01-a3ab-b057576efbd0", "comment": "Malware payload", "value": "7627a9644cb79f21f98403974afcc728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177835, "uuid": "2be02092-b551-42fe-865b-acad76e9f937", "comment": "Malware payload", "value": "374faa3594f8c5b22bff30ad8f7a42b24165397a013f8c6ddf68ae2a822e7e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177835, "uuid": "140c5513-76da-4813-9285-102d6a44b8d8", "comment": "Malware payload", "value": "c556c529c53d42c07ff83e9e1d5e7a3ee0fe6aed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177835, "uuid": "2db8672e-5ecc-4ca0-8be6-18c81428e248", "comment": "Malware payload", "value": "e71b4ff080a78fdf12ccd531f88709bf58cd22ba25112de692f6984241f8fb779002e2427cdc319666d28153d13c142f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177835, "uuid": "e3ec4875-4b17-4ece-88e1-f58dc654ed75", "value": "T13A55FA391A743A27E17AC739DEE54C1BF6D4B45B7221AA5AF0D603674303A01B8D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177835, "uuid": "e2a3c5fd-5ba6-414e-8a84-beef881fe47f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177835, "uuid": "970a5eeb-daeb-4f1f-87cb-e7d579be7885", "value": "24576:zfLWAYc6cWzU1a1weFnd0rbM/wt7E3xdjVl:jUBgbAwtohdjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629177835, "uuid": "af6a3669-9acc-4c9f-ba37-f31330bab644", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629177835, "uuid": "6bcab4a9-d1ca-4c70-9eb8-b5eb7f77d551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177835, "uuid": "99ed31ec-e362-4221-b43c-d342fdff0ec3", "value": "REMMITANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5138e6-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629209934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209934, "uuid": "7491a2b6-e912-4507-91ea-d229412441c7", "comment": "Malware payload (ArkeiStealer)", "value": "5b0100b5146bd477988bd1574b333ecf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209934, "uuid": "32ee81aa-cda8-4f86-a423-10137b7655b8", "comment": "Malware payload (ArkeiStealer)", "value": "375169ece6dc94c792ea4543b66f843dff9edd1adc5296ef341cfee719bd48eb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209934, "uuid": "11548427-bce8-4c2d-a08a-8cf66c46ede3", "comment": "Malware payload (ArkeiStealer)", "value": "3feb01a3bd047dc873a0a3c1f012f86487a51e88", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209934, "uuid": "36806445-9bed-41ce-a047-5253fd7eaa7b", "comment": "Malware payload (ArkeiStealer)", "value": "3f3e91d65b612d9a15fc5c94c303cb1752f14abbb9d582bccfd7cd2758441d5b0b5bb194eda58f4be8979507a870627f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209934, "uuid": "8aa1e2de-392c-4a0d-808c-1d00b2a10605", "value": "T15E448D2076F1C435E4E712F4987983B8A42BB9B05B2441CB62D626FEEA343D8DD32347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209934, "uuid": "f94c8b98-604e-4cd0-af87-2cf703efc60a", "value": "3cf7934f6b854bd488143a7d36a97eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209934, "uuid": "edf33ef7-6c47-441a-b40f-d1cf8f4d4d61", "value": "6144:s7QH0Ys65Ne4JCLXbEpzU/VoNcktbxsg/Xki:vH0Q5vJCPEJU2Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209934, "uuid": "96f08bf3-b987-41dc-80e7-b2d15a05cff4", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209934, "uuid": "112a6de2-a4e3-44af-b47b-776176bff812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209934, "uuid": "d20e1a32-62d9-46be-81d1-7085977426e3", "value": "5b0100b5146bd477988bd1574b333ecf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d104da-ffa0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629235075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235075, "uuid": "a748f696-312a-4a02-a843-f5d634bd3ea3", "comment": "Malware payload", "value": "6a0280695a03d4d8c38c0113c7110e7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235075, "uuid": "23c2bfe2-9b30-42eb-a155-448306f54a9c", "comment": "Malware payload", "value": "375216b1c645e2f456e15fe64a433cb2a35b344a2644629638d3d7ecc5f0f133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235075, "uuid": "757138e2-ef7d-4613-80d3-2cd2fa49109a", "comment": "Malware payload", "value": "1a4ae531b14716c5bbde2169a29d14a5d764de9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235075, "uuid": "c08cd808-1660-439d-b807-7e7adc592a45", "comment": "Malware payload", "value": "623cfba9e513f3b03260be950f6ddf5108cf21a7b235367569facc300770478ebad7f67d1fe006e2284d3096aa3664c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629235075, "uuid": "fb9d8867-d317-4a30-a852-8eee7c7f2609", "value": "T1EF03E0A092432EE1B6F61673F67740132206836CCE96B2381650C16D9FD76839FF7926", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629235075, "uuid": "27b27a06-4589-43f9-afd4-66b4aff71a00", "value": "768:RbL9T2anO9m9YOUWpEB1Vue7lzZVv+Lnbk7ROHLCe4jXD3q3U7jU:dZtnO9m9vpEFL7l7C0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629235075, "uuid": "2b365e6e-b7ff-4944-927c-83334fcfb303", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629235075, "uuid": "667df0fa-f3d3-4880-b06a-0a409ad011ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629235075, "uuid": "266eda93-4e87-4163-bf70-d3fed236185f", "value": "6a0280695a03d4d8c38c0113c7110e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f6b5e5-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209515, "uuid": "01b4fc51-530d-4070-998c-a2a26388dd60", "comment": "Malware payload (AgentTesla)", "value": "132ad9758c964214b0af2db6416f72ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209515, "uuid": "e90443a5-3f29-4d13-b0fa-af2536cb98c8", "comment": "Malware payload (AgentTesla)", "value": "375b7639c4540b562c82494ffefe34ed936a61178a172121e175f28e038cc43a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209515, "uuid": "353772d8-d884-4c42-904e-7999ccc82b41", "comment": "Malware payload (AgentTesla)", "value": "3c36f755283a9f96d3b2af286bfe5e947cba1a48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209515, "uuid": "8beefe56-c269-4d11-8718-293def384eff", "comment": "Malware payload (AgentTesla)", "value": "dad5985b0a8e4c98644c8c808133145579cf79b20b4f2ec35dc69f1a25fce4ebdecccbfe3caa5817102efb86b907d39f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209515, "uuid": "a45292ea-6e11-4d2e-b84e-8bd7c1b9b25e", "value": "T13CB48B3955F8932BE53AC2749458034AE3F19DD2FCD9C927F8C3648698726E229C472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209515, "uuid": "96409927-d4fa-4851-ac01-8ba83ab20f66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209515, "uuid": "b9a59f10-3798-4b84-b8ca-73e5e84ff867", "value": "12288:bIRQX5P9CkBEf6jZkQUgeFz/MX/AnJtcme:c6/C8Y6V4geFIvALte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209515, "uuid": "1baaba85-cf96-4231-9b98-57611bf6fdb5", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209515, "uuid": "b02ef3ae-632c-4b77-8494-fa0ea0b291a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209515, "uuid": "b42a8fb5-d496-4359-a8a6-d1b60b791451", "value": "Marcelo Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fb461a-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209247, "uuid": "8382779b-b9e6-4c02-8ec8-8ee0f1def616", "comment": "Malware payload", "value": "0dad0861840cb73b4cefce3dcce28fa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209247, "uuid": "b0be9ff6-614a-4e9d-ad71-e687ad452c77", "comment": "Malware payload", "value": "37882a4a0aaf84e2f3c063de493fedbf2233c31c7bd146c79059dd1ae914e2f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209247, "uuid": "96ee3bcd-b3a2-49e6-8d3f-61572bbd5e82", "comment": "Malware payload", "value": "760f36ab9cdb2cba9db76f8e392da6bc0ed5bd5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209247, "uuid": "29a072af-1568-4841-bfae-abbb8ce6ba87", "comment": "Malware payload", "value": "d7289856fbca29c809eec671b5361ea51d60083718b7a07517df7daff1c5166d6d5a3b22075c929076cf7c96952aac4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209247, "uuid": "198911bc-d942-4eda-acf6-af55076ca419", "value": "T179E5336301CDBDAAE1B4CD3833A39BC3D959CD266877A71A91E9707599BC34B31812CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209247, "uuid": "b0184d08-afea-4127-bdb9-b8ab6b7d3115", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209247, "uuid": "4c6774a3-0101-4fb0-8ce5-01473643bc07", "value": "49152:3P+LLajA0Rtg0xD9enMqcKAEVcnidEl4ZquTONy1kH6oVVvkof5XMdXpqzHZa:3Guzg0VYXPVRKl4ZqpvVVvhfGFpe5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209247, "uuid": "4e0be491-141b-44b6-b67c-76cf1b965c7f", "value": 3138684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209247, "uuid": "0dabfe86-0d15-4640-815e-4cd423d1f068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209247, "uuid": "1eb45cfa-2e54-4cdf-9d63-b9e14dc70342", "value": "0dad0861840cb73b4cefce3dcce28fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f950d5df-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212477, "uuid": "908d12fa-839b-4d6a-b718-05a5098d22a9", "comment": "Malware payload", "value": "ba0927e06588724e00ef0617da09d1e2", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212477, "uuid": "4f6e41bd-807c-4d43-829f-11b1f29450a6", "comment": "Malware payload", "value": "381774ed8d6d69975694247acc80e42831ee68b43583c8734af52adff8f73373", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212477, "uuid": "9f52ce7d-28ff-4181-a34d-4eda5ca7afec", "comment": "Malware payload", "value": "cfe3dc0da082948013b27823a8faa0ffaef5f428", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212477, "uuid": "6fc6ff54-8654-47b5-b625-335f8917e9c9", "comment": "Malware payload", "value": "43c225e52d63fb9a54057259ad324ac8b8557822506442cf52c09e7de7c9f7f769671a09058ce468609e34abb2d3f748", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212477, "uuid": "0db18a29-7409-44e9-a743-652abc729d8e", "value": "T179E2D5835720E13AC177CAB1E1FA9391D915BE3209254707378CFE796FF1B901A45A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212477, "uuid": "ffab9f44-63e3-4fce-9cae-23a321b71089", "value": "384:ewtE/i8nkBoG5OULMnPLVb1CiO9I/tF/kxhOME7eAY/ftHr:eYE/ikkOPPLVbYic+tUYPYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212477, "uuid": "ffaa0c72-c2ca-4a59-b385-55dcc0b0efe9", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212477, "uuid": "b9a4479c-1e74-4b2c-a12e-f7a2a04472e5", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212477, "uuid": "54c4edb2-7f0b-453d-8dab-d02e5b299e54", "value": "ew_MacOS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968eb02c-fefc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164637, "uuid": "dcce73f4-e08a-42b0-91dc-0c53b58a980e", "comment": "Malware payload (Mirai)", "value": "7163c0f4aedc44b13d381a49f182ab5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164637, "uuid": "dcd6a3ff-ba95-4b11-86d5-21008542529a", "comment": "Malware payload (Mirai)", "value": "38c8d94c94bd4546b4bea51e6294715ac093ee97ab7ef52f23f9b2d1c04a6bd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164637, "uuid": "6df0d90d-5804-4b3d-9fa8-596d7f3346c8", "comment": "Malware payload (Mirai)", "value": "e4c4d9bf2cc2fe68e0add93fefbcf6c5faf8ef32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164637, "uuid": "c208f313-1117-40fd-8713-ae2f22318c45", "comment": "Malware payload (Mirai)", "value": "ba96b0af8847ae84ac08b1d705a07d322fb1b1e957e5b7961d5e4abe49e0a82d1ab744edd81068cae24d82bad80ba5ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164637, "uuid": "8eccc092-7aea-4e3f-8b97-758e4509f061", "value": "T118534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164637, "uuid": "fde30744-d00c-41a1-b1b2-9645a4ebcc27", "value": "1536:LE2dKd40y5tgn28q9PgN8l8MsINprfm7uCciPY:I2MqJg6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164637, "uuid": "b569b36c-e275-4a1d-829e-1b6f6d2c20e7", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164637, "uuid": "3677930c-77f2-4616-bf81-9cf5c65a3174", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164637, "uuid": "29744467-c32b-4f73-b25c-a0f419ddb1a8", "value": "7163c0f4aedc44b13d381a49f182ab5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70226d07-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629210099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210099, "uuid": "1c982258-7ce7-4cdc-8cee-0fe923ddf566", "comment": "Malware payload (DanaBot)", "value": "cc55b7877737c052e14c380b468d98fe", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210099, "uuid": "e45e84e0-4961-42b7-8bbb-d6c6166f61b7", "comment": "Malware payload (DanaBot)", "value": "396df71a540c8b5101d47c289bd064288ae2e1b53335cc5de2cab2a872ff9ce6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210099, "uuid": "b7cf96a4-9320-4a11-8ab9-910f37bc0d69", "comment": "Malware payload (DanaBot)", "value": "f90d114e8672caa5ff4e98fb92ad786094450a56", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210099, "uuid": "2aef922e-06b8-451e-a1d7-70c3a80c2312", "comment": "Malware payload (DanaBot)", "value": "44591adf8113a05346cc8a1986c12e43c4d5bb7a627322acceeace58320431d9e12b429d384f345d89459c96cc46ade5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210099, "uuid": "cab6aa1e-4b55-41e5-8055-de60b604657a", "value": "T1AB4512307792C475F4B302B555B987BC64797EB06B6420FBA3D42ADA9A303E49C3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210099, "uuid": "cfb0e2ae-2b99-48c4-8685-a7936493a03f", "value": "35155166d938a506dc8c83222d11c045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210099, "uuid": "ec0ae3f3-5720-4c5b-b9d8-4208d5e1d6e8", "value": "24576:LJvGqyYJW1L1NLbt1EgcJExHyAW6xNyPIS7HGMQRc/Qyhwzb3lq351L7zF6Ulz:XWtnt1EgrHyaqOcfw330P/zF6Ulz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210099, "uuid": "39ddc305-303c-4d5e-8dea-29c939a55784", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210099, "uuid": "99da14fd-92a5-4b22-87fb-3e23da1b951c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210099, "uuid": "054fc790-b744-4b56-bd7e-ee0e15b30e43", "value": "cc55b7877737c052e14c380b468d98fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e1aed1-ff87-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629224232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224232, "uuid": "35ea0109-6993-40bb-be0d-bb296ff4f9ca", "comment": "Malware payload", "value": "dcd3f0063e87795838ad8facad691e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224232, "uuid": "13032719-a693-4e2b-b436-45a5e8f778ba", "comment": "Malware payload", "value": "39973b1539d74a8dfa4fd980ff1ba3c44bd4abc2340c4aa1fdc3a09853ba7557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224232, "uuid": "88dc1d7f-179b-4f25-a857-a4f12db4957f", "comment": "Malware payload", "value": "7b0024ef58bcb8aa5d661dc2dea336b0247c7a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224232, "uuid": "5a884bb9-0f4e-46d2-a015-9c7ce0bdbf21", "comment": "Malware payload", "value": "bd6a10b34fa84cf6aa73a600894b892f57ca9cf389909e0fbb61661507a23cb1cb5ac6cd8e74bbe21a0d97b5fa29e56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224232, "uuid": "e5b292e2-5180-4aee-baf3-d1fcb326bfcc", "value": "T17D057C1F2F751D72C6341A3F8FA6B315E816BC222914B1467FF5F04B8B3639271262A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224232, "uuid": "7fa456f3-afcc-4d35-b290-271b745c40e7", "value": "4474eef8942642f5a5e4f27d086a72ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224232, "uuid": "07ec4078-d134-4be6-8a56-cdf9b98141b9", "value": "12288:MGktoHAF1IE4LIeCTZjTgo4WYBJBqryw747znK5Gs:MGvgnINIvHnIyOt7znK5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629224232, "uuid": "6f532365-d98f-434c-b93c-d903572c4d77", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629224232, "uuid": "40dedd7b-668b-4953-94b5-f88c4ca96d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224232, "uuid": "89885f50-2783-497d-b786-e059b31d5267", "value": "Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc8dd30-ff08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169964, "uuid": "b89cea7b-43f2-478f-bab7-aa13413a3bc7", "comment": "Malware payload (Mirai)", "value": "00db509baac2461a621cef7b951ade97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169964, "uuid": "762ceef2-848f-471e-9f98-29c4e1bd653f", "comment": "Malware payload (Mirai)", "value": "39f78728f16dba386b38a5ef9a9b622437dd95b2bb18d9d8719233492b52dd19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169964, "uuid": "35b3536d-f778-4f91-a85d-bc7b324a4d19", "comment": "Malware payload (Mirai)", "value": "0a4c5004197a1c3c4a65341c14a2fe82319480c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169964, "uuid": "a75391da-efc9-4389-9da4-e2976a0b13cb", "comment": "Malware payload (Mirai)", "value": "fea2faab54ff1486b02213918c5a40e934af3732a2ec9f83b6afbbdfac8b3b429539dd6c0a3f897871e349ef504e991c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169964, "uuid": "b3aefa84-fee0-428a-8b8b-897c534c279d", "value": "T14C433B85B8829A22C5D112BBF66E558C372927E8E2DF32039D212F6177C681F0E77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169964, "uuid": "3732e30f-7901-404b-8e6d-37a9ee86d745", "value": "768:/wUwgw2VNP7k2lUJKcHVe/WX4gbuc2pYPnSuT2c2ntuhJG8E7a7QMQRWbwjhVkZ/:BwoNP42lURc/WIE2pwhzl7Ik0wa10K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169964, "uuid": "5e45af7f-505f-4b16-87d9-b79df1e96bf5", "value": 56836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169964, "uuid": "d303de42-e92d-4975-bde7-42280b32fd59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169964, "uuid": "4ac9729f-541c-4681-b7e5-c73830657eaf", "value": "00db509baac2461a621cef7b951ade97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3956a03f-ff03-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629167487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167487, "uuid": "1c4a99ed-d51f-47a3-8015-c3c6823f1556", "comment": "Malware payload (NanoCore)", "value": "9f7a900a67adea7dffdd46114c156af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167487, "uuid": "590924ab-d547-4aa0-8198-5913b28024b8", "comment": "Malware payload (NanoCore)", "value": "3a19f17216296e7629b3718c19525d5739dd725154ae40aebee9084963db1092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167487, "uuid": "7d52ce7a-892b-4db0-a79d-1a760ac98b94", "comment": "Malware payload (NanoCore)", "value": "a1d009240ed2d3bebd03032b73d8d73699dada09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167487, "uuid": "49054c39-56ba-4141-bf36-4b41f57bb7cc", "comment": "Malware payload (NanoCore)", "value": "9bd73838b88cad0e9704a31f5e14746e8e29ded9ede5b610323f81f6146d58c877ea466e836a6145104d1b67b50213a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167487, "uuid": "25096d7f-8fde-4067-9d6c-363fe3b15b77", "value": "T15E14CF563BA84A2FE2DE82B9611201139379C2E798C3F7DE68D454B79F277E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167487, "uuid": "003b6d36-2ab5-47b4-95c0-a369dfda5d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167487, "uuid": "2d13f95f-1435-4508-be0a-2582ed1f4da7", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItM6l9e5YBFUS68fnSpbcsN3KL:MLV6Bta6dtJmakIM5ei2H5fni/MuQfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629167487, "uuid": "a2531215-5fd0-4684-93c1-850797229ea9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629167487, "uuid": "d62338d2-e69c-4709-9de5-807997c9ac86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167487, "uuid": "b1c66ad8-bc18-4d9f-9c42-456650f5a245", "value": "9F7A900A67ADEA7DFFDD46114C156AF8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d4e590-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629206914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206914, "uuid": "4488b9dc-ce40-4f25-a110-ca527378c724", "comment": "Malware payload (AgentTesla)", "value": "589f61bf68b88c20ed3097db98e2eb26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206914, "uuid": "2acd9e85-e7bb-40a0-9977-5de03ef32eb7", "comment": "Malware payload (AgentTesla)", "value": "3a2d4def8df0e2a34ab0e2cc126c8e00857bd556356f2c6f4137fa19e3d33b2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206914, "uuid": "7b8f8b23-aaae-44e8-844d-375613424389", "comment": "Malware payload (AgentTesla)", "value": "e54585484dac4b50f8f4e5c777158d3114f2cf81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206914, "uuid": "7c717911-38e1-49c4-b7e9-c3a776528964", "comment": "Malware payload (AgentTesla)", "value": "ee11501ccef07994dea366b8ba04d5ad349502a24bd187a5ef239f323321b450fc7d036ea1f5b72eb6037ae82aaff712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206914, "uuid": "719c6ee9-8d4b-4caa-9f37-487acd938816", "value": "T15743936CD0A706C9CF855BB8132BAE54058D361EF7859632757C877827E6E7F810683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206914, "uuid": "31a7049b-fc6d-4b4c-b62c-e17ccf78a83d", "value": "384:zUYIoGHHiQWpv45iGw7hyzDwr3qE5G8p4Ud1nomvTe:ioGH9Wpv45iGNzcr3qEKU/omv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206914, "uuid": "b3a0a761-75ae-4545-a653-e37f830a197c", "value": 55264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206914, "uuid": "ba01713b-1fbf-42cc-8b8f-10328d6ff353", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206914, "uuid": "e6143e6c-e855-466b-816a-e455a73840c1", "value": "PO _KV18RE001-A5193.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a95180-ff32-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629187996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629187996, "uuid": "a7fe2065-26b0-48ae-82a1-3f2f2385325b", "comment": "Malware payload (AveMariaRAT)", "value": "e7d6aaee7ccc60273b1a7cd7a8142990", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629187996, "uuid": "fe816ff4-1c7a-4e44-9041-efa02d9dee50", "comment": "Malware payload (AveMariaRAT)", "value": "3ac1be1ee3013db4347de3cfff22c2a030fcca769ee918ba6c4585e38e43c05a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629187996, "uuid": "a3d18b43-8a02-4ea7-888e-f9b33733550a", "comment": "Malware payload (AveMariaRAT)", "value": "98149090fb2e8ba7bd1db007a6a1b89a59786c57", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629187996, "uuid": "2569c39b-5053-43e8-93c7-ae647e9822fb", "comment": "Malware payload (AveMariaRAT)", "value": "5f6eb1c89e5c06e88bbe0721fa32fd33ed41637ed81eb764f7d580094f521b7dfc9bab03f7dab8ed48d6ef210824d4f3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629187996, "uuid": "dacc55c2-e1e0-4121-9b24-34dc1ece556d", "value": "T135F48C66E9AE6AF3E13622BD5D379541E818BD012E243DC43FB4396C4E35981362F0DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629187996, "uuid": "0550d9b8-e920-44b9-ad15-4678cc3a4e17", "value": "23820aba24c2be0acaa9e8720fdc4001", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629187996, "uuid": "ec82e35c-26e7-4f27-8132-1ccd95692f23", "value": "12288:4iH+k1z45HbkeuKwYCBt+e2vtarxy7dS2WivoUA:4iboHYeUuVAmLDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629187996, "uuid": "9fd7b111-489c-4558-b04a-f124ed15a708", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629187996, "uuid": "3de4e85a-6b19-4d9e-9b6a-bae137062780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629187996, "uuid": "9ae0f505-36d0-4dc6-ac01-0e320266fdf2", "value": "Pyuocuaciwkzcgnbgekomyddfwoonhzxzg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cc7708-ff02-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1629167218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167218, "uuid": "d7439ac2-b6fe-4628-a10f-ad59ba5680d5", "comment": "Malware payload (NetWire)", "value": "5bdd4de824d48d14df40bce7f7709ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167218, "uuid": "0383ef24-9b9b-432d-8dc0-a6955e292e1a", "comment": "Malware payload (NetWire)", "value": "3afedea501a9bca64d1d400f5e3aa79e1f0d359a035d84569c123d49458425f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167218, "uuid": "27227a57-2c16-469e-ad06-dbcc6e99c089", "comment": "Malware payload (NetWire)", "value": "8cc562f26e24660ad2f7a5e88e8172e7718e6bf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167218, "uuid": "07daab52-f002-43c7-a4e4-63a707bc96d9", "comment": "Malware payload (NetWire)", "value": "4b8faf0485f73fb47aef248a4981e427035c1b55e39f2bc9ea90a02779535a2529131879a1a28ad0cbc33dd84d9cac61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167218, "uuid": "7167b416-1c86-4e24-936a-593dd9e918b6", "value": "T1BE55DF03A741C4BAC47A0734C5971BF02EB6AD30DBA2965B9B607D2DBD723407E25FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167218, "uuid": "824f47ce-5573-48f4-99aa-871e13610483", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167218, "uuid": "4516c87b-c336-462c-8355-711b5c7c1a13", "value": "24576:AAOcZwdf+OD0+t2drJGlFN5SoRS7NVzxYOKdfA/i6A3Xc6z1F/i4:efU8lJS7PKdo43M6z1F/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629167218, "uuid": "a6a7eb48-a22b-4dd6-866e-98d9eb56b1d4", "value": 1384364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629167218, "uuid": "173a5ae0-860d-44de-8809-f327f4e2de78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167218, "uuid": "85784deb-d4fb-4076-9bb6-95cc3a334b58", "value": "Proof of payment.jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdf576d-ff9e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629234334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234334, "uuid": "77a53eb2-cafc-4595-81fa-50e926ec0df2", "comment": "Malware payload", "value": "728f3575ead222e4e13b9558291547be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234334, "uuid": "e9583402-8b2a-431f-8b62-61265022c81e", "comment": "Malware payload", "value": "3b20be034ea25bcf142fe6d985c38918bde59c780b3ac7bdef4f0b88048f5dd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234334, "uuid": "2b7d8561-04b6-4fc9-a088-2f7254eff3bd", "comment": "Malware payload", "value": "a8cc84f01e26fa44c411784169c27425ae580b03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234334, "uuid": "7b0f6f2e-c75d-4a73-8945-d451264d0fa5", "comment": "Malware payload", "value": "af6d34dd91484ca85ef566f9277706d763ea40bd5c202ed1a4643bce33a1aa9b55bd5d7c062bb591b95caf67ece05ea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234334, "uuid": "f6382a6e-0053-4ccc-9ec3-b1e25a82fe01", "value": "T1A75549423E4ADD03E0A91637C9DFA4340BA8BD407B66CB1A7E9F335D65423A71D0E5CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234334, "uuid": "f32bbed9-5562-4a67-bb26-db75e62e3709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234334, "uuid": "4f1e8478-fa17-4bbc-abd7-b394ffd3a5cd", "value": "24576:/5VMWIJwEsVuAVmWSG6tHeKYqd2yovVfv2kDxyf08FToITHH+4:xiWbnSG6ACrmVn2kDxy7GIT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629234334, "uuid": "2b2bcff7-1871-4a8f-82d5-99f41e45f470", "value": 1369600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629234334, "uuid": "cf27878b-ddda-4ede-b3d0-b98ca34896d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234334, "uuid": "8f361e20-98ac-40f6-b2af-9fe550bcf473", "value": "728f3575ead222e4e13b9558291547be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916d24c8-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629208867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208867, "uuid": "8c619b1b-27be-48d5-8f3d-7d4e1bb3ed89", "comment": "Malware payload (GuLoader)", "value": "82a8bb5dd1c456ed597e0a70ed7eb542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208867, "uuid": "36248add-1f0f-4f5c-bf9f-ef59f83969ab", "comment": "Malware payload (GuLoader)", "value": "3bcc6c538439e2232c2b6a76311e25e20cf641e95067804fda1f6c7fd10628cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208867, "uuid": "eccb8464-fafa-4f55-a1b9-2bfa575a6f52", "comment": "Malware payload (GuLoader)", "value": "09d71d4e1045d057984e0cf4199b07d591f3f1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208867, "uuid": "91723b8e-bb13-4085-8524-27ee22d761a5", "comment": "Malware payload (GuLoader)", "value": "5bac6b720fcc44bde2cadc9a4e9498c8a147a735daef7277d1bb7fb88bb8b9b946fdec65d1e3684dbd36d825cd10ce40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208867, "uuid": "9057f655-058b-401e-9ee9-d4c8de2e1bf2", "value": "T1F1E3F73571CBD890FD50DD7012188626BD0EBD23268AAF0BB662670D29F61F6E5F091F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208867, "uuid": "111c76e3-4a43-47f7-bc6f-768e55d7054e", "value": "2b4f5fe80df3ed9a6d3159464b73e6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208867, "uuid": "902aa238-008c-469d-8f7a-de8de08a37ac", "value": "1536:1NUKVbc/sm94zH1pul3vXSvN9DM1f1F4t5hV/hgyrM:7TismqrvE/ivPDM/F4t5hggM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208867, "uuid": "256986fb-58f7-4f83-9d33-afd0f09ad2e8", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208867, "uuid": "42ebcc85-26b9-44fe-adf9-884d9371c7c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208867, "uuid": "e94255be-5692-49b2-a0d9-5fe9df4faef6", "value": "REQUEST FOR BID 17-08-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf6ed63-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209072, "uuid": "6bf547cd-617f-472f-b43e-47f618c174c9", "comment": "Malware payload (AgentTesla)", "value": "e683b822d682f35726a688d6cb83c803", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209072, "uuid": "8e728287-74fe-4803-98db-a2d30630c36d", "comment": "Malware payload (AgentTesla)", "value": "3c7d4c8f84d91d0b7d38b43ea06792fefc81753c5fc4de747081a155d9141813", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209072, "uuid": "b6d54911-f8e8-4afe-9b32-abf3d5bc61fd", "comment": "Malware payload (AgentTesla)", "value": "0e75f7ad3fd9e5c57e188c1e9573e549ed9855f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209072, "uuid": "b2b39d9c-8ef6-4fed-b569-984067009075", "comment": "Malware payload (AgentTesla)", "value": "ae9a4a684bb03ddffa7c644f7ab81f40d07cce7229abbde200cf53ebf8abf38e3165ec1501b5cd7ee61a81034a4ad531", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209072, "uuid": "75109a5f-5f69-4819-bd7d-b20fbda32529", "value": "T1B92560381BB926A7D065D63EABD18617F04096DF3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209072, "uuid": "a7386b75-efac-42e4-95d7-b032d4cdfa35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209072, "uuid": "0a9c2432-732e-482d-af27-e91c20412fdb", "value": "12288:qwDc9F3nC0Py3gAhMEJbjJEKkZiN6SJ2lGR5/TkhCUZkVmJZu++9ab4qTrPY6SsG:kSslGb/whCfGI++knvPSsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209072, "uuid": "7fab154f-b273-4284-b221-0f926e771914", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209072, "uuid": "517a40f5-0674-431b-8799-2f8f74c8f581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209072, "uuid": "f2bf035c-f384-49cc-9309-3dc1ca592ea9", "value": "PI BLM006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713f670a-ff8e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629227281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227281, "uuid": "d05f2fce-f5ae-4494-8f8f-2d8cc4623ff0", "comment": "Malware payload", "value": "95430763c99589c3200aaf1fd43b7007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227281, "uuid": "820c62d6-045e-4e22-91d6-e4f77284bcd7", "comment": "Malware payload", "value": "3ca91b1dd03fbe8b040ae2397ff229dd9aeb2a7403f5eaeaffceb66077e6de3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227281, "uuid": "8abb9b9a-fc36-4629-b258-3314671df46a", "comment": "Malware payload", "value": "2e91711444691b5d0a38860d1dc81b9d7af4c2fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227281, "uuid": "1543651c-22ec-4ab2-8207-f64c19325c6f", "comment": "Malware payload", "value": "fb7c52ea21a96dbc6cd5a165249f9f3ece83fbcf88f1dd420619f32ef0f9e400bd39ff0e8e31db191da4ed3109a1f570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227281, "uuid": "a53a4268-1fa0-4c74-bfea-e75f6582c3b9", "value": "T1D6F4D43C19B83A27E0B9D725EBE18817F190989F3521AD99A4DE03A70307A5375C737E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227281, "uuid": "3939644e-1303-439a-bad5-55555b75ef55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227281, "uuid": "b0817129-4080-4e12-b402-7a4c470632c3", "value": "12288:2HLgmDc9F3nC0Py3gAhrN96yGUr5pyFI04W014S6I5RO5L2MiY1F+X:ILr99pC34d47iY1gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629227281, "uuid": "81120604-0948-490a-833e-9456a51e6cbc", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629227281, "uuid": "267f898b-9828-40dc-a403-ca3ee3458129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227281, "uuid": "755e94e3-3f59-41fe-a263-e6716088cc58", "value": "PO-229025326.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be89c43a-ff2e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629186179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186179, "uuid": "6cc90536-60e4-4492-b4b8-6e8f748faebd", "comment": "Malware payload (RedLineStealer)", "value": "7d183dcb376ad8afea5c7fc6afe23028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186179, "uuid": "304c99b0-6790-424e-b505-f9a9528196ff", "comment": "Malware payload (RedLineStealer)", "value": "3d243c5f576ffa3f0f3e405764686809b9be85e791b946d2f1f3bc117fd17d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186179, "uuid": "238a95c9-3e26-4591-9f27-e6069c322d6d", "comment": "Malware payload (RedLineStealer)", "value": "7b0db13dae031242659924cacfb76c21bc4db802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186179, "uuid": "9a3c1a0c-d2cd-4186-9dfb-df283577c2b6", "comment": "Malware payload (RedLineStealer)", "value": "48ccf468b7de446cad49a5da1cdb56ab86d3ae5afe7e81710121e1ae2a4533e0564ce1a2932e75d3cb3bfa05f87430f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186179, "uuid": "ec1f2178-87fd-493f-adf4-cf7726567459", "value": "T1D7540211B592D872C5470431C066F7E5AAB5BD51E6E0802F5BA93FAF1F313A2C26F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186179, "uuid": "f4cab2b7-d12c-4e41-912b-d807e02b7a9c", "value": "477c037bd85187d535326c948fa8e5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186179, "uuid": "6b53027a-5c94-468e-aa1a-5ae8cf42161f", "value": "3072:xAYh79895F5DKWu52hkK3+tCgdMQByvgjOgL4eoSvK8dqvvmWMBNyVRfQuKT0yBc:xP2oWuAaK3iCa/yYjbL4ICfOzlRX6Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186179, "uuid": "7f26f5a2-b6ca-4064-aaee-06d759587107", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186179, "uuid": "5dccb303-6447-42a5-8bee-11d454036c9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186179, "uuid": "638c1b09-38b8-464a-b48c-985a88fd3b5f", "value": "7d183dcb376ad8afea5c7fc6afe23028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d76a50-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212302, "uuid": "141ed666-c4d0-499f-b5eb-287b71c3fa3f", "comment": "Malware payload", "value": "d313dd345d5ea37bc1c431a53d1af91d", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212302, "uuid": "59cd73bb-1df6-4dad-b518-1b5e80b90844", "comment": "Malware payload", "value": "3d9aaac0a8e5c7eadd79d8d5c16119d04f4e9db7107fc44a1e32a8746a1ec375", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212302, "uuid": "ebe3fcfe-37d3-450e-93df-308d7afcdf7e", "comment": "Malware payload", "value": "baaa29799bdbb6c1f3fc70e25c0aee4b033fefc8", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212302, "uuid": "69f7628c-0fef-43c4-afbd-4f8ac95a9960", "comment": "Malware payload", "value": "6ed7d485152c7c0c4bb1cc7e379474219ee2e9cb38b28c72897c00617f8358f02a623ed8e954cd3dd17975faaadc7098", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212302, "uuid": "dc675e55-0c47-47da-be7d-06a7d302f812", "value": "T140B31A46FA43DAB3D85301F101B35B2A4B31FD3A8827D94AF36D7DB09B525C1A626378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212302, "uuid": "a11564ab-1c79-4c21-a660-0ac19b09ff04", "value": "1536:bgWolpwcyFjTaJa3saWM8j3YknDYNSmCiQYkR0Pxk0S4KEoBgAohCf:bg34jTyuAfznDASmPlPxHS4KZunk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212302, "uuid": "3410bf70-f182-4c89-a8c8-218368e6c8a8", "value": 114928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212302, "uuid": "1787c6eb-f35f-42cf-bd4a-f54a4689a2d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212302, "uuid": "c47d9417-f05e-4b71-a129-65e4a67e6f8b", "value": "ew_linux_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca84d5b-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209181, "uuid": "588156d7-1dfd-48b4-a99d-aacddec561b2", "comment": "Malware payload (Formbook)", "value": "fc5a615198e809bda28ef71431e13367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209181, "uuid": "98a8054f-71ae-4385-97f0-413b3559b0aa", "comment": "Malware payload (Formbook)", "value": "3db4d4a2dc190c6ca349f576eb9e87b828b93e8623df8559a420b981b7a3fa26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209181, "uuid": "c121de77-ef21-404e-ac45-4714a1a69f9a", "comment": "Malware payload (Formbook)", "value": "9dc5968a658de7cce2930abe892da0350c82c716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209181, "uuid": "6b2b074f-ba69-4b12-98d6-e72c8bdc01db", "comment": "Malware payload (Formbook)", "value": "5a735007d123321f7f9290573c1190ac27252d2d61c58bb6d888d7bd70dbc0dbb0a01c82be8ad65894c5248ee1dea3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209181, "uuid": "4cc6f7d5-6125-451a-924a-a1d79eefab55", "value": "T1EB94CE11A682CC33C7E3243921F5C6746A396A31075F5AFB17844ABDFB351F1AA31A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209181, "uuid": "3545b8ce-e95e-4126-9a80-dad1e39e18e1", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209181, "uuid": "54352a5d-25e2-428a-b41b-78aac2abfe25", "value": "6144:7lbxPE6FRU4YeILAqtD7mRS/ogvKWJSyI5peOu3eUm8GTlaz+keAfl51Q7eWM:7rxUReILAqtDn6yIne3eiGlaz2O51Qiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209181, "uuid": "124f2f00-8ab7-447a-94ac-7b6d43a8af53", "value": 425761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209181, "uuid": "5482a570-ff9e-4242-9231-4c3142378ddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209181, "uuid": "3d7eff59-8a6e-464d-8630-07392eee05a6", "value": "Roominglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f65462-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164339, "uuid": "c79daae4-070e-4903-a92e-28d7c465bfed", "comment": "Malware payload (Mirai)", "value": "16b19b1fe3e33a3a012ba7b63eec2b1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164339, "uuid": "5559483c-581c-4a3e-a8f1-0adb539db9b0", "comment": "Malware payload (Mirai)", "value": "3dd46aaf324b40d4c469464a63c038ebf0fdd9b64344897468b284c7d64f523b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164339, "uuid": "f5c40beb-d1d5-4b5c-ab8e-255a5be86343", "comment": "Malware payload (Mirai)", "value": "cbc9ddbe7b97e957c1c1d9e0173eab58602af0ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164339, "uuid": "2f8897cb-6e03-4993-ad22-a24450f81cc9", "comment": "Malware payload (Mirai)", "value": "b690e6900e3e8b00a343b7fec07a06741f5c9033ea04f19db4cbd0cbd18f1ab5399b7d50a11aa557319d9a8ac4cb9438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164339, "uuid": "be2c53fd-9e9b-4a12-9f70-ad06302ac288", "value": "T13363F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164339, "uuid": "c2114ab8-323e-407c-9827-fa1760cedf38", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duEDtX+RZpZX9v0zAIyi+wcauE:TvBkGNxQ6Kb/jRmRXZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164339, "uuid": "cf6bf76f-1e01-4c71-b73f-7539828eaadf", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164339, "uuid": "3ad7541b-42be-4ed8-929a-1d27b4625a2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164339, "uuid": "71708b6b-ef44-4512-aac9-0fa6e48a7270", "value": "16b19b1fe3e33a3a012ba7b63eec2b1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae77b2e-ff3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192454, "uuid": "3f913286-808d-40c6-abef-9467c536c06f", "comment": "Malware payload (RedLineStealer)", "value": "2093d467e65e9dbad2a55577d9f8d396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192454, "uuid": "3b2be09c-b352-4d44-92f3-36e68a348bdb", "comment": "Malware payload (RedLineStealer)", "value": "3de11e9ba2b8db6be4069506a95bc31250d8ae8d0df5e8fec66121a05f1ccbc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192454, "uuid": "ade99657-1c75-4aee-b0bb-c65a424cb193", "comment": "Malware payload (RedLineStealer)", "value": "c1e80273574c80a82b90d021212d784c7a90ee4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192454, "uuid": "5c6832c4-9a16-41a1-96a1-098059d11c11", "comment": "Malware payload (RedLineStealer)", "value": "048483621ed3c2ee9f142062aae440a2a5cd59ba2ac9b5feb5d65c83a2181ff87ff3a58022bd42984ec9ab680ea93bf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192454, "uuid": "c9e2c1e9-c691-4060-bc4a-a1d404f54214", "value": "T14EA33B3263ACC619F3BE0A366870111587F4E0CF6411E79F5EC1B4EA2E767826548AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192454, "uuid": "316178b9-0b4a-490c-a0c9-5696b5077d4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192454, "uuid": "55dbc2cc-255c-409f-9a4b-21db305e1ad6", "value": "1536:oo6aGr2CT0jE68c8RdhXHyYopkKTgauKwjgbue7vluvLyAsd1vetx5REfG6WAao0:odxiCT0GRnC5lT3luzydd0NW1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192454, "uuid": "45a3a712-2430-483a-9021-b3868de29010", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192454, "uuid": "e4ad0b46-8f0d-4bf6-91e8-c5d96dfb23e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192454, "uuid": "b4194272-3b1f-4c6b-9547-5a6af6bad732", "value": "2093d467e65e9dbad2a55577d9f8d396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a637f-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164365, "uuid": "e88c617a-5d06-4a30-8c4e-5c365c402562", "comment": "Malware payload (Mirai)", "value": "ea9af4bb2364885edf0ec1f285779279", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164365, "uuid": "df6daabe-f0bf-4079-800c-a672fab92311", "comment": "Malware payload (Mirai)", "value": "3e67cabd3c09fe2a8da3bba9164c7c86cbf6b28d58469a681c710f41487ab3f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164365, "uuid": "62ba8972-4b57-4ac1-af73-1ead2ee8419b", "comment": "Malware payload (Mirai)", "value": "10816cdd9f992e518fcc766b36f25af1f19f01ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164365, "uuid": "30285b12-ea01-4825-b7d6-c8a78e278009", "comment": "Malware payload (Mirai)", "value": "2b3514235058f2ec75867f1d160d18cc562ff96038ce236243a474f3fa2ba164e8c219651dc25f2e46e4e54dbaf9303c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164365, "uuid": "7dd63aa3-f22a-45af-9aa0-a73258f4fe05", "value": "T18C534A21B97A2A27C0D1A57A61BB8765B6F513CE26E4CA0E3D720F4DFF215005A03EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164365, "uuid": "52208c82-c0ff-42dd-b8e6-f0a7cc3d0412", "value": "768:4Vo4by1sAa49TwjCJi17ATufs2QmD/vLOqhsZiiO+o3MtSgt:4V5y1sAa49TwjCMVAKfHzXLLAoH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164365, "uuid": "e9dbe567-4322-45b7-ad99-907910283afa", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164365, "uuid": "5fe5fff8-cb9d-4ab8-8352-3520fb40f2ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164365, "uuid": "fd9af7ca-418a-484f-bcdf-cb933d9f0a41", "value": "ea9af4bb2364885edf0ec1f285779279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff3e99a-ff5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629205509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205509, "uuid": "b558935a-5945-4d7c-9146-b67eba5cded6", "comment": "Malware payload (AgentTesla)", "value": "b352e668083dd7a6f7f859ef0c84bfc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205509, "uuid": "763dff17-ddb7-40bb-94dd-481b27b6e5f9", "comment": "Malware payload (AgentTesla)", "value": "3ef98ef967f1bd8cd4d53866f3046dd0c9391ba954b2cd45ec6c8506f4b47be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205509, "uuid": "0f97e70b-f584-49d0-bde5-f74b35fbb61e", "comment": "Malware payload (AgentTesla)", "value": "fb6040b7252cfb1d5f39ef9bd4b79a40ebee5f1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205509, "uuid": "fdb53a87-a572-4e0b-aa65-a8f28f07de1e", "comment": "Malware payload (AgentTesla)", "value": "36c57a7438211b393c9bb44dd67abd2fc7cd40b1a7b2ea40dde9cab3eb14c5fbc5c7a7e2af6cdb12d439549274d36aea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205509, "uuid": "7a16e660-1c68-4a71-b80f-cb79a6f1a13c", "value": "T17045D63915B82B27E079E369E6E44407B3E4985FB225ED59BCDA03E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205509, "uuid": "b6665b8d-7b5a-41a9-a0d1-18f26c195cd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205509, "uuid": "82a8201b-92bf-438c-8b2a-24d6b9cc93ee", "value": "24576:+sESAHFY7blhBbyECLVX+0aXFJafwsGLuV3RZ:uyH1eEWuXXFcfUKVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205509, "uuid": "f0f778f5-57b8-4f4d-ab23-2aaa4e3fd6cb", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205509, "uuid": "e38d31a6-5965-49ec-82ad-cf46b24310f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205509, "uuid": "9a3a49c4-b903-4d69-8a1a-36857786d77f", "value": "URGENT PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add777e7-ff2b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629184863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184863, "uuid": "49730619-c75c-4c70-b275-2b94492251ca", "comment": "Malware payload (Formbook)", "value": "a3d451d05feae4fbc1911f18d5dd1b11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184863, "uuid": "bcc413bb-51eb-4526-bda2-37d8e240f4bb", "comment": "Malware payload (Formbook)", "value": "3fdfb16899787cebec1a48bb7e42908e46a8e95a9127d2c9ba520b83167130cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184863, "uuid": "70ea385d-1efc-47d9-b928-2f6630faa372", "comment": "Malware payload (Formbook)", "value": "83a7119eb4ac27913dc7aadd5f72494061d8d3e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184863, "uuid": "88a0a9e7-1935-4cad-937a-982e8e27bb7a", "comment": "Malware payload (Formbook)", "value": "8a6ba694a70897f64e57ba52c0b7d7c6e06dfe05bd08bd36e1059c9fc0caab0303d3323403ba4aee3dea278a46c82a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184863, "uuid": "e432bf5b-ae9c-4179-9f37-fc16ccc04dea", "value": "T15864DFE6565B95A1C8BED279D04C9A3F0393EA3DE2A2C2CA3B5307C1790C1636DF64C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184863, "uuid": "46922d86-902e-4b3d-8bdb-eacdce36bd42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184863, "uuid": "cc7506e3-188b-416e-b902-bdf7ca8d8961", "value": "6144:j/MfrlhhbobE3TWKZHgtcANruUD9OQ1qoYm:j/gwbUWWghNJD9/wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184863, "uuid": "e2b81fb5-03e3-4661-a470-4bcd433481de", "value": 307568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184863, "uuid": "fdc095c5-b8ee-4c83-9742-3ecf5d354386", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184863, "uuid": "0803efad-53bd-4c0a-9503-e4dbacf3fb30", "value": "ORDER PROPOSAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53426fd3-ff51-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629201031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201031, "uuid": "c56253ad-8ef6-41f3-923d-b1ec11ced938", "comment": "Malware payload (Gozi)", "value": "d841b586c4c9007c226bdf3c20b1cd81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201031, "uuid": "49bd13d2-8d37-4e12-a859-1545666e9159", "comment": "Malware payload (Gozi)", "value": "406e33fabcd8f926a8ce0ae4300c07318483e02f4ee42668d498b58015e86ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201031, "uuid": "3071bebe-6a28-4426-8a44-47fc2db5ddd6", "comment": "Malware payload (Gozi)", "value": "b2ff8eb3f32e4226f6bf1b518573bfbd728528d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629201031, "uuid": "6ddab208-d4c7-4979-83c0-7c41ee3aadbf", "comment": "Malware payload (Gozi)", "value": "8971e54e3f606138468a145d168f82e9ef587649668c15096feb94866a1cb0157bb4db2696e211927cdbf978cf6384fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629201031, "uuid": "11d9f7f6-822b-4d4e-801a-4618b0a72478", "value": "T1FF245B6AA3E40595ED6BC6B6CE52D61BE7F274092B14D30F4374CEA62F17722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629201031, "uuid": "40e9925c-8d1a-49ca-a3ea-a3cc70f9206b", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Lu3y5SH:cxb5wvtKRvSxY0G+D7u33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629201031, "uuid": "d9aa77f4-a039-460c-a47c-b8b1f7a07ec6", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629201031, "uuid": "218ffa06-2656-4587-81e7-5eca8ac1740d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629201031, "uuid": "0be74c9e-2c9a-4043-a69d-16c03930660f", "value": "f6e0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba50b21-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192939, "uuid": "e90cbaa6-c99a-4b3d-bfe0-037f3a86b882", "comment": "Malware payload (RedLineStealer)", "value": "4df8dd40cea92fc437fbff1e6b1595ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192939, "uuid": "1637bfca-f8e4-4ac0-9d58-50bedcfe00dc", "comment": "Malware payload (RedLineStealer)", "value": "409f15acc9e425d5f0cd8f1c6820b44067b5628c60a3a58114db3abf1196215b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192939, "uuid": "cb340d44-1d24-4e55-aabe-d82780e7bfd4", "comment": "Malware payload (RedLineStealer)", "value": "19403b5800caa8d964dea24f81426d2a7f8e24b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192939, "uuid": "b4b5b8e8-dc8f-471f-877d-4fba470cef48", "comment": "Malware payload (RedLineStealer)", "value": "633c8855d3a4268cb4c3768cdf00028056fc14b8e09fbd3d2424479daac98896a4527e941fc7f193e950c02a20cca5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192939, "uuid": "a2c6e651-5b27-4ddc-9298-698f6f639994", "value": "T1C4D41F18667FC015D1F7EAB12DDCA8BBC9A990E3644D793710A4633B4B91784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192939, "uuid": "2db56c22-32ce-44cd-81e2-2a8d4152ffdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192939, "uuid": "d82d3eda-50c4-4cb8-9d2b-3867448a3f7c", "value": "12288:akIrKG5eA1GoYqqbnIXWkvmc7Ln9VWbO/cp:arKg136", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192939, "uuid": "79ed4f7e-b55f-41cb-999e-c2deedc0863a", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192939, "uuid": "4af53557-0465-4354-9435-96c3ce8565bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192939, "uuid": "0ec302a0-cfa5-4227-901d-72ae8f02823f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87069ae-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629230058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230058, "uuid": "a4aad378-866f-486b-97d4-ed7674cf12b0", "comment": "Malware payload (Loki)", "value": "c06ec597e0e1666d733f6f5ea8f67cdd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230058, "uuid": "1a73397d-38da-47f8-b2f2-e1a9405d8343", "comment": "Malware payload (Loki)", "value": "40f9ecbb0af6928a189be61eccea012a0468e4308b4eb2e6087d2d1fd75f795e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230058, "uuid": "b98cd072-a04d-4807-867f-1e91d1c012a1", "comment": "Malware payload (Loki)", "value": "c37f6bb477fdc0432ed8250cca17b144a66d149a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230058, "uuid": "23d790fe-7785-4490-a13a-bf89d9dff5ca", "comment": "Malware payload (Loki)", "value": "a163debcb8d32c41b7f52b2e9077e0ecd54fd6991ab18d9b434ee4f17af482a9c2474c1bceb5f8abd65370ccc76651ce", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230058, "uuid": "17f5a5f0-4e29-4f9e-bb98-920701224429", "value": "T13AC4237ED150C437B8E538A8C8275046D88FB205E9E49DC8FACE36DD1D94BB29A0DC99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230058, "uuid": "febf08f7-d634-4616-aff4-40abc6558ad8", "value": "12288:WteSuZss8weicZdQszJRVT7aT7RicfHNfBep7ov+E/q6n4g:Uea5DZdQWT7C7RiUHN1Zqpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230058, "uuid": "35c5f62a-a64c-49b4-b6ae-8f204cdc9a41", "value": 560160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230058, "uuid": "ec7ad348-bb0d-4c26-bdd9-2742048735c8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230058, "uuid": "708f8807-ca7c-47b1-a8d5-29b215adf196", "value": "PRODUCT REQUESTS.pdf___________________________.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892b0b23-ff3c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192102, "uuid": "4f4d6765-efae-4f6a-bcdd-56218c05847a", "comment": "Malware payload (RedLineStealer)", "value": "581721e440712b96cc96d52122c5dc62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192102, "uuid": "e7247f5a-2db3-4fcf-8588-c6a60e61f3a6", "comment": "Malware payload (RedLineStealer)", "value": "41257eb458426a09f3ae33dedb9d3b1e3c8828e0de60f0389a43f8390ca4e166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192102, "uuid": "76fe2f55-58f5-44f5-a88a-d51082ea7fcb", "comment": "Malware payload (RedLineStealer)", "value": "661da1d3828b8a5dcbbc3b2dabda7f35af57b1ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192102, "uuid": "dc4a2b52-7cf6-4852-8b81-075d1732039a", "comment": "Malware payload (RedLineStealer)", "value": "aed98a2c969862e6c5a60f75db369d290a0e9e445d485c5fafe89b55e6ee4f8f959ecc1631d21441812379497094dcd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192102, "uuid": "fdb6b169-1b6b-4812-8335-866ee3acbcc0", "value": "T12F749E30AAF0C035E5A702F455B6837C643D7DB17B3491CB92D62AEE9A34AE49C31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192102, "uuid": "83137c34-6691-4b22-83c2-777b49b4635d", "value": "e16577a15d2f4b952ae6a4b3a61075c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192102, "uuid": "7012fe0c-34db-426b-b7cd-d57b070b37c1", "value": "6144:GOI2RN2NiVXrr9phieyJ+RsHYlNbCwkzuhGMahHvaZo0t7VKa:/FRQNiVv9phiysHI3kC9ahHvae0Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192102, "uuid": "97ca680b-881d-453a-9c75-745eca4f3fa9", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192102, "uuid": "ef29a7d3-35fd-4b20-8517-5d4a22edad1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192102, "uuid": "49d0d596-ca1e-44c5-8231-d7a25cc48acd", "value": "581721e440712b96cc96d52122c5dc62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6727c630-ff6d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213091, "uuid": "6a3389fc-ce5b-4813-ae56-c854ff0b0f23", "comment": "Malware payload (Mirai)", "value": "c48bcf5a50d183b36856bcb39ddb9edb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213091, "uuid": "1171af48-0045-4e8b-8f64-e21cf3c9d5ab", "comment": "Malware payload (Mirai)", "value": "4191a7c93299d4daebfb24d6eed21fd30a7e596ffa5930afb153ab3a62ace9bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213091, "uuid": "5e1168a4-315c-4090-a9c2-d5418c7fc22d", "comment": "Malware payload (Mirai)", "value": "4b937cfcc420102f2ff6c2b5ab17c7ae7ff8be14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213091, "uuid": "1fac2235-b6ae-4f2d-ba37-bc72a09a6fa6", "comment": "Malware payload (Mirai)", "value": "b65b9afa038fec2d1da6be88bae900aeea58d43c0d88e60d17db082e8751979e520f078713e3bf01c4f335e9dd7f4072", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213091, "uuid": "86bdabc8-9dd0-4847-8cc5-80a89ad8fa57", "value": "T189A35B82D642C2F3C4430AF1029F965A0532FB3A8E3B8EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213091, "uuid": "a88e07b5-e46c-4190-833f-7048026e9348", "value": "3072:uLOqjPQP39VjGWX98732V7kGyNVa5huTQ7FXnf0OzTyoQQub:uJQP39VjGWXW9NVa5huCFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213091, "uuid": "6ab87f18-1a9f-4ee4-9b2c-265106f818de", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213091, "uuid": "a5fca649-81dc-42c5-b334-3ce55a3efee2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213091, "uuid": "22eebb25-51c6-41c1-970e-4645c43c6fe8", "value": "c48bcf5a50d183b36856bcb39ddb9edb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14ab452-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629208947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208947, "uuid": "59273f46-e6f0-49ad-80d6-4d0a00afeb6f", "comment": "Malware payload (AveMariaRAT)", "value": "93a8539e27e2b84da471c4690fc3c627", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208947, "uuid": "2556b3d1-6620-4cea-bf3e-9ffeb39b7908", "comment": "Malware payload (AveMariaRAT)", "value": "42db3f1acd94d54cefed48c6e1531304a66f41e81ca2c6124e506b8900b5d522", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208947, "uuid": "8e0427b3-d4ef-490e-be9e-8d4cec8c6a4d", "comment": "Malware payload (AveMariaRAT)", "value": "fd19f9c125b56e4efbb05b39bc191538f2bdf345", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208947, "uuid": "b443fb0e-86fd-445f-8382-a6aa914206ee", "comment": "Malware payload (AveMariaRAT)", "value": "00b0e3bbf72c821336b8c5da887054227346b13aff1466d7de35d364780832ee7d8a8e8b50b7c49cbc87717df48c4a1b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208947, "uuid": "c5a2faf8-98ca-4c63-b0f4-597b88f2113c", "value": "T1DB457C5F7E829E79C00A1A334F1AD999D80CFDE02811884FA795FA0FAF795C27514A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208947, "uuid": "cfb90aea-0942-418f-92cd-3bfd24da406c", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208947, "uuid": "74aa8ab4-94c5-4222-8213-c7bbf63d5836", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0F:8ej+XQUeET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208947, "uuid": "13c41ff4-6bf9-40df-91d9-767d2d093372", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208947, "uuid": "46f4ffb9-58e5-4696-a6cf-59eb067812f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208947, "uuid": "1127bad5-d526-4e92-990d-25d24f9746aa", "value": "Po#84472837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d55a38-ff26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629182678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182678, "uuid": "463ce920-034e-4a65-99a2-f9fb9c5573db", "comment": "Malware payload (Loki)", "value": "200b2ed7c3b44a4a761a6f4057edbd05", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182678, "uuid": "6590de86-4253-4d0d-9278-acad895705fe", "comment": "Malware payload (Loki)", "value": "430c80e589374441fc8df86c2fab86325fa382ac721caef72e22224501b5c704", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182678, "uuid": "42cabfcf-9c22-4997-9143-3603513db638", "comment": "Malware payload (Loki)", "value": "b5bbb29c63136f9316fbdd68e32b7ba2a9701c12", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182678, "uuid": "fb07f277-523c-4fdf-8f7c-6712f85bcdae", "comment": "Malware payload (Loki)", "value": "d9c181af3d60ea78a78b1025e6885d03bd255c5febbbb7970a5b2024452054830b58cb08818b1278d6ac7b77078d9c65", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182678, "uuid": "150668c8-a173-42d2-863e-8382ec48fd68", "value": "T1B155120E17E22A32C58EFB3744217870D9AD5E57111CD3BAAF6E3DD890B23A4118A75F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182678, "uuid": "42731667-1534-4324-b136-13530b5c9118", "value": "24576:EtOtz8LAgnvJTlBRIGtPq7kuroYqOatfztNMVdM6k8aB:d9QAgnRTrRFtPN5PWhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182678, "uuid": "3ee6c3ea-48b3-4da5-9e88-d446665f06da", "value": 1341336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182678, "uuid": "cfe3e0aa-b39f-4a3c-b053-9967a10f2a17", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182678, "uuid": "916eaf18-8440-40df-9c91-485f9593b4c7", "value": "HBW PAYMENT LIST FOR 2021,20210809.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501ad429-ffb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629243117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243117, "uuid": "515ee82a-0c5c-4435-9618-71093a4333c5", "comment": "Malware payload", "value": "457101ea5c30c53f9381d7e9aa6432a4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243117, "uuid": "93927298-c8f9-4966-a8e4-c965a89f1344", "comment": "Malware payload", "value": "43698d70087aa875c4384b59cacd8eff56bd0bff3be20e69b98613ec5184b41f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243117, "uuid": "72100f61-5fdd-4090-a36d-d2e1d43d8be5", "comment": "Malware payload", "value": "e554c0ef069fe5a49919bea560003cfccd69f858", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243117, "uuid": "b21fcdda-b314-4442-b5b0-a8b60eab0ef1", "comment": "Malware payload", "value": "dd193b7091679d69fdd33ddb20a13702b70604e8eac078473a867548ed2893b2e820ba9860f2c29487f66680ba784874", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243117, "uuid": "82614edc-c4f9-4f40-a4a3-73fb8eea27ba", "value": "T1A112B904B7E4AA36E6BF4F3C99F30391013EA7514D76DB5E4C8AB2491C327586B20E79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243117, "uuid": "b06b7305-8314-4bc6-9fd7-8391c46931da", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243117, "uuid": "9b0cba42-6bdc-4a51-a6a8-29cdae2d8b89", "value": "192:br3WHLHVozlgohRayeA1/aI38fMr86nFUAqqY:/oH6zWohRx//aI3Fr8OFBqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629243117, "uuid": "2eace308-4193-4690-963b-0c5db454079f", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629243117, "uuid": "157daf83-6f0e-4199-93bd-ac8235272d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243117, "uuid": "9ac9ddfe-012a-4c50-9f1f-23c348f7e3cf", "value": "pay2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94eba1a-ff53-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629202088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202088, "uuid": "c0598e48-b237-4685-a593-8aa592fb176f", "comment": "Malware payload (Gafgyt)", "value": "0a012b2a6439d90bca49ed964be49397", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202088, "uuid": "fd35aa66-449d-4b6c-b487-f2ed9441ecf3", "comment": "Malware payload (Gafgyt)", "value": "43fbe1f29dea179d214a87c8def45db1557d187f545902a0503fd483b070b768", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202088, "uuid": "75f46fa1-8c23-4c56-a459-78335dd48da4", "comment": "Malware payload (Gafgyt)", "value": "aa3d5ca62332ad10fc8115f254525045c42687db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202088, "uuid": "266f90ed-1987-4161-9e6e-4dc33a5a69c5", "comment": "Malware payload (Gafgyt)", "value": "3736c393118deb971a14778ea7ff0dd3a63b38a96d87ac059480d0545ca4d98d9a00bb3736c3f10f45271d9351346588", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202088, "uuid": "d95673f8-e8c5-4e54-9347-dc20705c19f3", "value": "T156831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202088, "uuid": "deba49c5-b312-42aa-9b04-0f32d1f6206b", "value": "1536:BQOcK0ozMPjej5qckA39ikRFa7nrWBfOEmQ9VqXjtWf2Xe:BlQ3y4ckA3BSrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629202088, "uuid": "de8e0d25-0fec-4c9e-83c5-764956cc7c3a", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629202088, "uuid": "a76d91bd-02be-42a9-9bb2-20ca12f6c302", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202088, "uuid": "fd211661-7b15-4bc6-9639-5f08d02c9e33", "value": "0a012b2a6439d90bca49ed964be49397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e8a06f-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192981, "uuid": "7792a49f-612b-4623-8efa-2d266b4a8708", "comment": "Malware payload (RedLineStealer)", "value": "571ec37bbc0a7b94c3a3829ee47e5bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192981, "uuid": "c130fb3c-eb33-4c59-bb4e-4f9002add4e3", "comment": "Malware payload (RedLineStealer)", "value": "459a684a6e6299ffbd967855a504ff2311cba4a8eccae192b1f4146cc3bf7382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192981, "uuid": "ccd31e8b-6504-44bb-b3bd-6b9ee2af6382", "comment": "Malware payload (RedLineStealer)", "value": "ef44ce30e13c73e4b07e3067b1e2107fe8948d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192981, "uuid": "5931f6cf-6d81-4db2-9b8b-e39dac12b5b2", "comment": "Malware payload (RedLineStealer)", "value": "8b2e2044743a392dfd8ecd6d6e9bbea76f98ff698aa0b255e5c3af954ca2cc1552054904d71c4fe5f443d038a41fefda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192981, "uuid": "361f2b00-f8f3-4214-92c9-d1f4abb2885b", "value": "T18A24BED1E75718C6E8BCB63AE059A52F1791CABEE8A5D6DA370343C4789C4032CF92C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192981, "uuid": "38e8eff2-f672-4653-97c7-6a0c6dcfee1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192981, "uuid": "eee0fe8e-7b27-4806-9f60-d66a4590a0ed", "value": "3072:ktHnC1FHiLW9Oxi8uFbNUaBAICgV04WEyF5uXa0ToO/wumRE6Q14vmOw38a9Mm:kkmLBxczCmJyTu3p9OQ1qoYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192981, "uuid": "4a7a3709-c67c-4ca0-a760-c26395e063a3", "value": 221552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192981, "uuid": "0a17ee1f-b680-4a2f-bd6f-a015f321aabd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192981, "uuid": "e7f02430-7dc0-4df3-9ac1-2656c358168d", "value": "Setups.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84b9d20-ff95-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629230407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230407, "uuid": "4eae9082-00c1-4f27-825f-cca8dc251319", "comment": "Malware payload", "value": "67c36f40f5eac60d28fc7e5f4b1612d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230407, "uuid": "75f2227e-afab-4b72-8f30-8ce1743e9ca2", "comment": "Malware payload", "value": "465983053a0b1ad8d94781e9bb4f7f6971e3b5127baa4dac9784df09b75d87a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230407, "uuid": "4730c915-08da-4f3f-bdb7-4a2411dcf742", "comment": "Malware payload", "value": "a1b5cbfb6401567118a3865da3893c8a249cb943", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230407, "uuid": "8db5e45c-9416-484a-b882-238472e45786", "comment": "Malware payload", "value": "7c44fc3fa044c20061707956d793f1a3db1973f0c568723bf1808b645654125d98f3e0fc0ffab194052bf28c8c314239", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230407, "uuid": "b74523c7-895b-4bea-a775-c440850a436a", "value": "T127F2F161310F6893E1FA4E33F4EDC24B612A693D0BE96533C164113EE9DA0EA5DBD243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230407, "uuid": "439bc218-7a8f-4647-bbc5-5c8415246b94", "value": "768:qmyN24ozsM+3u5g05r7Wm06nMbG2ve9V59bhnwhF3Uf:qmyw4ozccTWm06D2UXAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230407, "uuid": "97db8e4c-7888-453b-9ddf-0ed4c1947578", "value": 36436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230407, "uuid": "9be6c575-f741-41bc-a584-ea38a78978de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230407, "uuid": "3aea1941-361d-4236-b568-15bab30f1896", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db192e32-ff5c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629205984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205984, "uuid": "e4e48129-2af3-4c8d-a230-9d3b1721e4c1", "comment": "Malware payload (AgentTesla)", "value": "3038c63be8eb4248dcb08e75fa8da3c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205984, "uuid": "a8211666-ff9d-4551-b650-e94e38c3aee9", "comment": "Malware payload (AgentTesla)", "value": "4726af08a130ba2231569458692ac3adbfd179a982ba056084dcb89878cdf68e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205984, "uuid": "2b5a345c-3625-4a69-ad9d-7dd906fdef6b", "comment": "Malware payload (AgentTesla)", "value": "69bdec07f36138aa613057bd814aeec755f62d3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205984, "uuid": "c20f4ff3-cd61-46af-b294-85c67157a4f2", "comment": "Malware payload (AgentTesla)", "value": "b12a1bd78d978d59f2d0a425109b9fbc45a7ed2d3dff2ea5a6404f5c28c11656c745f1c132087b1a0d12cc113ce5946c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205984, "uuid": "634d8be9-94c3-4e20-9d3a-ee0eb3496d8d", "value": "T14F15603D1BB926A7D065D23EABD18617F04096DB3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205984, "uuid": "2d623c75-d267-4341-901e-cff06a29c5b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205984, "uuid": "8600b89d-5911-4583-a65a-b3d783d4b3ba", "value": "12288:6rDc9F3nC0Py3gAh2EJbjJEKmsFg1Od/WIwBdeiQNAyoS2hy9YLFVJRN:xsFg10nwDeCQ2sIFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205984, "uuid": "aa067cc3-ffc0-4b3b-bfe0-3da69ec96f39", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205984, "uuid": "df5cbcaf-9804-435b-bc96-57ab9d62540c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205984, "uuid": "6940e352-7b94-4c06-a3d6-96c9eaea1adf", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f36dde7-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209185, "uuid": "65e94a82-bdeb-49af-9860-f7b0c6f5b3a4", "comment": "Malware payload (AgentTesla)", "value": "60bf4cece40c238bc25027e71371d379", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209185, "uuid": "ccae8c88-6965-48fc-bb01-2dbfa17fc946", "comment": "Malware payload (AgentTesla)", "value": "48059f16b5f8c0594033ed72312c84667870344edcda6b35c0a5bc49d4839098", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209185, "uuid": "49845f84-be51-4567-8fd2-db0aac6080c3", "comment": "Malware payload (AgentTesla)", "value": "437714bcf6ca8663bb0faad3c12fcad72e88a9f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209185, "uuid": "93d3fc68-0910-47ff-be65-26e6173ff3a8", "comment": "Malware payload (AgentTesla)", "value": "b5a24f664a91db4c253807e5501e6bd86e5764c75997b57b2bd854807d3ac6e6f0545e54e276ca63a6b4435c2fb0da39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209185, "uuid": "bcf75a02-e0f0-4847-9b07-0c3056612843", "value": "T173A412923684918ADD242873D78BC742671B3C3245628E8776FCF93727B3A872163779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209185, "uuid": "6ceb3804-f0cf-4098-b864-2bf9ae3897a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209185, "uuid": "dfe447b0-6cc8-4a8a-831d-b6b2768769bd", "value": "6144:u8HO6ogzZeMODUjtKw3uCuBeB3TMVeK17Rh5M3d754MXMF/GjAx4KLQRmbLrLehS:JlzcMODUj0vK3UeqRE3VNc5zRmhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209185, "uuid": "c82f0b46-895a-46b0-a15d-d1fbd27f4d34", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209185, "uuid": "45086279-7d11-4df9-8056-b8541ba5def5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209185, "uuid": "037cba90-e058-462c-b4f4-242cd96f9117", "value": "MV.BAOGANG GLORY.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b41781-ff39-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629190810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190810, "uuid": "d37fa8cc-2705-4a42-ab97-e9976148582f", "comment": "Malware payload (Mirai)", "value": "b1a11af9ace54a5f3333208ca2cebb77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190810, "uuid": "80200937-4490-47e1-a78d-e230a8c87643", "comment": "Malware payload (Mirai)", "value": "480aec125ea3dce04a293659a634e3dbbfabca36f46b489919787e32c07d242f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190810, "uuid": "993597d2-4cdb-4a6f-a7ad-f8e294fbcfea", "comment": "Malware payload (Mirai)", "value": "b363aa77596272c7ab1239569dfa0bea76315768", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190810, "uuid": "0898c6d5-ec48-4a8d-b556-149e63ab0c56", "comment": "Malware payload (Mirai)", "value": "782bb0a4062242c3066c2edbb1fabcd5913af09f383ccc00630afd4309d6a8a67db0373ed83d682eb0218c1c6a68d67a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190810, "uuid": "bfcf763d-3f54-4bed-a953-44243d578133", "value": "T139430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190810, "uuid": "ecaa5a1e-b43b-497c-ba0d-cc9918845637", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7F1suV27cRhMDHs:Q6ia7dy1b27ihq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190810, "uuid": "0b222805-cb10-40b5-bd47-4b6bb948f293", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190810, "uuid": "701c277c-7dfb-4849-80a1-d6bc50d48a81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190810, "uuid": "6158eb94-b6a8-45ea-b1ff-fdc49db4a379", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54daeac-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629206887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206887, "uuid": "a41521c7-9591-48a1-8b93-66575cee1704", "comment": "Malware payload (AsyncRAT)", "value": "7c0b741217fc5370ad84fd2ec137a811", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206887, "uuid": "d8c6f05e-3e8e-46bc-8fa2-5333d2915268", "comment": "Malware payload (AsyncRAT)", "value": "486b4fcc5a6e4f4e949aa11aa3f2e9d8d2075ac8445617af8c41ab214f6dbfa0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206887, "uuid": "2735bf7c-cd82-4117-bad6-457e9e0898f2", "comment": "Malware payload (AsyncRAT)", "value": "8102f8e7ff006515421abebc61b58348d8191283", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206887, "uuid": "49840898-46df-4afd-a5f1-44482a4b9856", "comment": "Malware payload (AsyncRAT)", "value": "9aa9d116fcc61755cfa9abad9fcfec2ba195b88a18766840ad55d56516e7ac703ef506c97237661efcdb51a511ad3484", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206887, "uuid": "3fb19b4d-43f2-4dc0-b190-f691757dbc1a", "value": "T16E04CE91E79B70C2E8BCA23CD099A12E17A1D67EE4E5C38F7B0643E4AD994532CF45C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206887, "uuid": "2a1b4ea2-3262-437b-b908-1f6a159d309a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206887, "uuid": "655fa420-9d3f-4137-bebb-1c68d4d71280", "value": "3072:hVAAAonanPKMhvdFNe2iu9Fbh6tpTnjPwumRE6Q14vmOw38a9Mm:hVDn4PKMFdHdDbopn9OQ1qoYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206887, "uuid": "209bf62b-7cac-404c-8f3c-d18e5c6a0e97", "value": 187760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206887, "uuid": "955c08c1-4981-4462-a2ab-cc7f103a8eac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206887, "uuid": "37d3a4f2-c1e9-4b58-a94e-c35d57dc7378", "value": "Invoice Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1431daa6-ff04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629167854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167854, "uuid": "4408f19a-15ff-4d1f-9797-4cc2f282b900", "comment": "Malware payload (Mirai)", "value": "1da470c816918dc201f82632471dfd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167854, "uuid": "0138af72-cdf8-4597-8111-5769c7a00e58", "comment": "Malware payload (Mirai)", "value": "48d1b1e68335712c370516ca5b2414a75ab7667f459add81b925c96cb9c9a881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167854, "uuid": "e77781ae-bb4b-4c26-a716-2946a4edb654", "comment": "Malware payload (Mirai)", "value": "3199e846188fef6bf612dc2ae3e993ee9ba0f813", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629167854, "uuid": "86f94086-cb69-41b0-92fb-5baa13355d41", "comment": "Malware payload (Mirai)", "value": "b814680ec20e3db4828c1a512ab9269c03c67748135ea795cebfcceb53953da62b8526951bdf10c3e07bd820b4c33b73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167854, "uuid": "f269d000-51f7-4637-b362-a550759eee5d", "value": "T1E6635BD5F401CD6CFD4BE9BA84264A09FA3133115AA30F2B96ABFD936D730A49D43C52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167854, "uuid": "5a60dbce-eb1f-4822-909d-dde2b982ef56", "value": "1536:wyZkYoNlPfvnzeZ0fJcAD6cpzgNjC8QhGf8q04Ps:wR9TeZwJcA0Jay0As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629167854, "uuid": "32ce8714-2a10-4479-aab6-225d0c2df069", "value": 69928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629167854, "uuid": "0ad8c8da-7a11-4590-abf5-291e39ef1cd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629167854, "uuid": "13a2e41f-bb95-4309-9b4f-0954078a9c72", "value": "1da470c816918dc201f82632471dfd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e1f502-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629206972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206972, "uuid": "2db897fc-b82b-4deb-9ec7-08249bb409ba", "comment": "Malware payload", "value": "eb99ad83f9d6596121ee63aea808baf7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206972, "uuid": "3ed0b5ca-2af8-47db-be13-4b9a6d6d92f9", "comment": "Malware payload", "value": "48dffcb3d5e2728bf122e64e806c3b08abb6ca96bf2f96b9f09597eb1a937485", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206972, "uuid": "92dbc899-92f7-45de-b683-c7357919d0be", "comment": "Malware payload", "value": "c51f9cd85e5398dcfbbf0ccf02ddffe60da7bb6d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206972, "uuid": "d296eb10-ab42-4c23-aaea-d8405d93f271", "comment": "Malware payload", "value": "5ac22dbf92b50754acba9a8666215ed74f2f59ff08493d8e1a5e93eb57452ee3225e51029122876d24d7e7a1bc02664f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206972, "uuid": "3c6995a4-c85c-4c32-98fc-f3003e7d2c0d", "value": "T1BF5512281E848E70D6BB7C793591CBA02785FE2A6BA7C88D213763F6957D3B01DCD640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206972, "uuid": "a53e8e83-cf52-42fe-a5f5-823d7805191b", "value": "24576:UfrQ0/cmzLnsYfS2JM/om7VFhcB5vvkJg9jMJ8mwATa4sx:P0/cmG5iB+Jg9IJ1pTa48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206972, "uuid": "6fb2782a-8ca9-4598-b5f9-b6057bc0ae70", "value": 1328856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206972, "uuid": "e48752fb-95ea-4b59-8ca3-4fbcd58c37ef", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206972, "uuid": "3bbb1b46-d2a4-4124-8e2e-e1e4d162d684", "value": "PQR-7943-377.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683aefb3-ff1d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629178733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178733, "uuid": "6cf50181-5047-4526-be39-b356bb4fbcc7", "comment": "Malware payload", "value": "a7053a004026ddef8d6e7e107c501d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178733, "uuid": "b611b59f-8a66-4d89-bbe7-37d3ca1d5758", "comment": "Malware payload", "value": "4935b3a7af4c46c208f6ce1036fc1828eee26b07c12f48b8ce0766defb88f4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178733, "uuid": "cc47885e-c426-42db-8508-fc5e5617b2ca", "comment": "Malware payload", "value": "e1255b9bf4b74404aab3664411e442ba1ad203d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178733, "uuid": "ccef2609-4a27-4d90-8e21-521cd7a93ea6", "comment": "Malware payload", "value": "14e6d5db3d8ba807ba54671f477edcfe57b2242df2679cf3d2529a6dd548eb66fa5d6357f9be4df3612a4d196a3275ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178733, "uuid": "7f9e4466-b86a-477a-ab27-e7a68a370dba", "value": "T192E19801EF480F57D91D52704AFB8B4AB678E154DB128B1F2668F12C3D433B47E6BA94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178733, "uuid": "4854680f-7080-412b-8c05-c5a0a5f04baf", "value": "96:UgpDdWiiQLvvyviCZxQa5K/5DB1W0/jElS4eK:UE4wzWiCfK/dvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629178733, "uuid": "57eea606-e24e-4c63-9be8-19af64f82cc6", "value": 7116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629178733, "uuid": "6d29e2c9-fac7-4516-97f0-892fa6fece7c", "value": "image/wmf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178733, "uuid": "64fc4f6e-0409-44bc-9a7e-b8ca6c3f52ec", "value": "image002.wmz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a176be-ff28-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1629183418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183418, "uuid": "30f111ac-20b8-49e8-b9bf-354ae46b538d", "comment": "Malware payload (DCRat)", "value": "a100cd626553653384f7e6cd2484ab36", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183418, "uuid": "6ed0da00-874a-4c9b-817f-c1bf024d1e06", "comment": "Malware payload (DCRat)", "value": "4a2bd74b2dc8b31da8d46035c9a77ee1eb20dabaf2affa04230849bcdb5e3bbf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183418, "uuid": "670b5d54-d9c9-4ea0-bdeb-74a1b0c8e07c", "comment": "Malware payload (DCRat)", "value": "544712847e3343ce1423f1ea1bb03023bc80312e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183418, "uuid": "4f8bfb36-1d2c-4fd1-8054-4faafe16a4dc", "comment": "Malware payload (DCRat)", "value": "3579ca0eee165600c94fcc5295f529181fd89f797a0cb80f6b99b97e2135cf6c8e782fa28c075b8cf45680db2bc06a3e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183418, "uuid": "26f6ec7b-a08f-400e-8e90-8d103b5cca79", "value": "T16CB48B8637E8AA11F2BF4775E0F55D6E4B71B412A6B2EF4F09C652D92813740EC00BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183418, "uuid": "332cfd38-1b68-4613-9090-110daf253f86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183418, "uuid": "668b45b9-9c8d-40a9-a73d-441c914390de", "value": "12288:hqnOTB8B+CmV820ZDBAoSTM7eBUJi/+L6/o1:h+OTB8B+PADBEQ/JiG+/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629183418, "uuid": "ae9db094-1c65-4c3c-a72f-5f4a941b1a0d", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629183418, "uuid": "5a6555f4-20dc-4660-a82d-ff287d58d66a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183418, "uuid": "874808e3-81fd-4e75-a903-e12de8a6cc57", "value": "a100cd626553653384f7e6cd2484ab36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3489676c-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208711, "uuid": "0feb69f7-9ec6-4984-a595-ea816ff20490", "comment": "Malware payload", "value": "4ec8827165bcf961bfc8e07506fbda21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208711, "uuid": "fe3adb5f-db5a-459a-b013-9f61704ab6a2", "comment": "Malware payload", "value": "4a446088bcb32413bec736d194ed2830dceb19e4715a3700d1b091542dd5a168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208711, "uuid": "1120291f-f324-4f70-be95-a8354d05bcf2", "comment": "Malware payload", "value": "a1e8136b3ba43b4a4d1baa56c6f8843bbbbd22d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208711, "uuid": "cc2524d2-52fb-4eef-8476-179bf6f2877e", "comment": "Malware payload", "value": "5294cd06e61ab99c183fc084a5cd147a1bc017881d21d6f17623117af93a57933ed907640598d33a84759c58d7fd3d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208711, "uuid": "aa11886a-f952-49ac-ba2a-860a36a569e0", "value": "T1FC55EA3A2578393BE179C33DDEE5481BF6D8B45B7211AA1670DB13670703A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208711, "uuid": "1a6e13f7-3516-498f-81cf-65b86deabb4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208711, "uuid": "857eb015-6952-47b6-af3c-896e2eaab9be", "value": "24576:RQPAAcKc2zV2veZ7Fn7znzyvyu/QlCHhr52Yf:bS7BfnWyj4BrQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208711, "uuid": "d2d3fb81-dbd3-4160-adb4-697662f7d5b3", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208711, "uuid": "0e762a0c-b81c-448d-856d-c9dcfafab7cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208711, "uuid": "302fc4f4-897f-4576-ac06-fab42d75c33f", "value": "PO 210817-011A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498b6cdb-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209176, "uuid": "0d8a9e30-4823-4c64-a42b-6feb33e83102", "comment": "Malware payload (Formbook)", "value": "dd845e175fb5b0d020a2032dae447287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209176, "uuid": "89a76517-0a4c-4437-9c25-ddf3f1a3a6ef", "comment": "Malware payload (Formbook)", "value": "4a8e92182911cc2ee70ab3c2c869123091d8bef639f97f7bc04d2903bddc78e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209176, "uuid": "cccd7870-a3f0-4fc7-affc-9f46037cc2c6", "comment": "Malware payload (Formbook)", "value": "411c9dd7b1866ff08b4ebdfbba5b38a1f874f2da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209176, "uuid": "78bb6844-8c58-449f-a7aa-4c1a9761e2d1", "comment": "Malware payload (Formbook)", "value": "7a47bcc5a0ef635ead062c76d1d8607ac2efa74d1f33360b8f68e9e474bfc63632f28aeb139f38f10ba684cfff36351e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209176, "uuid": "53991ad2-b807-4271-a94b-9fab5a414331", "value": "T14E84DF15F6828037D9B3087A46F55278693D7B701B2F5AFF17C81AB94B341C1AA31A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209176, "uuid": "7af99c97-859b-423b-9b7a-679c329f8ddc", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209176, "uuid": "cad1fd6b-1fc7-4100-8646-1aa48ec32a4e", "value": "12288:rd5qRTBltDnQyDCdLAdpKVI2mzMh0ytejyrV:rd5CBbsQCJAdGI295WyrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209176, "uuid": "5958cd51-7bb2-42cf-a83c-80ed58f60dfe", "value": 393252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209176, "uuid": "6369e47c-e8a3-4319-9db6-59fc02a34d5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209176, "uuid": "89f06303-c39f-4920-9962-86aef8f8b0df", "value": "90k New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c47b653-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208643, "uuid": "d1763d33-fade-45a6-af4f-8c6fa78e1d80", "comment": "Malware payload", "value": "c9047f8f9fa69377c60b45b57df19f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208643, "uuid": "9c634c96-d684-4c73-bbfa-ac4912abb9cf", "comment": "Malware payload", "value": "4b23a60b57dd0390547858a7831de752412abd906fac2ed414d9330585649e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208643, "uuid": "ba0e28b0-797a-447c-bbaf-e674ad08eab3", "comment": "Malware payload", "value": "5ebc03a7cbc9c57e978a794b837809cfc891fdee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208643, "uuid": "fe6774fd-9e0f-4e46-a85e-bb61bc978ea1", "comment": "Malware payload", "value": "d84e43f57872e3f23944f17b84ed7ff096273814c7bfde091edf4c921e359f6e51d67430685ecf825361ae660e49953e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208643, "uuid": "529494cd-f484-44f1-acbe-ad8f8efb3a43", "value": "T14155D93C26B8393BF179C339FEE9581BE6D4B45B72116A1674D613670202702B9A337E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208643, "uuid": "24b76645-d6ca-4f89-86d0-016476eea686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208643, "uuid": "9f30d86b-797a-4fab-b6b4-3b185c7340a2", "value": "24576:rgWw92ckc+zAsm8/cPJSFndC04ENP/igcnivCmib:rU8CSBtPqVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208643, "uuid": "5892e24a-62bd-4b2d-bb11-f7a02b14ff6b", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208643, "uuid": "1742f03d-f0cb-476b-af54-24205b64988d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208643, "uuid": "af6760ff-5f3d-41a8-a7fe-ef2f1f61b680", "value": "FedEx Receipt_AWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43b9e5f-ff1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629177625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177625, "uuid": "803f7d25-d6e4-46bc-af99-ea587fed79f3", "comment": "Malware payload", "value": "72595a85b26af149529e59295cd4488d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177625, "uuid": "bf8bd83f-3499-4a78-9d11-cdab01b9e3db", "comment": "Malware payload", "value": "4b463ff0e6e333d5f6b91d5bca2c76ce6fde2cd697af87aac8a1984548829d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177625, "uuid": "ea29041e-0cc4-41ba-883b-636e7e4cc0ed", "comment": "Malware payload", "value": "4187e7409ea896df78a9de79d25c7155d73d0ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177625, "uuid": "e0e2f314-6be5-4755-b85b-683af8d120d4", "comment": "Malware payload", "value": "0dedc344a998029917a5d706c96a5e02ed68d6d9e4f770793ed2fa1e523fb36d345bbb443186395b461ae4a943318f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177625, "uuid": "60edb006-8cb4-44fe-8cb1-be578086d21b", "value": "T1D655D93815B43A37E179C339DEE4482BE6D4F45BB211AA1A70DE57670243E42B89327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177625, "uuid": "b6f91ca2-65eb-41ca-9cfd-2cb6eda9601f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177625, "uuid": "bb0f6cc8-7c11-47e0-8b25-5607d9992db4", "value": "24576:VsEQDcIcOz1dpMPPWEEzJFnZ/BDEWL4M3TapfY9:eNJB3ZEITqfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629177625, "uuid": "824179ec-c817-4e70-89e7-70d12e2a90ee", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629177625, "uuid": "3f53c2aa-5828-4856-81bd-96ffcaeb4a5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177625, "uuid": "769ddf01-7789-4580-9200-40e1e0425b03", "value": "RFQ scope of requirements PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747a2289-fef3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629160714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160714, "uuid": "8d00d23b-94e8-484b-93c4-b183539dc420", "comment": "Malware payload (Dridex)", "value": "32ab4c2c19629b6029280df7a8b9ee53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160714, "uuid": "543f078e-184f-4026-9711-ec8bfb6f7390", "comment": "Malware payload (Dridex)", "value": "4b6c961a0ce8b3998edd824a606903ff871ee5d6f4ebf321f4995709c2b68307", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160714, "uuid": "c1aaf797-ae9d-46df-8e8d-c78474f92c8b", "comment": "Malware payload (Dridex)", "value": "35515e69063d46310ba56868150c8e7a992fc0b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160714, "uuid": "a71d58c2-f7e0-44bb-8f66-cab0d872b2ea", "comment": "Malware payload (Dridex)", "value": "a6eafd5edbe84f44f17b7833a7a46194bd7f4590b35e8afad18e51bcfbdbbfe461b8a9b4e57485c70272d866e6525dc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160714, "uuid": "6f15f3b1-8e8a-4340-ad8f-11a92ba10205", "value": "T174140227EF585843D61CC7BA3F472CB003DE1B46A205B4C9A9F32D6D2A5C6A24BF911D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160714, "uuid": "41a7c4a3-8261-43fd-a34d-9c4da975ca4d", "value": "3072:NJ/ogkBdPxNLhrZSGkAWowGZrYL5H8t5xjNHBmKBak0znLuM:DogkLjLh9LkAiGraajvx4kenLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629160714, "uuid": "9d20cb1c-ee5b-4cd2-b216-9be5f3d5be9d", "value": 203014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629160714, "uuid": "2448c055-4af5-4003-bd20-dc67c2d34b5e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160714, "uuid": "e77fc5fd-956c-49cb-b0f8-c3b83b9dcc04", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.438388277.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8edd7ad-ff40-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629193981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193981, "uuid": "6754bd7d-76b7-48ca-9a1d-c6100c123cd4", "comment": "Malware payload (GuLoader)", "value": "a904ee33a468f0f1ded5655364039d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193981, "uuid": "6bb0aba5-6690-4c81-90aa-6353ad58f4e3", "comment": "Malware payload (GuLoader)", "value": "4bab804308489a345ce6b6f32f492b518c8ea3c0fd299c887f37432fd7c95337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193981, "uuid": "9c7ab905-4342-46ca-a797-b560475880bf", "comment": "Malware payload (GuLoader)", "value": "bae26b674518fd99de1447d15a782968f85ae9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629193981, "uuid": "676f9b28-763e-4e44-9fa1-09ef21245eac", "comment": "Malware payload (GuLoader)", "value": "cfb52388d6985b6db31f90bdd1e1741010dbf8b4ed14f27f6d1e8a654be848bc19a763d5d8ef30abea5eb643c272a83b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193981, "uuid": "591c0363-7c0b-4889-8f6a-e91a16f74342", "value": "T1B0E3067576CBC880FD04DD711258892A7E1EBC23364A2E0BB512670D6AF95F2E9F490F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193981, "uuid": "77469a07-cd76-4ffb-8a75-35fe78637fa3", "value": "2b4f5fe80df3ed9a6d3159464b73e6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193981, "uuid": "014bba78-9011-49e9-be19-968be3f18972", "value": "1536:ddUXlQJA45jPPsnVluGjF31JBgqFBCZtV35gj49h:zNxRP0nDu0FvB3CZtgk9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629193981, "uuid": "efd477ac-c89b-4c24-af5c-729b15ccbd79", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629193981, "uuid": "8da7a344-4e2b-4776-9117-ade05c3435bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629193981, "uuid": "14ec9b91-e5a2-41af-ac17-5fc2f74c4556", "value": "4bab804308489a345ce6b6f32f492b518c8ea3c0fd299c887f37432fd7c95337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c5067c-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209441, "uuid": "33452b2c-d095-463a-b148-535c9b805f43", "comment": "Malware payload (Formbook)", "value": "91706d95a9aafe3c99f742e6d476fd66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209441, "uuid": "84018026-5586-4746-b8df-48c2b8c2bf3d", "comment": "Malware payload (Formbook)", "value": "4c5ba895d47529032c749f81ae5f8ffba7fab5493a2bd33f699c0d05aabfa080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209441, "uuid": "d611db2d-3967-4356-92b9-4f48631ba17c", "comment": "Malware payload (Formbook)", "value": "2b69023fcd198efe36909ae031726a02966c30a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209441, "uuid": "48c558cf-19bb-47aa-be1e-dec068ce7173", "comment": "Malware payload (Formbook)", "value": "ed0df66ba3d0db64728ead4fc9c39c46e4e71bd2fc00a79b5a8ba8806b4a15da964db7f5eb9ad7585da2a314c6e55f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209441, "uuid": "1573f627-6599-4959-833d-53a7b126dc02", "value": "T167254E381BB82567C065D63EA7D1C61BE050CADB3419EA5754CA8F67B302BC2F78722D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209441, "uuid": "025b5f90-6736-4cf0-98fd-ed8aa359d648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209441, "uuid": "e01f43aa-f643-4721-8af1-55f6947960ed", "value": "12288:F7Dc9F3nC0Py3gAhPEJbjJEKFWxqG1ICxlLokn9z5ab2NJO92dJBfOjpkUhXRxOT:OY9jlLokn9z5dg2L0GUhHl1OMayg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209441, "uuid": "adc3b8c1-ccbb-4faa-a6b0-95a3b5296b65", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209441, "uuid": "fe5f4ddf-edc8-4a76-adf8-2d615fa083d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209441, "uuid": "b099db6a-dff6-46d0-9101-3e21e8ab8c13", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910fd1a7-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198988, "uuid": "3eaeda04-5f90-4130-a3ab-6155ddd5e844", "comment": "Malware payload (Gafgyt)", "value": "d3106c1179d96ff7cf42ebe2602a6b69", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198988, "uuid": "abb23574-9c08-469d-af36-aaadcd1e995d", "comment": "Malware payload (Gafgyt)", "value": "4c846a88084d99ffc86369051a89dfb64c5790bf3bdd0dbfb9298f2ff82a1f7d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198988, "uuid": "ebba1d56-0082-4d00-997a-58464cd5a203", "comment": "Malware payload (Gafgyt)", "value": "f84a91eb6500c543096c813569af5e46676f4e60", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198988, "uuid": "9f4f1caf-afea-4f2b-976f-e6f64fd2d744", "comment": "Malware payload (Gafgyt)", "value": "f5ec06226da4463c4144fbae90ca85d4fc1d495351ce78ac617cf0b8bf2c1901c73d80518a8c451ba2c6065e2303c4f9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198988, "uuid": "958d832a-7aaa-45e1-a102-50d99e28df0f", "value": "T199B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198988, "uuid": "18afac3c-3ed4-4009-b0f2-82679b0efbd2", "value": "3072:R/4rNF9U4vv/Kw6J73x8UmkiSFxfKxbXe:BSNFK+/8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198988, "uuid": "3c4ec17d-0f04-4036-a1cf-a48c79edada6", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198988, "uuid": "749542e5-1ba8-4c47-bb79-7b676c10765c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198988, "uuid": "e4956ab3-2f06-4b40-a994-324c80e0743f", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00af146-ff33-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629188302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188302, "uuid": "b9296f99-ff6c-47a4-8713-9733586713cb", "comment": "Malware payload (AgentTesla)", "value": "a4616d5e7d1d15f5f35ed41302011bb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188302, "uuid": "ba17d189-f8fd-4302-a933-1d79ab322a79", "comment": "Malware payload (AgentTesla)", "value": "4d95a2a4536ef058cccd8ac846bd2dd906fcbcd87fe6579b9918632402d04def", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188302, "uuid": "3b4b06ff-2623-41a7-8bf8-497d2bd06f86", "comment": "Malware payload (AgentTesla)", "value": "f7ed20260874c7e99e917b50c2389486bde1b401", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188302, "uuid": "d82a9f0e-feba-4ab2-bb34-a6f4acb9c311", "comment": "Malware payload (AgentTesla)", "value": "79ab1ba0ac43b04548d860fc3459a8270af4b391d12fab30ee3573358c811dd64d81e6d9667961c07f99b47213738a58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188302, "uuid": "bab5b355-7708-45c8-8c0a-ae620764aa93", "value": "T1E305E02A3F0C9ACBC258B47F4B81D785C2A2E3D6BC16E7AB19905D5BF7952C0F70A144", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188302, "uuid": "5266d50d-91a1-4056-b7ea-0ded9ed6248e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188302, "uuid": "70b3ee7c-a63d-494a-9e20-a50ca871e18f", "value": "24576:a8peqv2RPiYTdx7emyQTGbQdvfNB2ekYQAR7s5pLh:a8o5PVxSaf/2ekYQRpLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629188302, "uuid": "5fa95eb2-bf59-4f66-9026-bfe1dbfcb69f", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629188302, "uuid": "4188c95c-fd4b-402e-a148-779b7a19c97a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188302, "uuid": "ffd5d71b-71f9-47b3-9502-f7dd1132a7c4", "value": "00098765_INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24b7da8-ff26-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629182696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182696, "uuid": "a659661d-b35c-437a-908a-6b914fd684d7", "comment": "Malware payload", "value": "7c5d51f707b6fd10c4ffb3aa55a23501", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182696, "uuid": "2347bbff-a0ba-490a-818b-c0709a6e5fbb", "comment": "Malware payload", "value": "4dc4374ec31a770fab9ba859bc17bfc7b7e7a03d50fcbf7a155b2a02eaf4cda7", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182696, "uuid": "136f426e-7601-4cfe-8907-8c3c4f800a53", "comment": "Malware payload", "value": "0324118b42e13f842f762c09a1f1bb1c6cb0da73", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182696, "uuid": "e047753d-0f47-4c47-9e4f-e87a65890d95", "comment": "Malware payload", "value": "7033cba7bcc8b27cd17fb25b36aed38ed55718eb0d9c684307e1a959b9acebcdf01ee0dd8894ebd7ce9120d28b3ed397", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182696, "uuid": "a3fcc870-e766-40ad-ad2d-660553a60168", "value": "T175551292B8D81A8DD38E3EB09D23F12813BCDE726509D133166D7D82553DF2A9643A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182696, "uuid": "87a8f8f4-79a2-4e8d-9561-315e5488b7eb", "value": "24576:o8ShU43y6pBZ9dEPsqWZD6dMcmXSZvh2eEF9cb+uBft+W6gzOtPyReTA:HyymEP9O6dMbqfEFOb+uBDytPyR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182696, "uuid": "52ec8917-d534-48d5-a372-0442bf39fb2d", "value": 1324520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182696, "uuid": "4cb6731a-1127-4fdb-a329-738174183561", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182696, "uuid": "9e5697c1-8d55-4297-a79b-92c3968ad284", "value": "PROOF OF PAYMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f549018f-ff62-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208605, "uuid": "4d2d8eb0-9405-4edc-9c09-d855d31f82ad", "comment": "Malware payload", "value": "edf835efce11d616562acffc39e9daea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208605, "uuid": "21bb97dd-dc63-42fb-b3fc-ee806cc52e2d", "comment": "Malware payload", "value": "4dca26182f7fb3bff226adec1829c07807797ca4e0ecdd629657d83245f17085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208605, "uuid": "421bbc85-1148-47a6-8059-433ba04f3aa9", "comment": "Malware payload", "value": "9511ae10673934509437355f52da9189cc9323b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208605, "uuid": "75374c72-d781-4a6c-8d80-ad817064708c", "comment": "Malware payload", "value": "49d89fffa6de465038d05f5c8be185c18a55e01ad0097923a6362fa70754784713b5ccb20f1d311f966e925f81694283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208605, "uuid": "11cdc737-67c8-48e5-9912-b3cffdee8533", "value": "T1DB55E93825B8396FE179C339DEE4481BF6D4B45B7211AB1A70DB13670302A12B9D727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208605, "uuid": "61d888b3-4802-43ff-b725-de2f86a6ede7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208605, "uuid": "06876389-6ad6-4f14-a0ba-d8cb70b6d0f4", "value": "12288:CuquRFT0Agcqc2zQD3PLtenyDrkQmVdSvBQrFnsDc9F3nC0Py3gAhayCYGr8udha:dT0Agcqc2z8ICrDvMFnaGrZ3GWzhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208605, "uuid": "0ba2dffc-b0d7-4e86-ba9b-c13afbaee105", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208605, "uuid": "b9a965e8-0697-4d4a-9de6-677f1663a7c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208605, "uuid": "5af55983-fc17-41b1-994f-b07ae7b9a82d", "value": "AWB - Invoice And Shipping Documents August 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f346128f-ff26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629182832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182832, "uuid": "d21d56d4-7fec-49cb-b5b4-91eafea190e3", "comment": "Malware payload (Loki)", "value": "20fda68e642026879072acbdaec905c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182832, "uuid": "9f13c4fe-3617-405e-b1bf-fa0d61d12563", "comment": "Malware payload (Loki)", "value": "509af0a6b4ca7a15a4eb64458a1863e37727493c5933781e501de65fb6d858e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182832, "uuid": "9a13480b-b6b6-4d0f-b312-ee9e7bebf207", "comment": "Malware payload (Loki)", "value": "dcf39873c8ede45436d7c98b0bd02323a0947d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182832, "uuid": "84cd834b-0f3e-48e2-8f05-e95cb292d7d7", "comment": "Malware payload (Loki)", "value": "b6aa07743f065f6dcb9e1d192aeb9781cdd3ccf6ea36cba4b94cab81091ae6c8afce9e77b2e6800381589988c421b2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182832, "uuid": "bab8dff1-3f8e-436b-8a37-599f7ce0839d", "value": "T18DA4CF11B991D4B2C6921473525FE3AB9D2977309D328C87F3945EB0FF729B0A228B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182832, "uuid": "b438d992-5145-4999-a9de-043757953f6c", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182832, "uuid": "97b8984f-6aaa-4ca0-b9dd-bda13e695cf3", "value": "12288:uwTVDh1lZogujm7qvtlJvtP9cLvElCSYi:uwTVDh1sXjmIj9cDiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182832, "uuid": "c7f08983-39e2-4eb5-a273-05572ffcd553", "value": 458844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182832, "uuid": "f28fa955-724b-4683-95c2-7af8681b96ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182832, "uuid": "4efc5f72-bcab-4451-b681-8c6a9566f6d5", "value": "scan04289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c946ded9-ff3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629191780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191780, "uuid": "7ffca554-e86d-40b3-8269-734a77fb0bf3", "comment": "Malware payload (SnakeKeylogger)", "value": "e7e478e04f7e736a9f395e373ee0d62c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191780, "uuid": "5451ed55-dab6-41f0-8740-fac0281d2fa9", "comment": "Malware payload (SnakeKeylogger)", "value": "509ef2d43b9063eebd71a0a34272fb33111eaa6478e0d1262945c9f7077d8aa3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191780, "uuid": "625aa983-2a29-4cc7-939a-90dce23d5fd1", "comment": "Malware payload (SnakeKeylogger)", "value": "c5f56c2f700d701ca3f6fb156373dde756d74ef6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191780, "uuid": "22109caa-6875-4771-90c8-20bea756252b", "comment": "Malware payload (SnakeKeylogger)", "value": "f80abeda78c2e9db851e19d1a9f20bb4086ef0e06aa035c8be598aebd5825365efc0ca8c7dca723ec27eaad4d444d51c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191780, "uuid": "85890d32-79de-4154-9226-bfbdb2ff6643", "value": "T1F23350ACD08B06A88F85A7B82B1B2F81054C7A6DF7989533767C533527D2C7B912793C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191780, "uuid": "62c3f6c8-3d4c-4360-90f6-3af578c31595", "value": "192:nryMWEH32m1k45WBRa3UwlJpJzcW3K3VwozvzVxffqXl26bTzjI/hMcAV:wE3Lkta3UwlJQ3V1zhxffO26bs/hMXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191780, "uuid": "d1e8cab5-b88b-471a-abfb-e4b596a9bd5f", "value": 53604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191780, "uuid": "c5b7f181-56b5-4390-b4d4-ba3d5202b975", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191780, "uuid": "bfad05c8-3d6b-4149-98ac-95f4ae57b431", "value": "picture.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5343025-ff3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192713, "uuid": "a542ae7c-2d07-4369-8b78-8d30ccdc092b", "comment": "Malware payload (RedLineStealer)", "value": "5b2efc41e60b436ff9bce0ae4f8fd30a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192713, "uuid": "2977b332-e620-4689-a734-0b549bd961f6", "comment": "Malware payload (RedLineStealer)", "value": "5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192713, "uuid": "9a37092c-34f9-48b8-af78-8d1cbd375637", "comment": "Malware payload (RedLineStealer)", "value": "611ddf0b6cb01edd77969925d242c7d0685e9750", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192713, "uuid": "d674e36e-c2c4-4378-93db-cb8282ea3f0d", "comment": "Malware payload (RedLineStealer)", "value": "711a5f792437f6d0bbea813d49bb23191ad83fbf3e9e44ba97ea32db290234a83ae861390ab12297dd952545fc5eff5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192713, "uuid": "6e8f4188-97ef-4d5a-ba65-c1c2fe1ce107", "value": "T14CA32A3263ACC629F7BE0A366870021587F1E0CB6412E75E5EC174EA1E767826548FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192713, "uuid": "dfae5344-d0b9-48ec-823b-2f588279b946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192713, "uuid": "d4864eda-3f72-48bc-9d15-50d6f5991599", "value": "1536:RTo6aGLKC7i2RHZVeb5N9HSBoh5TAauswsgbue7vduvNyAsdBdetx5RE7G6WAaof:ddxGCD3MbZHtZDi3dulyddONWh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192713, "uuid": "d4affea2-9023-4cd4-8272-337217bdaaf2", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192713, "uuid": "7115dd4d-cdd8-4ee8-92a5-740f27f06326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192713, "uuid": "6fb11fc2-bbc6-4aab-ba1f-e5b110e76b9d", "value": "5b2efc41e60b436ff9bce0ae4f8fd30a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ed5d74-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208737, "uuid": "419fed05-855e-40a0-93ce-17c58804ae47", "comment": "Malware payload", "value": "b173c1c9ca617c4b8564de9679068717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208737, "uuid": "d2de311f-6688-4dc8-81a9-b108e68465d4", "comment": "Malware payload", "value": "529ce12eb813691c6a8c714ade806fb6ecb9cef78827ab54af7427a1c0da8b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208737, "uuid": "f3e1dd2c-d5ba-4197-a644-48f878be23a2", "comment": "Malware payload", "value": "1859f524657a4598bd2be3bfe0ae0824f45b1c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208737, "uuid": "c295bcce-547e-4703-a05d-4dd19ea40be8", "comment": "Malware payload", "value": "409727987f8ec9fb8f7efc70d6b00f4c5a5be85c8de8b64cc6900b05051b4b4018daae64ec0b2b4493a589a8fe2ddb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208737, "uuid": "54ed3372-2436-45ed-9eec-0b8bcdfc47b2", "value": "T10D55E93815B43927F179C33DDEE5481BE6F4B85B7211AA1A74DE13670242A02BB9337E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208737, "uuid": "31f5f8a5-3041-4e65-af05-a7a8d517628b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208737, "uuid": "0bb85039-58d9-4ea3-b2e1-1241acd49737", "value": "24576:qvYiAYcic2zCL7eMjdcwFn5bjkJyzX2TI99mDfihB03x:7q8cwBHzX2YkTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208737, "uuid": "19a8cf9b-4957-4334-ab35-a9a4162122f5", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208737, "uuid": "9da41925-a88b-46d7-bc77-dab160e44b5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208737, "uuid": "d6cea158-8e2d-465f-a081-332fca2f5a73", "value": "INV+PL+BL REF-281736577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51662a02-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209189, "uuid": "d911c9d8-2c8b-4b5f-8e17-c580be2dfb34", "comment": "Malware payload (Formbook)", "value": "02b89444a1d633c44e1e9e54e3fdd1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209189, "uuid": "b8adf42d-2d77-41b9-880c-b07adf32a92f", "comment": "Malware payload (Formbook)", "value": "52b0438a43977e210e58786f139697a9007854f624d8901c891a9af69b87667f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209189, "uuid": "e06fc753-e7f5-4a16-8ea1-657f66bd9101", "comment": "Malware payload (Formbook)", "value": "6d560a1c41457fa9c88d5d218ea4a9ae670fbedd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209189, "uuid": "efd89b89-3609-4011-9111-2f14a466b5b8", "comment": "Malware payload (Formbook)", "value": "282aad10da9fa0d831936ff71d7b8f4d33f9f998c78b5b04b4729b64247c3216eeaf95263aa4ccc20da54cea9733ebf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209189, "uuid": "117c4a44-2729-499b-99f8-50d81a4bebfd", "value": "T1062560381B7925A7D065D63EABD18617F04096DF3411AA57A4CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209189, "uuid": "5405d65b-5863-4255-b318-b17378efbc48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209189, "uuid": "74dcf14e-1e0d-47cb-ad18-d000ca80536c", "value": "12288:qxDc9F3nC0Py3gAhSEJbjJEK1+E5Gl6twEtG5FhVvjRrry8rXcuzDD8qfv:6J5Gl6HE5FhhjRvy8Zdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209189, "uuid": "7e05dcec-ee5c-4322-b31f-d45fff791b33", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209189, "uuid": "2e314dce-e10f-4611-a91b-53d523e28375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209189, "uuid": "5b5bb3a5-26c9-46e4-9fb9-474257b2de2f", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb917860-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164350, "uuid": "30d03c0c-6eb7-4d8b-b858-179e1806dfdc", "comment": "Malware payload (Mirai)", "value": "382d7dfd644cfa35f0cd85a93d661260", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164350, "uuid": "21c7929e-8e35-4249-9756-e08278ca84f6", "comment": "Malware payload (Mirai)", "value": "52d81fecc901991071196a9ee1dfde5cecadcaf7884658a7d7d3d14e8b18f696", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164350, "uuid": "6cdd1d9d-eed5-4e9f-a138-248a1ba2d467", "comment": "Malware payload (Mirai)", "value": "75fcbd4faa0a9a26a9cf93ada3dac2120dc34883", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164350, "uuid": "f7412fc2-8c08-4c0c-954a-7b98e9e4883e", "comment": "Malware payload (Mirai)", "value": "9b847167ce80933f92e073a88f284e2aab5c5bfa3ba591897c8a06b289b729f50d41d31559a4ae63890f699ffef9fae4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164350, "uuid": "f5159d58-45bf-4374-a963-826d5ea2610f", "value": "T1B5530847B44180FDC149D03443AB6A76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164350, "uuid": "f05fc6d1-c068-4270-8c25-aa59cad85704", "value": "1536:anF9U0FferGtOW4/RWo49z8kkRqwvhJOlQ5M7WR:0FK0UrUO3JWvcRqwvOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164350, "uuid": "1541a1f8-4fcd-461e-a559-80f43a001b3b", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164350, "uuid": "7293c7dc-2c86-41db-9115-29c753b42ceb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164350, "uuid": "9f117975-45c9-4821-898b-76d7ad7d67b6", "value": "382d7dfd644cfa35f0cd85a93d661260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e67c36-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209924, "uuid": "a212a72b-8161-472d-85f0-5b7fb07a6e95", "comment": "Malware payload (AgentTesla)", "value": "2c47f030311ad86019602b0da8298332", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209924, "uuid": "a56503e8-4170-45aa-a848-966a8a95e6cf", "comment": "Malware payload (AgentTesla)", "value": "53070d5934af2bddffe0d4ba90f8e4b21898077082262e9e3320c8b5589b18c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209924, "uuid": "729a7ceb-2bef-40b2-8a22-11e61f171d7f", "comment": "Malware payload (AgentTesla)", "value": "0e3baf911af6a8e011b722925ab217f012b5162a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209924, "uuid": "174ab783-9562-43fc-9d7d-43e67ac16bf4", "comment": "Malware payload (AgentTesla)", "value": "5782bfd78a9ff11b110a897b60cd447b9abbc49c489ac3f13a350860d85cf1ba9769f75c7dd7196cb3c4c1b517a73dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209924, "uuid": "2d672072-045c-40b1-86bb-8b061018378e", "value": "T1D22571391BB825A7D065D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209924, "uuid": "ba678866-86c5-42f2-82dc-93b91e680741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209924, "uuid": "04f4489b-7335-43c9-9594-d755adeed8de", "value": "12288:PjDc9F3nC0Py3gAh/EJbjJEKDuainvOHtYXwacIKDu73RXYAa1Jfs2YACJTKkOSv:kuaEZwyKspYT1Jfs2YrJTKkOB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209924, "uuid": "be2a72f8-98d9-4e5d-b3a4-8a8b674c6407", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209924, "uuid": "b0a97996-d59b-4c8d-9b1f-1fe37920df4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209924, "uuid": "a6a3e5f1-6335-4cfb-a37e-382c7c41288e", "value": "2c47f030311ad86019602b0da8298332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a137f0-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629209459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209459, "uuid": "e6e0a7ee-5358-4445-bc3e-1afd0f3a1b65", "comment": "Malware payload (a310Logger)", "value": "60d4e7791158258a1c7a50570021acb3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209459, "uuid": "192b92de-ef2a-48b3-bef3-ef84314d54db", "comment": "Malware payload (a310Logger)", "value": "5376e7e271739ec94123ba33b4061ace8309950174746e962c8bade29b571984", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209459, "uuid": "ebd355bb-1098-4217-a204-ac839a4d5b0f", "comment": "Malware payload (a310Logger)", "value": "107cbdad79622f6112f4d5eaa2319ea85fa97a9f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209459, "uuid": "80a0f53b-2a5f-440d-acc4-4e737cacb325", "comment": "Malware payload (a310Logger)", "value": "dc70c238aefeab9c70a01f816b8c3801beef221f17f44e45212046ab91af6a367230c3f3c9570f9a5e2dc634517b38eb", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209459, "uuid": "5a020ad8-5716-4688-96c7-f04d161dcb86", "value": "T17D551212B385A037DC72083685F296B5A9686E34C70F6DEF2394467D6B312D1E930E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209459, "uuid": "47c7fec3-5602-46eb-a317-b845e5c1808b", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209459, "uuid": "b9f32702-3e99-43fe-8bb4-eb41b10f2e7e", "value": "24576:HtImRbYyYAu/5LqBsskWKKIfga1HF/KPLGg3SknffSLexizH6ZQKxO5fLXBVmby+:9Jpv2qB/ku0T/Kyg3SEfjIzgQP9LXBYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209459, "uuid": "4cb03fd2-341b-4e21-b5fd-8fd78cc35a4b", "value": 1297526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209459, "uuid": "c37247a2-d345-41d8-a76e-1ab5788f0a84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209459, "uuid": "3ea9332a-9e70-47fb-bb87-c3e9111225ee", "value": "quotation \uff08HY20 PP .pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac2e189-ff6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629212506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212506, "uuid": "72be8f8b-7c9c-41e0-8055-e7897882c2f1", "comment": "Malware payload (Mirai)", "value": "e00c56abfa0d423f36e02de1f56a2655", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212506, "uuid": "6911d1ef-a90b-49de-a40f-7dd011f5ee6a", "comment": "Malware payload (Mirai)", "value": "5379335890ccb80428c21f3a9b5a185f1c05c6ba1cd608fe08076afc0c6e1099", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212506, "uuid": "9aa81668-257e-49f7-9598-6daff2c72f12", "comment": "Malware payload (Mirai)", "value": "8af0506af3cb7ccea8a0a2e5ac68ed72f42294f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212506, "uuid": "052d2c2c-b62b-4dc1-8949-f11025272279", "comment": "Malware payload (Mirai)", "value": "d85516e5e75a42e9cedee47ab54ec839573539dc12864591ed8a6cf6ee8d264a63f2bd1286eac00f5b63df4cfdcf7d7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212506, "uuid": "d009ac4b-0289-4cbc-b89e-d9c23af586ce", "value": "T1CBC32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212506, "uuid": "b05e4fe2-e62d-4986-973e-4de22277520c", "value": "3072:/YNa/GLBNPoQvphakpiQ9/nYEP/UnSQf/R:6a/ylowphakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212506, "uuid": "30e3ceff-1cae-4a7a-92b8-6f127c861958", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212506, "uuid": "f6ce1f74-171c-4517-8988-482cd3633047", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212506, "uuid": "a121ec97-d3a1-4c86-aeb2-98074e77941d", "value": "e00c56abfa0d423f36e02de1f56a2655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707f33af-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192920, "uuid": "147c5d63-e27c-4310-a699-3bdb62faeeab", "comment": "Malware payload (RedLineStealer)", "value": "8bcfb9320a0570d0f84273d298a268ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192920, "uuid": "6cb304aa-a142-4f54-825b-38f158dc540d", "comment": "Malware payload (RedLineStealer)", "value": "5471c7d3aa5ad7016fb59b9bbef2328ff1397dd70ec8ad213a8ff598c5fce8cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192920, "uuid": "45ca12d3-743f-481a-b33b-54bccd1a3f03", "comment": "Malware payload (RedLineStealer)", "value": "63f51886a52e54ae549ea720164396c2d9e07812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192920, "uuid": "1c66a5b9-f0e2-497e-97dd-335af0232583", "comment": "Malware payload (RedLineStealer)", "value": "2eda3a865bd18a33097fe766b97421177377dcdd77115fa1d6c15ef2d861fd1219c18a17dab9537b0814e89c34996156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192920, "uuid": "3a29620e-9e06-41a8-95e8-55d79e59a8e0", "value": "T1B405182CAECDD203FBF43A329E67C55493B66CA5052AC10B6F0D76A7A871BD339121C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192920, "uuid": "97226bc0-386c-44d6-92dc-e00602cb95f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192920, "uuid": "08006690-008b-4f6c-bc28-a60d2447b2ab", "value": "6144:OXW9Zx9m/w3T+Z3RrCd40jsPV0mg0ykNbUkxChx4IQq14WT:OG9ZxJD+n2/wIlkqkxChx4Iz4WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192920, "uuid": "c4dce477-6da0-4e30-a97e-94487a4cb01e", "value": 835568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192920, "uuid": "494db680-24f1-4212-82c9-28768cc8c044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192920, "uuid": "ae13c9f6-f0d8-46e5-8f84-6b9bf8024c7f", "value": "Minecraft_v2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e96fafb-ff01-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629166798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166798, "uuid": "f9be2c72-7cfb-4f47-b06d-a0fe4eedbc4b", "comment": "Malware payload", "value": "d2e63c45e22a184813ec4cc9c918e252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166798, "uuid": "33e5d814-217d-420b-bf0a-01e09d1055d8", "comment": "Malware payload", "value": "554e86316de7db62bc551038465cdb026c9a78664e75374a4b87bbc07b89c4d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166798, "uuid": "f705e04c-c063-4841-9d43-3f0272a1df20", "comment": "Malware payload", "value": "57c1542aed5d46ad7106e3e15ab41e79d409f433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166798, "uuid": "310c52be-addc-4106-9630-e16e8c642b63", "comment": "Malware payload", "value": "a3a6ad4b3971fee2947be7f95ca7e71c4f90265b751a5e604f4f291411d862b985f0fb56fef0e26c078a796683ef2c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166798, "uuid": "f16b05b7-f9e0-4f18-bb42-d7eb7eb125a5", "value": "T15055FA782578393BE17BC339DEE5480BF6D8B45B7211AA1670DA13670703A12B9D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166798, "uuid": "adf89466-65af-43cd-b398-862f0ae460bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166798, "uuid": "8739b06d-eb01-46c2-a91b-1f6ba221dcf6", "value": "24576:+gZkYoXc8cOzq6p1lIxnj8FnezbLjCHzSJUt2XkTsNzBx:YZZBibLuTSJU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629166798, "uuid": "17c5096f-95b9-490f-b81e-9a1fbea9cf12", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629166798, "uuid": "6a75532a-4a7c-4492-9dc5-06a1151bf81d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166798, "uuid": "e76dbb13-1c66-4b90-9ee4-55e9eeca5d50", "value": "00098765_INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e506ad-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629209389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209389, "uuid": "ebf54f83-704a-4879-9a62-85b21a74c2fd", "comment": "Malware payload (GuLoader)", "value": "77524c29c945b7e183c67e2b7a14950d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209389, "uuid": "a90435f2-0f56-4cca-9e1b-22ef3e092da6", "comment": "Malware payload (GuLoader)", "value": "55703ed5643143dc84f5c746c712a56e46c8c6cdb18456eaf46e6c6f085d92b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209389, "uuid": "6bf69cf2-2016-45f5-9cfa-3436313c8f7d", "comment": "Malware payload (GuLoader)", "value": "6210e25dfe9b29f1c1fae67f0322eb053b550655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209389, "uuid": "67113118-5200-46f1-8531-9813c150c307", "comment": "Malware payload (GuLoader)", "value": "6d1df9ecd1c228631db8aaf2d2f4b72f98db91d8ee07583b23705ff56f59dbe5554bba77e43b12438017a9823e2fc15c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209389, "uuid": "6a44f620-3690-448e-a25d-4537920b3707", "value": "T1B9D3CFE1B0E79D63E6A106710538D2E493D3F91986214F0BBF7DCEFA993BA404CC2569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209389, "uuid": "5ef7f897-660f-447f-9ef3-607ee9525462", "value": "37e215a56c837657c68542780cbce344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209389, "uuid": "47824bc7-540c-420d-86ca-9587f5696c20", "value": "3072:R+CD40KugPox1B70qTfRSlO9ts42CvASp+2H8UedH:R+E40J8BqTJSAPs42CvzpFch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209389, "uuid": "2b452a59-9075-47e8-af69-8a5c0241658b", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209389, "uuid": "fd8f040a-36f1-4ebf-847e-c08723271157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209389, "uuid": "46aa102f-eea6-45cd-9ec5-9017693f84a7", "value": "801702021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380a04ec-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208717, "uuid": "a62997c7-814a-4f2b-986e-abd3d89acd87", "comment": "Malware payload", "value": "c0ab025894b9cd53405f87ebd81ff670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208717, "uuid": "7e7156a1-7f79-41a9-b61a-94c36b8b51e9", "comment": "Malware payload", "value": "558fa89936e4ad801288a625ea83021f3495d32d75bf5d7abe32ea8803402542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208717, "uuid": "8eee42a8-f016-49f6-87dc-202021d537ec", "comment": "Malware payload", "value": "af31f18d5b45b776d51b6c5c43857840b1949f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208717, "uuid": "748611f8-d287-4a63-973c-84b25c14721a", "comment": "Malware payload", "value": "811f1121c745e8d8b57a81dbb76f25a648d5afc438d67affd3572f2d181a14acc52b4d15412e542be53a0d09f871e62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208717, "uuid": "d9d5f378-e508-4890-b9e2-bf28d75e9186", "value": "T12C55FA381578393BE1BAC73DDEE4480BF6D8B45F7611AA1670DA03671713A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208717, "uuid": "6db90b82-44b8-4779-ba9f-5950d1863292", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208717, "uuid": "f99658b0-8252-4622-859d-8dbc35bb132a", "value": "24576:/KIMoyc5c/zU/MvmgR6j56FnGHvpsTNkxBOAhtIpYEciCLwmDg:/vMT6j4BuvpsqxBOyM8LLwmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208717, "uuid": "ded92825-6402-44fc-a584-fd64c06a16eb", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208717, "uuid": "71b80d8b-f9eb-4afc-91bb-4b97c1c85be5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208717, "uuid": "69182ec4-eb92-42f3-ad3f-13b95ddb37a8", "value": "000001-001901000910010.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c56e84-ff99-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629231899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231899, "uuid": "18ab1a5c-4785-4535-af33-eb4b1befc2ce", "comment": "Malware payload", "value": "3d783752db7d5c611bebe4b666fde00f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231899, "uuid": "50c264db-2714-4d78-aaaa-436e60c35a13", "comment": "Malware payload", "value": "56761cafd78c9ab9234e8cf453813f989787f73157a584b28bb3fee8b819ec0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231899, "uuid": "64a38062-6bf4-4d1b-9058-708eabf2bd9a", "comment": "Malware payload", "value": "e198580b0eec7da7ea4bf4cb39144e8e0dd74382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231899, "uuid": "c11b71bd-696d-4758-afea-ea4e7c4dca0a", "comment": "Malware payload", "value": "0b8534589882154548ef16180ddc3181de80ca397035112e9dc01ddc1b81c10571ae57bd6315d59fa3ae78af05f5459b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231899, "uuid": "c1c1003c-fdf4-4edc-acab-13fc9f34e1de", "value": "T12B652A3815B83E3BE1B9C339DFE4481BE2D5F55B7211AA1670DA13670707A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231899, "uuid": "fc81fa36-097d-4037-a648-56e9ce2d7669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231899, "uuid": "9481bbf6-ac52-4adc-8a2d-70b58117b27c", "value": "24576:JZC3EccWcWzTXl57v27sFnTEdSLX3VykoUbg/VEjUbfquyh:YnxBAdSLlykobVNbfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231899, "uuid": "93a5cfc1-176b-4439-bb52-c7d1a3e4f7a1", "value": 1548800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231899, "uuid": "08bd23ae-3683-4a0b-819e-a719759e415a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231899, "uuid": "a5733958-1207-40b5-80a2-66c3b9170a89", "value": "odeme_kopyasi.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662e6388-fef6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629161979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161979, "uuid": "082dbcf9-c87b-45e7-80e5-5d37c49262fc", "comment": "Malware payload (Dridex)", "value": "3c720e2a319a2e4a854d469147d9de5d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161979, "uuid": "b9a13d49-fccb-4b67-b083-1fcef56574e3", "comment": "Malware payload (Dridex)", "value": "56a8c617c05279b4baf2c15fce7c9538db3d2779411210d33393f2c9706a7d95", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161979, "uuid": "7f035dd4-ec44-41a1-a8dc-a00498b2d542", "comment": "Malware payload (Dridex)", "value": "246023c3d495754f7fe63337203400b1bacbffca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161979, "uuid": "1cd55617-2b8f-46d5-a898-62803fcca93a", "comment": "Malware payload (Dridex)", "value": "c7851b4ac76116113f18daa44534f852b83949f845e0cff9952feb673e616ca8613e2da34d706d345212549eabd7f04c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161979, "uuid": "998fc286-5c85-48fe-b983-04f59c7466a2", "value": "T1E144021BE6A5A943C64CD2F86F0625210B985A01F20BF0CD31725EF76F689FB53D252A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161979, "uuid": "bb7a5c80-6a15-4ee2-a3c5-7112af1dc838", "value": "6144:1ogkLjLhl6S4zavanHGmP6Kx9a9tFkJ3UnZy/nwa:KDLZw+MHGmP6IStapPwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629161979, "uuid": "8af8b21b-955e-448a-b546-8aa6fc159c87", "value": 271717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629161979, "uuid": "c2d21a70-d3f3-47f0-ae63-eb165d4426d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161979, "uuid": "4c2a1195-fdaa-4f07-840a-2533945b474f", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.129921187.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa1384d-ff62-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208595, "uuid": "261b5fa1-252d-4aa0-8eeb-ade045b95a08", "comment": "Malware payload", "value": "0271cabc3078c9484e2042ce1b2d2177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208595, "uuid": "cd7ed263-b3dc-44b9-8210-1f671a32a3fe", "comment": "Malware payload", "value": "57ad16c68a8a35936a578938dfa8b4e24dc248f47d07e865a4b37c5c319d92fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208595, "uuid": "f0aac504-6e92-4a14-a706-e6401f4336be", "comment": "Malware payload", "value": "a965b61724a315a6c65b7f3bf8165c0cc85123f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208595, "uuid": "1039b2d7-486c-4310-8d51-6a93a595727b", "comment": "Malware payload", "value": "90584784d8c892c70108f4989d0843544211095e588822b49e27d98e5beca4818f8a435328d5d3d9e7dfcbf14a890109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208595, "uuid": "c905fd03-9f50-4ba3-a346-c45e8898b331", "value": "T1EFD45B1DBB822690E21E4E37C666129C42F0CD2773B3F3EB55D539F48E7160A6A1F092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208595, "uuid": "bf68f3a6-3b15-4485-b913-26269dc84fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208595, "uuid": "a191f924-62ef-4415-b0be-1d17cca12228", "value": "6144:ePg2aTw6ElQKvzs+BgPC6VAWT0qjt6BWtIc4CGah3GEjN6lyiKDOsvfBUxTrObIt:eN+DctvyC6Vjhmc4cJNSElDbIdWad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208595, "uuid": "308838d7-3eeb-44ec-ba2d-00fc0ca64c11", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208595, "uuid": "0925fabb-36dc-4e81-9511-46f82da04e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208595, "uuid": "c7163957-da65-44f4-acc2-f2f1cb82987c", "value": "Order_No332100818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf5a45-ff05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629168412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168412, "uuid": "16947710-aa76-4129-a29d-fc1db044e4f9", "comment": "Malware payload (Mirai)", "value": "4f955ec66c1ce5a0f68b81074246697a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168412, "uuid": "3fc292a0-6dc9-4238-98b3-8574744acb1c", "comment": "Malware payload (Mirai)", "value": "58c8b6eaf2d90fcbf60b3fdff9436aaa19d77262834ea5a408657a515b225e0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168412, "uuid": "caef9d26-8ad6-4a4d-93c4-5edba6caa311", "comment": "Malware payload (Mirai)", "value": "1990bc7506a432ba2603183eee0cd3c25ec984bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168412, "uuid": "b8ee4071-b0b7-458e-8ab1-833a34840183", "comment": "Malware payload (Mirai)", "value": "7a5ba23906aafa57cd343f5d0d8167eecbc11729931878e7498d215cd8fdc893550f279ae099b0ea0edce38b49b0d170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168412, "uuid": "484854fa-feed-40b1-8c05-4c1e2dcb492a", "value": "T116730682BCD29A16C6E4237AFA6E40CD332563E8D2DF32179D112F0477C992F0DA7656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168412, "uuid": "2a22eadd-fdc3-40e3-8574-2d4614f9ede4", "value": "1536:Phtc23ibFunzQYl6QxRvzVN9UNJBnrm6ohAS4AtbWxXdUf:PhVwFg4Qx5eNJVrmJS0JWxXdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629168412, "uuid": "c0379946-78c2-4dca-b2ba-85d3b76e7d3c", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629168412, "uuid": "a30656cf-6573-4d8f-b0ca-e64426d6cedf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168412, "uuid": "374545fb-ca0c-48c7-92b0-a2dca968d975", "value": "4f955ec66c1ce5a0f68b81074246697a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d582449a-ff3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629191801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191801, "uuid": "8ae24a49-2b01-4c32-89c2-c2afecc76c79", "comment": "Malware payload (SnakeKeylogger)", "value": "3537c998f5d2dfe758f8a0571afbb346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191801, "uuid": "0c3d5f4e-14cb-4825-b710-cd5eece486d0", "comment": "Malware payload (SnakeKeylogger)", "value": "58efcf155dffa076b7a652ff4d52f44fbecf81a8085531be84dfbbf7238021a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191801, "uuid": "539a6d52-ac2b-4a63-8ef9-52ad9e971ea2", "comment": "Malware payload (SnakeKeylogger)", "value": "ef03de778e9c8050724dcbe050316268a1151e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191801, "uuid": "725643ac-73f3-42b3-9e7a-a9d6765e9d33", "comment": "Malware payload (SnakeKeylogger)", "value": "300bbcce2c42d1d7a217c00bb76e620dee57bef4953ecb606d3ca1c039fbbe3a83e1ceff3e4721fcc3bf4021cd062f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191801, "uuid": "2341862d-9818-4ece-8b34-2b1d6058040e", "value": "T1F7C45B243AFA501AF173AFA95BE474969A6FB6333B03E45D1091038B4723E41DED193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191801, "uuid": "8bb4de21-62b5-47e2-aeb5-e7e320178f02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191801, "uuid": "63b9048e-e76b-4a95-9710-39c7df0c772c", "value": "12288:Tj/vdd3HMIGlsutGMbMS2WGKEKUl1eQkunHn24Lc+6q:Tj/v6gaeuuH2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191801, "uuid": "6ab45692-1520-4f5b-8962-fbcfd8b12da9", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191801, "uuid": "1516c7ad-ccd3-4f30-9b86-7d168cc96b96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191801, "uuid": "24cf35df-1a3e-4143-a99f-4f2aee30c38a", "value": "SecuriteInfo.com.Trojan.Inject4.6572.13903.14739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afd2c0c-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209500, "uuid": "e72ca76a-ba04-49ca-883d-b6dd88d6d446", "comment": "Malware payload (AgentTesla)", "value": "3547f812c7e359bf1e1bcd6b61dd99a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209500, "uuid": "0c3a1e81-46b9-423d-bafb-c9dc9ea62c51", "comment": "Malware payload (AgentTesla)", "value": "597292082d54f074dd24cab4485b77dbe395c5c848113876b3344b15f3d1895a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209500, "uuid": "a7ae3587-7205-4127-b140-35bbf18a9ef7", "comment": "Malware payload (AgentTesla)", "value": "ced4003d512eb56dc00d9c330ebd8125537ddea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209500, "uuid": "3bb45a9c-a849-4b69-a6a7-fb266df9e815", "comment": "Malware payload (AgentTesla)", "value": "f14d10d99b8528d6b8cf994bdfdcefbe6b1c7ff459313048c7b1c3888c2a095c9450c81b0d6479773794dfd321b075ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209500, "uuid": "3d91ca02-ac95-4f41-991a-d7e96b78b21d", "value": "T1DB1571391BB92567D065D63EABD18617F00096DF3411AA57A4CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209500, "uuid": "dcd31ce0-6862-417b-9ee0-7cbf359d50f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209500, "uuid": "8b0239f4-9b20-4656-a822-7d58e017cb46", "value": "12288:j0Dc9F3nC0Py3gAhTEJbjJEKlMdtYME6N0Vg0AHzGcqXQ1ejF+Ji7DYP:+Yv6Cejicd1SF+Ji7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209500, "uuid": "ceb4507a-3b8c-44ed-b2f4-8c406debc6d8", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209500, "uuid": "058daaae-397f-402b-846a-c3015670a305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209500, "uuid": "40ff5ab2-873e-40df-a467-09c3db084904", "value": "PAYMENT SWIFT COPY FOR = USD 80,950.25xcod..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432ee0c8-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209165, "uuid": "d3af67a0-e638-4982-a59d-ed0b7a011598", "comment": "Malware payload (Formbook)", "value": "636f6725923d66195860d8cbacf5c7a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209165, "uuid": "827cee1d-3670-47b1-8b35-30fece3d14ae", "comment": "Malware payload (Formbook)", "value": "598a6fc7c9e91a6ce28af2833cb0e6262f28fab605fcd74098fc2edf9510b58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209165, "uuid": "63bab952-f902-4351-9f52-2062415c17c2", "comment": "Malware payload (Formbook)", "value": "77b4ea363795cded71c85c7e7a2eaf9a90465e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209165, "uuid": "7df2bce8-76f2-411c-9d02-25a8ab20234d", "comment": "Malware payload (Formbook)", "value": "02c97d88f88d252f66f258e9008fbcbe4fb984fabb2a4229120dafbbe2686263eb55d26f1537014b1149fa07e2641ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209165, "uuid": "cbca3e0d-854e-415f-aa20-261add4c4501", "value": "T12825503D2FB82567D0A5D63EABD18A27F04096DB34116A5754CA0F67B302AC2F7C722D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209165, "uuid": "4ab523d3-b229-4818-b868-5f498323d62b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209165, "uuid": "9d9e30d2-63d3-49c9-a216-7e89c369c9e2", "value": "12288:LdxhDc9F3nC0Py3gAhGEJbjJEKjuW3iRC/SaNmEZ9Np9uVXp/XiPNzrgG2bZbAQX:xFuKiw/IE/N2VXiPhYaQWM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209165, "uuid": "ba170457-db91-4d29-8b85-7c53d79b891d", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209165, "uuid": "2afd5cb8-014d-44cb-a1fd-03478aaac8bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209165, "uuid": "6465539c-522e-47bd-86bf-e62287279eb4", "value": "Flop doo Zahteva po ponudbi izdelka_465847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66632dcf-ff3c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629192044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192044, "uuid": "3c1d5c64-4d89-49d3-9905-23e9cbb4ff15", "comment": "Malware payload (AgentTesla)", "value": "dd3b642eda31e8b5362b773532559398", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192044, "uuid": "d25adc93-cbe3-4f23-ba5f-8464de3afa62", "comment": "Malware payload (AgentTesla)", "value": "5a5e7d1340f7f0df55e3b9bd4e32a550a7ca937e240d9a3a4e7226fdbfd7b6a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192044, "uuid": "db620e43-6b85-4385-85aa-2c20b5c2f15a", "comment": "Malware payload (AgentTesla)", "value": "831921baf32b8eb98372c15153859a54d103f8ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192044, "uuid": "85f32db2-2370-4c40-9ddd-a74100baf62f", "comment": "Malware payload (AgentTesla)", "value": "6dd4f3b99ad296e6caf4bc2c7d15833f16988b094b6e3ed75f59a9b1c020b67b927b1f841eb11df3296058015ef1afe0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192044, "uuid": "7a88b1d9-23c9-44b1-b27a-06d8143daf87", "value": "T1432560391BB82667C165D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192044, "uuid": "7eccdc31-5886-4521-8c70-d456021c83be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192044, "uuid": "c7b03704-177e-4672-b8a1-9892fd4298ed", "value": "12288:HUb01Wf4USDc9F3nC0Py3gAh0EJbjJEKNbuj5eEnEGp17zYFzkhPsx2uoSwvlqP3:seqdeET17GYhPQLYaDm1bw+p9z83wP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192044, "uuid": "87799690-673d-43e4-8844-a47db98bde90", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192044, "uuid": "872ccf83-a783-4e4d-8c3d-dfeb73b9583b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192044, "uuid": "8d33dda5-2bca-4a89-bbc1-e724366e4cbc", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabb714d-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629209849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209849, "uuid": "0bda05a3-e4c7-4072-819d-83ddc54641f8", "comment": "Malware payload (RedLineStealer)", "value": "8e9c68d087303e53ab7d9ece96cf58fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209849, "uuid": "df4561d9-fab4-429d-98a4-ff4a0ad1517a", "comment": "Malware payload (RedLineStealer)", "value": "5aa693e5b14972624e0adb96ad97a3abf7d48722bf5ff9d2fd95dd2d8801c3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209849, "uuid": "bc3e186d-3176-4cf7-8b3c-add7d1e2bcc7", "comment": "Malware payload (RedLineStealer)", "value": "5ce0e363b165a9b3d8681b9066c5c71b0492a1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209849, "uuid": "4ff2fb69-4084-49ca-8126-55010cba9641", "comment": "Malware payload (RedLineStealer)", "value": "bc982017982185ef23d3a8a596ec69ecc921a8d806a76a039fb150e485fbcbf16caa95cc0ffa08ff3edc428425b00d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209849, "uuid": "df17fd09-7b9f-4705-a06c-fa61b8ea040e", "value": "T12A74BF207690C035E6B711F4987A83BCA438F9715B2841FB62D6E6FE5A34AF89D30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209849, "uuid": "7e6a9473-02df-4b5f-aa50-8a43327d7c64", "value": "3cf7934f6b854bd488143a7d36a97eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209849, "uuid": "9b87868b-43f3-4a18-a941-0bb34776a65b", "value": "6144:RHaeYoD1VqLxP0XbF+Zd3jN70xc5/AF4HWZeZflEc8AtsLtB8MkHV:8et1IxP2FMdTmc54ylJuZGsLtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209849, "uuid": "70198da7-98d5-4c1c-9761-129ae0dd6846", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209849, "uuid": "c3f5377a-5055-4d7f-b9b9-416096e4dd39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209849, "uuid": "88f45fdd-742e-44c1-bda5-08de2fe701cd", "value": "8e9c68d087303e53ab7d9ece96cf58fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7af1e43-ff5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629205575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205575, "uuid": "a47772fc-92b5-4af6-861a-7a6136f99236", "comment": "Malware payload (Formbook)", "value": "5fda850600294bcd9f48f24cec17a28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205575, "uuid": "b6e6cb7e-14f5-4f61-9bb3-7e05a3586af2", "comment": "Malware payload (Formbook)", "value": "5adfadf50a8061e25c5f05d732425164f0e095ada4d8e47531f546dce9f2f3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205575, "uuid": "e3866e36-1d11-4437-9fef-e360d3a770a4", "comment": "Malware payload (Formbook)", "value": "cd051ac80fdfad3af7be6511ef1543e3010573ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205575, "uuid": "4b0071ab-6ec5-41dd-8637-41b80c2c5ac4", "comment": "Malware payload (Formbook)", "value": "6621721583f970c163e0e2c82b4bd97a429757282aae0cfc5d279f6aab4129ca18396354f62410addce2b9660f031cd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205575, "uuid": "84cfcef8-10cf-4008-b188-2d5b78012d62", "value": "T1EB255F381F7821A7D064D23EA7D18617F0419ADF7411AA5764CA2F67B322AC2F7C722D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205575, "uuid": "8351b1d1-08a1-4389-8e26-5aed160df833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205575, "uuid": "e9e63930-c597-4b06-a945-c6d21faa014f", "value": "12288:wj0/Dc9F3nC0Py3gAhoEJbjJEKjmqIMIyGOZi3PxgbfJ2dPFgaCB3KyFEW8xuAye:f2KJ433dPTMKyF2gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205575, "uuid": "fb8cb3d9-3e8e-4dc9-92c1-afb7e3e3da30", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205575, "uuid": "245d6e14-6038-49dc-b80c-e4f116f148a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205575, "uuid": "93bbb20c-03d5-40ba-8a10-6b81f7f154e2", "value": "Scan copy of Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e9c114-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629198915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198915, "uuid": "ce2b2a5c-00c1-4340-9248-a91d88d9662f", "comment": "Malware payload", "value": "44dd47401b94e056b009905fe584806f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198915, "uuid": "aecd67e5-0a88-453e-ab13-c7d621c8ba9a", "comment": "Malware payload", "value": "5af37a183003b4e1632be1b9044163d70c30e1beca6d14d8eaad151d422ae2cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198915, "uuid": "7ac1684c-f799-459f-ac2c-c86053c9f348", "comment": "Malware payload", "value": "a5a0b2a81920c0a255843ee31655643934c1e584", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198915, "uuid": "75695b0a-54c2-4ada-9a46-325b36161606", "comment": "Malware payload", "value": "9480e0096e33cbc6ed8017f3e2d695fdacea9c35b44eba1de6a59fee874982e006c57b212dd4205a88937ddeafd49b79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198915, "uuid": "97c43351-80e1-4c0b-b7d4-2714ba85dd42", "value": "T1AD55E93815F83A3BF179C339DEE5881BE6D4B85F7211AA1A71D613670303642B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198915, "uuid": "175c7202-4e82-4e9f-8926-9b7637dadf8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198915, "uuid": "05bfd04d-b26f-4eaa-8fc7-2bfe3e70b0ea", "value": "24576:DXqNUcucWzb5SroJFnd0oLxNUIMzK+pV64X/rYm0xGM:yUBqoVNczK+a4X/8m0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198915, "uuid": "4843cfa2-4f4c-4f89-8201-4c069a286466", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198915, "uuid": "3f0ad962-88d4-4998-8705-834bab8ca790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198915, "uuid": "d695e140-2d94-49a3-aedd-f6c6f4cb32e4", "value": "44dd47401b94e056b009905fe584806f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd65bc1-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209263, "uuid": "08101668-ee08-4338-8d99-893f472e103a", "comment": "Malware payload (SnakeKeylogger)", "value": "799c3c52ef032c42c3bb3eb8cad03e95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209263, "uuid": "18a28bdf-516e-4635-8549-354a738e785f", "comment": "Malware payload (SnakeKeylogger)", "value": "5cea575dd643a9dce9903eeeecc35685ce60348a1a1c65d6626783976ca14be5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209263, "uuid": "947145d9-0f13-4953-8903-71245466442d", "comment": "Malware payload (SnakeKeylogger)", "value": "ef0327d7575930cc0813da0e61f35ed2d8b2fb54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209263, "uuid": "b06bd86f-af80-4b68-adff-e5ab12b6373a", "comment": "Malware payload (SnakeKeylogger)", "value": "9b6b5a2316f43abeef2fff5b7cc38b86a0815b3d78f415f2a84b686acfb5c6c3920a6eae4666f033e97b39583ea8eb46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209263, "uuid": "4eb4f99b-197e-4ca1-8caa-4348ce2a93fc", "value": "T1BC154E391BB92667D065D63EABD18617F04086DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209263, "uuid": "6e2953ab-4512-4e50-8f73-b714f4bc9a01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209263, "uuid": "a0fca318-f31c-4714-8487-aec9bb5869d5", "value": "12288:CrYODc9F3nC0Py3gAhjEJbjJEKn8jL8CZ9GCfFnhAa9BLLeh/QasrtCjF+Vi:/+jL8CFnhACBLih/1srtWgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209263, "uuid": "3df97d17-efbf-4a6d-8fbf-afdaa28d7b31", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209263, "uuid": "e4966868-d0dd-4635-bd38-5eddf4f88d80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209263, "uuid": "5e26e00c-4565-47ce-92ab-37dbe449cf81", "value": "799c3c52ef032c42c3bb3eb8cad03e95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18ee5e-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209499, "uuid": "9fbd48a1-8a88-4427-aabb-af87e0bea8b2", "comment": "Malware payload (AgentTesla)", "value": "ce25176cb11dd428038e4989a7a77a6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209499, "uuid": "dd4c2f82-0f13-48bf-9269-ef48cccca89c", "comment": "Malware payload (AgentTesla)", "value": "5d1274f29885e1cc6213530308dbb0e0f6d4ea51e004a1ca26f0d00934d0834f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209499, "uuid": "c0bbbe81-1122-4eb5-a993-56330a9bda10", "comment": "Malware payload (AgentTesla)", "value": "4ee0800bc8d4db0a254efc2eac4b5f03005486ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209499, "uuid": "a7b2c6d0-6bef-40fe-b527-dde0e7121a8e", "comment": "Malware payload (AgentTesla)", "value": "d7cec7780fcb36d15db7f8ed40fa77857b22d2f672822d41606813c9e9a75e34afc8947d9f14feaccee2b132a26f3cfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209499, "uuid": "4ecaabfb-7ad8-4636-a9f6-a08909ca1e93", "value": "T15925703C1BB82667D065D63EABD18617F04096DB3411AA5764CA0FA7B306AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209499, "uuid": "3ba0fc61-f3a8-41d6-8189-10563244afba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209499, "uuid": "b1cc9bfb-538b-4ea8-baa3-f634a24aab0c", "value": "12288:VV5Dc9F3nC0Py3gAh3EJbjJEKjG5JSQmO4UKaiFlQZ6IgmsvPprkp9WomzigXGlZ:zcoQZIgmsXpMWfi/l/NIe0h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209499, "uuid": "02edc5a0-2ce3-4bf4-8692-45d4b5edd52c", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209499, "uuid": "48c14974-78ad-4f11-94e8-b27df0d72e36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209499, "uuid": "9a98b6a0-0639-4126-9075-1e08064bcfb5", "value": "PO#4895738-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bb7bed-ff9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629234590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234590, "uuid": "94bd0a20-438a-4b8c-95c2-8bc50b5cbf99", "comment": "Malware payload", "value": "7fb6c67fda7d7d48129628f239b0b6b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234590, "uuid": "4cd7793e-ba36-45e0-af3d-bca680c8c6e6", "comment": "Malware payload", "value": "5daf51aa6e48ddeb2b81220e9d12f788815c756a2af1dc22497df88f592689d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234590, "uuid": "e7ce428f-16d8-4d06-ae09-99122075ace9", "comment": "Malware payload", "value": "84c1e650ad5dc57607fde22971287d53d0dac6ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234590, "uuid": "38bcb371-71b8-464e-9d38-08b91a2846bd", "comment": "Malware payload", "value": "6f598771fe0f0a31bdf10f58954a3ce0a4cda591e5945caed48f8da1ea12e4ea8e6937f6c4bdf7397d09268d08d047b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234590, "uuid": "0987fbf2-26dc-4496-bfc7-0570be483d60", "value": "T184F2E092838104F496922EF2C8BDF247F1474F38E4E9623D2A6096F4B9B74174CEE653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234590, "uuid": "0987e540-af99-474b-b469-d8f2f9cacb78", "value": "768:WrmQQXodwHN3dZR7/Zh6HBlJJzRaZHdF0emmQepGZ3Ue:UmQQE6jn/Z8nb9aZHdF0bmBpGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629234590, "uuid": "38d8ea84-1bb8-40fe-8a03-efaef70f381c", "value": 34928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629234590, "uuid": "7a931468-9d32-4408-b50f-18f4b7499ef7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234590, "uuid": "ad77d812-a0c6-4f8e-9838-e12dcea4190f", "value": "7fb6c67fda7d7d48129628f239b0b6b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebe3e2e-ff71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629214929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629214929, "uuid": "704f9242-f3cf-4ca4-9126-902b41b15eb7", "comment": "Malware payload (AgentTesla)", "value": "05b583dcfae0cae137024e57541d3642", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629214929, "uuid": "dd677b3f-fbd9-4bac-bb0f-cf3402862556", "comment": "Malware payload (AgentTesla)", "value": "5dd84f1b06035d821efa70ac5fc4348df6c39b31e1557841fecadb478264bce5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629214929, "uuid": "39117109-59bd-4774-b9ca-00666bc6888d", "comment": "Malware payload (AgentTesla)", "value": "d75378a4aa4200add446c18c1aaccfbb48b4f0f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629214929, "uuid": "b0da49b1-96ec-42d6-b52e-b58c2d7cd663", "comment": "Malware payload (AgentTesla)", "value": "b759839f0ffe5572d627c1e01a1fdbc5a9a4fc9c3058a6269dd40e7527c759be6a5634af017ece06917a498bccf16bde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629214929, "uuid": "77f88b32-0177-4fb6-a8b3-84c4ea8c0f2a", "value": "T179B47A3915F89227E136C37495580346E3F1ADD2FCD8D927F8D3648A98722E62984B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629214929, "uuid": "3b42e76f-1816-477a-bbb8-ddea4cd46a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629214929, "uuid": "ba950712-78ed-4bc8-8e2d-3185622e8292", "value": "6144:R2QJJ9J9aW5H8hxlYni5kaa5G61zdkj+G403wYlgUvqtKS3fRAF7:RZMm8hxv5a9dhPDYlgUvq8iRAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629214929, "uuid": "d5e294de-a992-4f94-a511-9585c7392c3b", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629214929, "uuid": "607784ec-c0f1-4955-b902-e0b7eb09724e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629214929, "uuid": "39b08014-133e-4c2e-9720-dd825371132c", "value": "SecuriteInfo.com.Variant.Bulz.612553.16549.15256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76865cf-ff2d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629185818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185818, "uuid": "e2e56cce-6acf-4686-9e03-3082540a36a2", "comment": "Malware payload (Loki)", "value": "7cf69ae411c970a920a1b31ba4b97c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185818, "uuid": "73c7615e-8568-47a4-8cb9-9b0dd224fbd4", "comment": "Malware payload (Loki)", "value": "5e351f6e3fab38ce9b8d0bb05b2abee98c1e00d8a7632c8ca36fb4c6992dbd0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185818, "uuid": "3e87ce8d-36a9-4e5f-9b8a-a07f063c5ebe", "comment": "Malware payload (Loki)", "value": "8b67e9dbd263e035aa023881412f3f92b0aa6876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185818, "uuid": "cabd7f7d-f4b2-431d-a68a-fe1eab4e4f3e", "comment": "Malware payload (Loki)", "value": "b766db3a3ca0b19ef7eb6be2fe62ffca1a11146bd22d5fa2d7a5b85b1d27dec1e47b2696f59a1f2960703b72e228628a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185818, "uuid": "4163c110-22a1-4464-b66e-1ebbe5205471", "value": "T18955E83816B43A37F179C339DEE4481BF6D4B55BB215AA1A71DE13670243A03B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185818, "uuid": "cd4b1cce-302b-47f1-a3b5-f87b0c42bce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185818, "uuid": "10877bf4-7ee5-4d26-95d7-cde984886b00", "value": "24576:ksl6gwc6cWz2+GeMQcFnA3x2FMVrz7QDVNVZ7AVGvqfN3sr:8V2B8xyMVklZ0Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185818, "uuid": "0a6fee9b-9559-4f1c-8901-6bdface81009", "value": 1290752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185818, "uuid": "d90d7b46-5f49-4299-b31f-626571ba6dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185818, "uuid": "12d40d88-1b38-41d6-ba7d-531b056ee494", "value": "7cf69ae411c970a920a1b31ba4b97c2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf48f820-ff49-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629197777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197777, "uuid": "a2048302-790a-4825-b56a-cf6db7c3cb3c", "comment": "Malware payload", "value": "1f768073a7dacdf455b9562baf21d62a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197777, "uuid": "fb149abd-00e8-4398-956c-bb261b9bef7f", "comment": "Malware payload", "value": "5f678696f1d065b9c0beb9be0c8e1c22ba56ca12a9b83d92f35b9e6090cca0ad", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197777, "uuid": "e52c11b8-34a3-41e8-8861-a3863f134213", "comment": "Malware payload", "value": "797594481877f46e5ec5aa189bcb44222ef02134", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197777, "uuid": "1e7358cf-0f61-4712-ba11-d5dd3ecba6e0", "comment": "Malware payload", "value": "3fa565eb10a9f7a53b2cdba8ea5d49fff10ba9a5da78394f17e6032486d7b5c9ce17766591c3dc9fd929bfb1831b7b26", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197777, "uuid": "f102bf0f-f85c-4ef8-9c43-51d2bec46f34", "value": "T17405332E650EC5EDE788161252AB20717E49F1C6033914F75276E231BEEDBC3CE58A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197777, "uuid": "69f1fc0d-4d3d-402e-be93-b3c11a580139", "value": "24576:mluUHQQI86I++qXy1Dth3g9nc0j1Ql5PBpe:KuUwQIRIbqXy1DtaCS+5Zpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629197777, "uuid": "096392f8-429a-4b18-971b-a70c78a13995", "value": 810399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629197777, "uuid": "973fda02-1d62-4baf-873f-90077d786ee9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197777, "uuid": "97a1b445-8d50-4aac-94d2-a89ca679998f", "value": "ORDER PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afa2d32-ff99-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629231888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231888, "uuid": "5a6c4443-13fd-4a56-afd1-7c764804b701", "comment": "Malware payload", "value": "1fcd636e12d26504bd65db1731991314", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231888, "uuid": "5ffaedc0-4505-4bd5-8256-edd47d8e82e6", "comment": "Malware payload", "value": "5fba9f2ac4b7189e71e023bd51b04d109c0df85e352b5eae187183149b74b455", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231888, "uuid": "95fb891e-f182-48dc-963a-685106a23fde", "comment": "Malware payload", "value": "157104a02e81905b87aa4ceffe3edadb198fa965", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231888, "uuid": "f91ae73c-0ef2-4f9a-86e4-6a31928289a4", "comment": "Malware payload", "value": "c1c121a0308d37ef8d8d60d0a3c536181403cd762e55bb270c2c6b4b0aa9182098babe762a40dc0e673e24acfe48a140", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231888, "uuid": "a40aabc4-d5b3-4878-8580-87a9678f6a26", "value": "T1BA840714157B180B50E3DB795CCCD4FAE98EA163272F36320261E7AB674DE20DD0B7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231888, "uuid": "f7180574-8373-44db-91d5-933ff224dfaf", "value": "3072:NUV8vEeUcIYzCg1APIx1IWy0iwMCngbV7lZaIiuvWlCIY+MtjrNF+tv4EcoSx:lIYDZ1owZgbVGlC0DvBcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231888, "uuid": "7ba740ee-ea03-4f9d-b86f-441f67f16ae5", "value": 400146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231888, "uuid": "ebb1b0fd-9703-46c9-93ae-1850398a9138", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231888, "uuid": "b5f09670-b4d2-49af-a6b6-cc3d70cab127", "value": "inv-km7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d465cd-ff75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629216365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629216365, "uuid": "91b0796a-5062-4ad6-aefe-b09d32ab6d11", "comment": "Malware payload (BitRAT)", "value": "00094ef2636275cdd3e022941bd57230", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629216365, "uuid": "24c76ebb-cc3f-42e5-a30c-94953fda12c2", "comment": "Malware payload (BitRAT)", "value": "5fe8ce1e015ec5141541e626be8530a3b6e59cb347e7ffe62639be9fecd9b0e3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629216365, "uuid": "d192573e-707c-442d-a1bb-2d6d42d067b3", "comment": "Malware payload (BitRAT)", "value": "4934301ca4b4b7e49702ca3214b6afad00ba0b10", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629216365, "uuid": "cbc813be-8399-417e-ae19-19d486a4fb59", "comment": "Malware payload (BitRAT)", "value": "eed4cc30ded729c34dabaf1315fb4e574675e67633fb6c2a0d9c3268b50359fbd9d8142f7abb6bc3edf09336805f43c2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629216365, "uuid": "a16ef9d5-05cd-4589-84e7-b53c23d9cf33", "value": "T1DB053B2FAFB20C72D85A167B9F516629BD367E41287834871FE5F8C3DF356822016287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629216365, "uuid": "e96bd411-9493-41e1-a5ef-751aa34454ae", "value": "4474eef8942642f5a5e4f27d086a72ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629216365, "uuid": "f83957cf-f7bf-4e56-b2eb-4f61983c8292", "value": "12288:MGktoHAF1IE4LIeCTZjTgo4WYBJBqryw747zHK5rs:MGvgnINIvHnIyOt7zHK5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629216365, "uuid": "7a82090e-8402-46b6-a2f5-25d1a2311a7e", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629216365, "uuid": "6ba9fde1-d07d-433b-bf26-29b98a961ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629216365, "uuid": "f9a0e9fb-9624-4e0c-a620-e0a82fe9de3f", "value": "Iplkfdaqlitmstdmpwpnxrmfkaoulxgrmn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994d40b5-ff1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629177956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177956, "uuid": "38df4490-54ec-4e8f-b0e5-96282d2263ca", "comment": "Malware payload", "value": "482281cf2fa535e4e8eb06413f6de307", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpenCandy", "colour": "#F00565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177956, "uuid": "79973af9-f5f8-44b5-afdb-866486b72a85", "comment": "Malware payload", "value": "600408029d622447c7bab40a0de9c67b35037fa1c0fa69b7f24e06f8f75ef181", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpenCandy", "colour": "#F00565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177956, "uuid": "53fb7faf-00f6-44ef-8678-c2f75053f191", "comment": "Malware payload", "value": "bd3d451bfb56b02edd3d2d1fea10e29ec94f1a8c", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpenCandy", "colour": "#F00565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177956, "uuid": "0bd721da-06d0-4bb3-8a52-19ad8bd5bec0", "comment": "Malware payload", "value": "f6068077971c768250f0b6cb0b830cffa5476d6cafedcb464100c1f5c1c0b06ff25ca4d124cb17d1e0768bad5482298f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpenCandy", "colour": "#F00565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177956, "uuid": "2276919f-160e-4211-994f-611e398cd1c2", "value": "T1E7763307B4CD86DCFC343DB97C2653521B79F4E47C651F497720A83BF12A06AAC0A9A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177956, "uuid": "65310df5-b99c-48af-8c8e-2200b39296ef", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177956, "uuid": "78e23f6c-d541-456d-bf5b-9076c0b5697e", "value": "196608:ZqOAaDOa1iWGHNgJheMwSi6PVpeOZgE0E:ZqOlbRL2+iIZ0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629177956, "uuid": "4f186083-0116-482d-8d04-84920567014d", "value": 7549704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629177956, "uuid": "f294496f-61b5-45f2-9f9a-301500db8733", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177956, "uuid": "6734ed30-d39f-43fb-bf1f-ea6f74fde246", "value": "InternationalPrimoPDF_V5_1_0_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6bce05-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209078, "uuid": "ae89d410-754c-46d7-ae78-080eda10126e", "comment": "Malware payload", "value": "e21df63fb536fb7341fe5238085615f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209078, "uuid": "4215099a-78ab-4b85-9f13-19c50fa21f85", "comment": "Malware payload", "value": "607fff75bfdbbd040ba45f31197005023d9ced412baeb61387d89c1ba8251c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209078, "uuid": "754adbe4-b02b-4b7a-ba6e-aaf18c9d1759", "comment": "Malware payload", "value": "dcb8bab6dabcbf6ac60f6456ae6ef504c03db11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209078, "uuid": "6033f8ff-6c1e-4682-8405-a465177c947e", "comment": "Malware payload", "value": "bfaaf5e24a33242d3a3d6e33476abe8b8aea5f2c975bcf1f56d67fc0c25bae5f61ad6365343bc72ad0fa677855d089fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209078, "uuid": "f26c8e86-90d0-42a6-9c98-fab320541a1b", "value": "T160550B3815B83A3BF17AC339DEE4581BF6D4B45B7211AA1A70D613671703A02F99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209078, "uuid": "6d1a8abb-b336-4031-a58c-5c8a3d3a70df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209078, "uuid": "814c0cb2-ecd7-4532-81b1-cb1e355c640b", "value": "24576:bzelQcacWzmfqr4NrXFnugk4Ca7NSuoxN0HiXhtoqnto:4q8XB7kI7NS3T7KEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209078, "uuid": "243d027c-e424-4052-9195-37fdf6178b32", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209078, "uuid": "7a5143a8-7935-43cd-ad0f-1aabfdec5d20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209078, "uuid": "5d768b62-0b6b-43a0-a797-1564b7e529e9", "value": "MACHINE PO VM1721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114f6463-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629206934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206934, "uuid": "166e6015-f402-4221-970d-0ea688fca110", "comment": "Malware payload (Formbook)", "value": "7ef428aab4239b02d4d19bc53813f5b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206934, "uuid": "424bd234-585c-4ce0-b311-2627a1678451", "comment": "Malware payload (Formbook)", "value": "613f284287a3f7c7c5982a1f88315ac65c4be9828a2382cdaf4920a0cb5bcd2a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206934, "uuid": "e9ecee4e-79d5-4e09-81c9-3971be8bc990", "comment": "Malware payload (Formbook)", "value": "dcb1c5f74ab5812413300d7bf0bfb537423bec0e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206934, "uuid": "7ae68cc3-fdbc-44af-afdd-c58cdbd505b0", "comment": "Malware payload (Formbook)", "value": "e589748bb3f8ac192fc4267ffb67e877e68c0a829d04206ea1f7cd0d4568089777ba3ef2cf3947d20edbbc7b2f00debe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206934, "uuid": "2c3fd6e4-96fa-49d0-90db-b3311d25414e", "value": "T187451239D9268FBBEA7C1930CC1F4B943D277F735650541723EE39812BB262235E6A24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206934, "uuid": "c64713a6-6458-43c6-821e-38c3e598d110", "value": "24576:kBlj0QSNrTsRBiVEEm2NPyHz0JAt7QGg+iDIIZhNPWwXOwdW:QlurTsRBijxNaFNgjNPWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206934, "uuid": "2e86e900-1cc2-47e0-8a56-2ae0cda6b785", "value": 1258904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206934, "uuid": "4893b441-8246-4d26-88b3-0cebd94a06e6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206934, "uuid": "3bffab5f-1c36-4063-ac3d-ff51fc626a86", "value": "PO20210817.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e9beaa-ff9c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629233218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629233218, "uuid": "08630590-f965-4225-8a86-5c056c652233", "comment": "Malware payload", "value": "9a0e300d177a176d9894a620d1756f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629233218, "uuid": "b47c2316-8008-4846-86c0-56177cac76bc", "comment": "Malware payload", "value": "627219a8c4acc280da7a247fe4a6eb5f10e38a0f96bb31e11b6b22d0e616cc0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629233218, "uuid": "84407149-8edc-4dd8-8a9a-2faecacfb6e3", "comment": "Malware payload", "value": "e4d832b6a14322557d33f7d44827c20593a2a98b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629233218, "uuid": "8707be66-1d79-4b45-8456-e25bb65283aa", "comment": "Malware payload", "value": "8794573d6feb9eec5deb2433e088d0b101a67332b5cf7986ad0326ff66b9093c8bdc5b910f4e1a86b80a1f1be81cb53f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629233218, "uuid": "83183c9a-5399-4763-9db8-544b36c33755", "value": "T19D9412D2CCF81363F3B5D0FC10C77A06171BA11A56A72ACBB666967357D48C9CD2A388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629233218, "uuid": "6af57fb0-7715-46ce-ae85-be076befe61e", "value": "fb02ac9dfcddded46cefd8538bdd8826", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629233218, "uuid": "4de3a388-1f25-4769-b20a-b7366479bf3f", "value": "12288:PJuqvXKzN9qTaxt5sQ7zkvbDcwFQXChsi1Pas9H+:Ruqvshj7zybOXCsxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629233218, "uuid": "7f4cc24a-03d0-44fb-a238-28696853cabd", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629233218, "uuid": "7602312f-9e90-4879-a3fe-fb3d162b928c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629233218, "uuid": "08a9004e-b7f8-4229-a7ee-6b39db60cf21", "value": "627219a8c4acc280da7a247fe4a6eb5f10e38a0f96bb31e11b6b22d0e616cc0e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b0e59e-fef3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629160925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160925, "uuid": "5442eff0-774c-43ae-900b-d46facbdf8dd", "comment": "Malware payload (Dridex)", "value": "bf42bf320260f0904ab128a2458bf063", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160925, "uuid": "c0be5011-74c1-4017-9bf2-d535c759fafd", "comment": "Malware payload (Dridex)", "value": "62971be564f3e13cbdbb1215e1baa930d812233cf32f8db12aa2ceb1f211418d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160925, "uuid": "56857870-ec5c-4611-89e9-db66cd1d72ca", "comment": "Malware payload (Dridex)", "value": "0309867e0a70dda24cd912be7bdb369938fcce04", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160925, "uuid": "044b9592-0a2b-433e-9d7b-6970fd66a4ed", "comment": "Malware payload (Dridex)", "value": "c7f7d59899d0bd82b07c2422b2ecec35795ec3270002deac4a3dc26d5f51c76deeb5c41a09a980511a7b5d8a2966ab0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160925, "uuid": "e0ec1453-bde8-4976-a3b6-615ab556a49a", "value": "T13F14F12BC9446C17C51CD2FABE47367113855306A309B0CEACB27F6EAB5CB7207E1969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160925, "uuid": "96d4cd4c-a27b-4db6-91c9-21b5083de39d", "value": "6144:LogkLjLhv5I33R3w6hPZC7KVuWvGceKli:kDLZva33RgoPzV0qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629160925, "uuid": "b41d9239-37ac-44ff-9fbc-4e770789732f", "value": 198195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629160925, "uuid": "b34c7846-1bdc-4cbe-823c-77597b8989c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160925, "uuid": "106a4dcb-fb65-4f74-8606-7d2c1788b9ce", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.336903315.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57b6fc1-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190539, "uuid": "570ff265-f015-46d2-af4a-302fa8f55024", "comment": "Malware payload", "value": "f10e5a2c0df8d7094d977c5bdbd481a2", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190539, "uuid": "5447bdb3-f213-4669-b60e-bbbcb99f575f", "comment": "Malware payload", "value": "62fd03661ed7ec3a6974540700fb90fe9751567a25522ba4ba2b9d72b2468392", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190539, "uuid": "6510754e-80f9-4ee5-b57e-0456d5823744", "comment": "Malware payload", "value": "998996e2b8b5fbd831800e9a8f45393754b86b2a", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190539, "uuid": "1340feb6-e435-4d7b-878d-a8b048617a4f", "comment": "Malware payload", "value": "a5332fbc551ba9de7a1e0a17b04c4b83ec01b6a162c6c72d1d6732c10446d706cc25b734241bce595ec7ec06cfbdeb47", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190539, "uuid": "8904998e-76d9-42aa-9be4-8a835a41d97f", "value": "T14361C0932151B9EA414287BF3E596BF6807FC224A14A6044F78C5F5DF9DDE233A8D2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190539, "uuid": "caba7c29-38e4-4e2f-af55-4c936527a428", "value": "96:MGT8gX/HuSnW1jgCfBZL0H+mAiBrVMlNs:RHX8xKH+mAiBrVWNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190539, "uuid": "f11cd510-3d16-477c-b77d-aec2a63a071a", "value": 3242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190539, "uuid": "d9e298f3-53f4-4c50-b08f-0437e5340112", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190539, "uuid": "91914c53-3fd9-4dab-811e-d36b57265f63", "value": "PR1jnGXJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494804b8-ffb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629243105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243105, "uuid": "60a619a5-428c-4b33-a719-f8118ba73c8c", "comment": "Malware payload", "value": "4461412acfc3988974355d4c1601d3f6", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243105, "uuid": "04e6aa58-26ce-4c75-8505-c8685492ebc2", "comment": "Malware payload", "value": "63ca532a13ff909b4b7f72b9a094fa3fc59713984f645664c95a66f14be5f96a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243105, "uuid": "a99ab494-e87a-4c4c-8961-3202ca004d61", "comment": "Malware payload", "value": "33596fbe26e556bb2610739f070b66a2cf532eda", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243105, "uuid": "e85fa65e-94e2-4d59-9e95-36c974805f8d", "comment": "Malware payload", "value": "304115c758244ca546ea7d068d2417b7129a4f23244e0e2865f47cbda4330497a58df513e02a8ebc6f53227e6ca7c82f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243105, "uuid": "ff88674e-52da-45ce-9b19-0773516fc078", "value": "T189744B11AFA8C22BE5BF1775E4B302004BF5F486E5A7E74F998495D82C63304AD2636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243105, "uuid": "7d4cde25-fcbe-4341-bba9-6e16c1fe93ff", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243105, "uuid": "a1926841-6108-4986-88fa-ad1087decd74", "value": "6144:hriB7SfWB2tf3s+e2zelp2UXkGTQ/SBgE6Fi:2H2zkIGTQ6BgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629243105, "uuid": "638407f8-bb03-434f-b168-c86ad8ec9cb7", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629243105, "uuid": "906edff0-5570-4883-9807-db2331013e79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243105, "uuid": "f95220b1-3236-4e7c-8ea2-cabdd718afec", "value": "pay.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54953eac-ff42-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629194591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194591, "uuid": "7e98b146-1c12-4212-8443-5cf5e90aeb4a", "comment": "Malware payload (RedLineStealer)", "value": "8c69181e218d120c2222c285f73f3434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194591, "uuid": "d5c1f447-fda6-4aa9-bef8-68017f454210", "comment": "Malware payload (RedLineStealer)", "value": "646492cdcf4be74a0bae1711eb6902d8d2cc887519fe26c6bd7a84f3387d4a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194591, "uuid": "9ec20c98-327d-48f1-ab99-6ced3808c747", "comment": "Malware payload (RedLineStealer)", "value": "f6d61590fcc225b16dae79d689bb2d73c27f49f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194591, "uuid": "1964503a-4b10-44f1-8b0a-d82a569c7499", "comment": "Malware payload (RedLineStealer)", "value": "f1b30a12881dce621f4e80c76d01f98f4a5caa6c17473e382965d3e0b628403079d4fb325057095bc57d20decc47a680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194591, "uuid": "ac4dc991-d05d-4319-a544-104cbde3977e", "value": "T120E52242B3D58131F9BA0236D4EB05100E716D9D55F2D21F1EB0EB4E2973A926C37BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194591, "uuid": "b0b67af7-3540-47c0-97ea-22094fe864fe", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194591, "uuid": "af977ed8-8743-4171-82e7-9d2bc9754469", "value": "98304:RQ8xJ9f7O1TUbzNXGGDamN1+Wma1v1WXnc:RQkJ9zFB/N17gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629194591, "uuid": "f654bbbb-6057-40cc-a8d8-2cf4daaf0313", "value": 3276200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629194591, "uuid": "c49d97ac-fb70-40ce-b753-47eb8818fc37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194591, "uuid": "203737a1-f6d8-4e0b-b219-5d0c83c5201f", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.2213.12376.25059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905cd6c0-ff54-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629202422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202422, "uuid": "00cde3f3-ba6d-4672-a411-44f24111605c", "comment": "Malware payload (Dridex)", "value": "485a2dc5d5555c4af8f697729696c12d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202422, "uuid": "3ed23fc8-5ec8-4d36-9ff2-ade5037fcece", "comment": "Malware payload (Dridex)", "value": "65b61737b045ad509e941f3cac0c14769790d68f84aa84e7fd732a83e4547869", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202422, "uuid": "04d1fdc6-f92a-43f1-af50-cbcf7550b7fe", "comment": "Malware payload (Dridex)", "value": "282bef1e21544796e7e62fe725719cadc7bbfd6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629202422, "uuid": "f4c1abe8-b5ef-46a1-9f0d-fb36d52c55ec", "comment": "Malware payload (Dridex)", "value": "4aace6c56a0548796beb49533393d498724d672c0b9389f9dd2d2701a449cca997a64f00ad55b0fd167422dde7aff232", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202422, "uuid": "f5ae3456-1280-4534-b75c-b0c9789c066e", "value": "T191140227DA889913E34CD7FD3F1B2E60138A5A46E309B1CD19B13E791E197621BF540E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202422, "uuid": "6fad8af5-b0cf-4773-9134-467c132d0266", "value": "3072:wJ/ogkBdPxNLhUhEc+mL/o+iibLtEJA8oeFw+CD5BnUrixWsT4OqZ9+YfVKtbFos:uogkLjLhUhEPmL/NfFXey3u+xoCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629202422, "uuid": "0a4dd96f-088a-4695-8026-6874025bdee1", "value": 204825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629202422, "uuid": "168608a3-e2a2-4114-8bd2-cb88aafd59f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629202422, "uuid": "f65ee037-ec17-48c8-8f41-40abcd93313d", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.65262571.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177f6be5-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209521, "uuid": "7d340de8-7a49-4375-a6ce-ee41e1c41b05", "comment": "Malware payload", "value": "67e35ba1e64e085fe1226951b88517dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209521, "uuid": "bdb0dc33-213a-495c-a1c7-cd1f2a76d0c1", "comment": "Malware payload", "value": "65eeb38ef21735b46b448ba2359cdf12a9f5041e8f0df7385f63be59760bc645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209521, "uuid": "13502fd3-8ed3-4fe0-be04-91b0f5d14798", "comment": "Malware payload", "value": "42252dafdea79b21ff6385715b66fe23ef82680f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209521, "uuid": "bedd24d9-f1a8-479d-aa78-4c259be3be7c", "comment": "Malware payload", "value": "6d06e8029141469c1add1bc16a1bb481d3636d61367ecec7ba309051ddedfc301cbada4e51c542a8f9bd5de2103b6360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209521, "uuid": "ba622e33-b829-4e6c-ad0a-7eade5e338ed", "value": "T1A9E4232453A25E3BD5EEDB72795D00CBD6603E53D407BA8A3C2533CB2DBB34987A4A00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209521, "uuid": "fcfd2358-9196-40b2-9ef0-aa3d17af4e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209521, "uuid": "3b360803-1764-4473-8182-88b066344d67", "value": "12288:1gTXomEQUwTNl1v3iWo6GPU5WJg7MPW/hrJAmNZ5DD1ovdmKNxQVvnKb0u:1KE2pzXo6GJw9/h1AmNzRoEKnQBKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209521, "uuid": "49e62dd5-98c1-446f-bb95-9bc4f99528fc", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209521, "uuid": "774639f6-94ea-4134-b511-2dded99fc2e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209521, "uuid": "39098f5c-1151-472e-869e-3b1023025b00", "value": "New_Request_800454000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317c6552-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209135, "uuid": "bab5e036-e15f-4ec7-b200-df2bf4c2a958", "comment": "Malware payload", "value": "132d6a8d7b4b3f1f7fb968fc2191b7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209135, "uuid": "98686cd6-b951-48cb-92a4-f7c94328908f", "comment": "Malware payload", "value": "67b7d1b716b45d197d6eb32b9af959556b31ddfc359d3896721ef9b4e90f6a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209135, "uuid": "e265a32c-f213-4725-91f1-7341b652312e", "comment": "Malware payload", "value": "1c9e3d4e4a7bc2fd4cba92ad3777f213a92041b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209135, "uuid": "8e4e038a-d50e-4bdf-ab6d-b1317dbd408d", "comment": "Malware payload", "value": "f088372cfb8704628ee79b39c036403336758f3f9631a37fab094acd62362e6dde125cb7ddb5536a59ec659f0288be10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209135, "uuid": "9757167b-4452-40de-8ee6-a0cf8171a4e9", "value": "T10A45D8381578793BE17DC739DEE4481BE6D8B49B7211AA1670DA13770703A02B9933BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209135, "uuid": "9f1c3ee4-250f-4256-a89f-29f421ddb8c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209135, "uuid": "c6d10e2f-571e-4c6b-b7a8-a1fd9047fe94", "value": "24576:qn2Q9WcEc+zbU6e/17qFnDqrsyf3yXC5hxG:qQe9qBMfGC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209135, "uuid": "0fa34d47-88fa-4899-9528-e1773d188057", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209135, "uuid": "07a9c2e5-d646-4b74-bc0b-3b886d4cb90a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209135, "uuid": "5b016b8a-18e1-495d-8327-c2ac0194f70a", "value": "Aditi Tiwari-Resume.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73347c67-ff56-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629203233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203233, "uuid": "f3148d45-424f-46f8-81a8-b41bb469f426", "comment": "Malware payload (RemcosRAT)", "value": "bad9f49b9b13a16bac81b0202d5b6428", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203233, "uuid": "beef3996-7058-4720-8355-0db972edcafa", "comment": "Malware payload (RemcosRAT)", "value": "692210c1bf6bc19e5ed9866f1962285b50e625ba83d6f821c94320633c18806c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203233, "uuid": "763868c7-b646-44db-9706-14566196f355", "comment": "Malware payload (RemcosRAT)", "value": "d317f91f447e43bd30eea55e5cacc8b5a79f619f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203233, "uuid": "44284b5f-8f3a-44bc-89a8-fedd6587c420", "comment": "Malware payload (RemcosRAT)", "value": "9d0d099fc51dba6b4e74ab4294d2024a6f87aac209fc826558a2eef012f6422285d2783d91c597317ea191c82538424b", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203233, "uuid": "3196b611-4861-43be-a586-595beba24058", "value": "T1BD359D52E4924D39D53B5F395C5B332C5D2A3E882F6AB88DE6A97C8D1F376023C15883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203233, "uuid": "6b9bfc83-b2bf-472a-9d51-c9cf7bb6c175", "value": "12288:SxzeMOlDHVhjdNe1qKG8st38PvKsek4rPzfpYTAWNFzJCfUGQZxEb8+KLxCWBPbV:SIMUhj/LtGVriCTLNFzvGVb8+axb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629203233, "uuid": "59c29f6e-1275-4502-9672-903b892cbdf8", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629203233, "uuid": "e171021f-3a6e-43fc-b291-cb5d40de314d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203233, "uuid": "01a7051c-665c-45ff-973d-c8b8a1906d91", "value": "Angebotsanfrage - Order-00132E,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb4d183-ff99-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629231916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231916, "uuid": "8ece0614-f850-4700-aa3b-3eec291b94b9", "comment": "Malware payload (NanoCore)", "value": "f439ba7e42c8f643adcbe72a3c744054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231916, "uuid": "91d8b43b-b1be-44de-918c-130a339a1d86", "comment": "Malware payload (NanoCore)", "value": "6a7045cccb222af55aa8425e4ed2e03702be0330f1694558385941463cde98b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231916, "uuid": "1636ac86-2220-451d-af57-d44ae93b064e", "comment": "Malware payload (NanoCore)", "value": "c8d58396ce49078d5c5d5b0511ee132480404d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231916, "uuid": "ff091836-72a6-4e00-b200-a9d81f69ee02", "comment": "Malware payload (NanoCore)", "value": "4275fe4c6b4cc12eeaa612926bcbb643e175c90e2916e682cf1e2e37bb52fc81c8d65b57f7af29a47f68c69eb8c170da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231916, "uuid": "9ed647d6-b516-407e-bb4b-8f9a65dce614", "value": "T13A25803D1BB925A7D065C63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231916, "uuid": "10d5a504-7bc2-4a18-958b-518d3fb98ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231916, "uuid": "472c9a9b-9b0d-4836-8bd5-7ea7946d54c8", "value": "12288:gtl9Dc9F3nC0Py3gAh1EJbjJEKcMU/H6OZE1eWmDF/akh0hefrgHvDkUx5skTX8P:MMUP6mE12hCu0he0PAc/TDxqMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231916, "uuid": "6978106a-c44d-4371-aa79-0dfa3fc0651c", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231916, "uuid": "54ce3c08-2206-405e-bea2-9997611428c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231916, "uuid": "c13636ba-2b9b-4cb0-81b1-3cf908f962d5", "value": "Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1247f10-ff37-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190076, "uuid": "dc0adb66-7599-4ecb-8d18-e364db910dda", "comment": "Malware payload", "value": "4d3c72f041892712bd88865c40ae41ec", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190076, "uuid": "b91a0c13-2bf0-4f4f-bfea-8efd27ccaf37", "comment": "Malware payload", "value": "6a927471061f1aab7dcc61f9743f845438f09c3dfd5b2bcf458417bc2d15b864", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190076, "uuid": "bdceee08-b4a2-4dad-99c6-4ef8df8522a5", "comment": "Malware payload", "value": "f33b5a79d6e1fafa451676efff54064d35857316", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190076, "uuid": "f79af13c-b1ff-4abf-b7c5-d8209d22ce6c", "comment": "Malware payload", "value": "ff0540d714f4d27a6e29ba37c6a94687c31d2e36c514886c265ec6b8b57e6c4bc4e937c7146033632fbb74274fed6baa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190076, "uuid": "bbe59cd5-acfe-47e1-881c-98822f6614b1", "value": "T113911B206274690AEC23C5F5DA31FE5604DAF290E6CBE7C2B36EF9B60363B027D61505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190076, "uuid": "4db6de52-6923-4484-8e5e-91f244533c14", "value": "96:h8r/nUYppOicmwvBZRX0tO7bMNFo+3sU7Hh2GovI2P/eDX7/jy:h8r/nRp/zQBZBWNCr+UGow2Poy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190076, "uuid": "857501af-5b40-4914-9ee8-7a6959705951", "value": 4471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190076, "uuid": "680f8015-7b63-466b-a184-b410039f0144", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190076, "uuid": "aca05283-0054-4fa0-ac4b-f8a6b35e3446", "value": "Enquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40abb537-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192840, "uuid": "3e0b3cc8-b6be-4c5e-8ccf-48ede73a49d8", "comment": "Malware payload (RedLineStealer)", "value": "84515ba27617fd0d6e6e61343c82ee56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192840, "uuid": "a286caf2-c05e-4002-981e-6198df8f3940", "comment": "Malware payload (RedLineStealer)", "value": "6c82b47b3f2704735dc371304a37a9f57a8949c1367e027445fa277a948b0875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192840, "uuid": "c026be39-1a0c-491a-87bf-ea1e3a9f2d00", "comment": "Malware payload (RedLineStealer)", "value": "341ab08a1b2d951080f89db0ffb49a455d86d6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192840, "uuid": "dc18e963-bdd8-4e0a-b472-cf590c6ae453", "comment": "Malware payload (RedLineStealer)", "value": "c754321c03e93290a63c55349e8165d8b644569c79d43de81e72799b2cd7fb4a5505b8bf11ac8a3c9e740c0f67e8a96e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192840, "uuid": "290152cf-bcea-4081-93ec-c95f4957acc3", "value": "T15E940866B505148EEA6CAF28A89E116E2A519FF56C38CD9FFF530FC7511B42478F202C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192840, "uuid": "b5cbf2ac-cf07-4e9e-b7dc-56cdd06d3aae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192840, "uuid": "65967f67-17a7-4b10-a665-48b8da388c2c", "value": "6144:1KPCSvTvKhXQsutR5IXdoF+r2I1Fyjbl66A93LnYDttxU7Uu68ksVii:1BSvTkAXtvldA93LYzxOd69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192840, "uuid": "69ae6111-922f-4645-96ae-6cca15add230", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192840, "uuid": "3ac598a2-1c2d-4331-8047-c8b506656a27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192840, "uuid": "98920e59-4aa7-4bfe-82b6-e4fa6632c22d", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6de86a-ff8d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629227085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227085, "uuid": "7cca4112-6a00-4643-bea8-7db61e0b9800", "comment": "Malware payload", "value": "adfcea78d75201b3e076ad5cd5e03024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227085, "uuid": "e6ca6aa6-ec13-4427-94cf-bf3d1ea70c7a", "comment": "Malware payload", "value": "6ca83be643d77af8da636b80200781881cb6c4a9a1ad60d910c65d354478b7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227085, "uuid": "060c236c-d70d-419d-ae97-c70e23174893", "comment": "Malware payload", "value": "078a991833264fbd26fbe36368a8e5b7d80451fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629227085, "uuid": "1fec7199-0fd1-4d13-955f-a38bf1ff7990", "comment": "Malware payload", "value": "1b773b34860cbed96f676fd4db0e86b024b64884153a2a428f235415ef8a0b3ba5b894b9d4928c776560de8ce3444824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227085, "uuid": "7fb0c77f-f769-41e8-842a-4efccc9eba89", "value": "T179E4AF22F5D68036C2B327B19E7EF77A9A3D69360326C1D733C82D715EA05416B29723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227085, "uuid": "d8a5acf3-1f99-45fc-a7ec-8e73d89d4a78", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227085, "uuid": "502bb523-1ef9-4afe-bec4-5443b5ddc1e8", "value": "12288:XBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aNFVMB5DGDt2:RcneJVBvXAvwRJdwvZ5a+B5DGR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629227085, "uuid": "761773a0-6da4-4221-8f78-ae76d07c77cb", "value": 686832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629227085, "uuid": "dc969bd7-9d41-4ede-8d6c-513f25b035ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629227085, "uuid": "f9195b19-fa0a-4480-a80d-7def04d4a5e0", "value": "wdararmv.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5146da91-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208759, "uuid": "22940044-d3db-4a26-8046-0dad8f878934", "comment": "Malware payload", "value": "05afb35ea4954090085f2d214e5426b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208759, "uuid": "7706d503-19e8-4090-9b9f-0b9966d37ebf", "comment": "Malware payload", "value": "6cbce1d82bb769eb1c517c2c54db572614dfce4c858690d77df761572bc98825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208759, "uuid": "5e250236-048e-446d-90b9-825cbf8a3719", "comment": "Malware payload", "value": "70ba85680d68fabfe6027d67b411642dc17c9684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208759, "uuid": "6c5d61e5-2012-4b97-9c65-baee15c0a840", "comment": "Malware payload", "value": "8b5374e62fc1be56e0732ca8156fff928254c876ce2020d298658c3a4b66d61d36c6c6405b3d74382e9ff066b5fb894e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208759, "uuid": "1718b63c-f526-4a7f-b465-bfb27ea6d3f7", "value": "T1BBE4E012A2D2D036E4A335F811B680B666782D710B0E9ADB53F4793D4B312D3ED61A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208759, "uuid": "3120a27a-963a-4d77-a180-ecd341e1f58f", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208759, "uuid": "2361d3c1-fa8b-4e08-b893-a3a7e0b3ee3b", "value": "12288:krxieILAqtDnb1yaJXYyxxm10SZJbcdrFzGX0PsRdLS/Rc:krxixAC/17JXOxZ9OrFoQYdmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208759, "uuid": "e0bb75b8-d562-4858-a6cc-2941da1ca433", "value": 686606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208759, "uuid": "5640d9b3-ff82-4869-aef2-cbd57ce59bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208759, "uuid": "06149f82-6a33-466a-a8e5-6265c60a0e6b", "value": "0990000870098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e5c6f8-ff5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629205108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205108, "uuid": "b39d01e5-ee91-434f-bea4-498b6edee86d", "comment": "Malware payload (GuLoader)", "value": "cbdf1bd3b8c6d5d8ea358fad8b83becc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205108, "uuid": "08819ac2-5537-4742-8371-13fc230c1668", "comment": "Malware payload (GuLoader)", "value": "6d05c6f5356b5d1a4802d1b110dd5e6b9136f0b61081130f02404a9312fcd5fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205108, "uuid": "85fa3e89-2308-4230-8f06-393dd9d6563a", "comment": "Malware payload (GuLoader)", "value": "36e0b2d2d2629d768d6c8f6d1383ae671195cd73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205108, "uuid": "356f1869-b288-46ca-b7c2-c5b6c3c8c455", "comment": "Malware payload (GuLoader)", "value": "76cfa1089b0b9231e1caf4fc2b4a78f2a5db837209d4e2e4f595627962a04662207ec4a920a4a87867dae24cd268f4d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205108, "uuid": "f9962172-b2c0-46c6-8576-148bb0d19f4f", "value": "T1B5D3D0E5B0BBCF56D0891A721438A7C467C7E9598846570A7F3DD7BE0E3B6022E0264E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205108, "uuid": "1d6d7bbb-b92c-4165-ae6b-8f28b1ff9836", "value": "37e215a56c837657c68542780cbce344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205108, "uuid": "2150ab19-5ff1-43dc-94b9-3084c944455a", "value": "1536:gygvNo2+t8cZZuIOlvC70qTfRSnlO0ots4n2CvASgZXK+2HcCVx0JUei3:32uZV70qTfRSlO9ts42CvASp+2H8Ue+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205108, "uuid": "6b079958-15bb-42c9-9c21-b0e836c8193e", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205108, "uuid": "7a2855fd-d2ba-4216-bef2-86516c4cb120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205108, "uuid": "79f28e0b-d4f8-4787-a95b-5355a931c0cd", "value": "cbdf1bd3b8c6d5d8ea358fad8b83becc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f83c28e-ff87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629224164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224164, "uuid": "328bab31-6734-45c9-a3b2-97439681254c", "comment": "Malware payload (NanoCore)", "value": "29fadfa453b82c3004da7e2c5d859cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224164, "uuid": "2bee73bd-4368-4115-992e-5b408b48f750", "comment": "Malware payload (NanoCore)", "value": "6db62dd5519b4afb93f0b949b741d384525425f1032ecc52e7196d34243cca4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224164, "uuid": "a8009603-59d6-41fe-8629-90a03dc72246", "comment": "Malware payload (NanoCore)", "value": "30d2de57c4aed44210c9e7013fd6d57af3f0485a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224164, "uuid": "ed49eb47-ed27-4c75-a810-6fbb941ac8d8", "comment": "Malware payload (NanoCore)", "value": "f15be0a67f1d5b1bbfb8edd89220ed7c98b6d4371d047e432306ce8d75b9a163e4ff655379d5d0f4c1646e8ed4fc2f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224164, "uuid": "233643fb-34b9-4fd5-bc3c-22ca4b5a15cc", "value": "T16C14CF667BA84A2FE2DE857D711212529379C2E3ADC3F3DE28D854B74B163E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224164, "uuid": "7c6ae4f8-fdf2-41a3-ac7e-80fcdebdd2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224164, "uuid": "6795b630-632a-43e3-9be5-e361884e9dd7", "value": "6144:OLV6Bta6dtJmakIM5I0qHE4i6XYcN8hYXjhHrYC:OLV6BtpmkRpkAnOKThHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629224164, "uuid": "7b59e13b-80c3-43c7-abe7-4072e57bf845", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629224164, "uuid": "023a7fcb-2890-4f8e-b683-d4d208b2c882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224164, "uuid": "24c17bee-9ffd-4c31-b3f3-baac4977bfc0", "value": "29FADFA453B82C3004DA7E2C5D859CDD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53779bf6-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629207045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207045, "uuid": "d6a59083-c9f6-42a0-81ff-f3f24a290b33", "comment": "Malware payload (Formbook)", "value": "167e7192131faa0adc59e5e361580cb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207045, "uuid": "057f415d-a089-43f3-822b-be0d3ff30fee", "comment": "Malware payload (Formbook)", "value": "6e057860b43f01d325b4b6ae8717c64271fd81c0f2314b618b9c349ecbaae23c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207045, "uuid": "4fa015a5-9776-4055-833f-685d37721861", "comment": "Malware payload (Formbook)", "value": "932151523cd465e4db1fc215c6613e31e47f68c4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207045, "uuid": "4c0bcb90-cb0d-4a75-ad61-fce4035c0a84", "comment": "Malware payload (Formbook)", "value": "533a7500700fa7007137978ee7f009bc5c14eb272ecc667aa4473a682e6b7d85b95e635e2fc18b4d0dd9b867edbba7d3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207045, "uuid": "3363825f-3a9d-4de0-a9a7-a1435cfa2d4d", "value": "T1D55513E09A186AB3F873D6BC953B509B5439CF1093BBD487BA76BA40337536221F451C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207045, "uuid": "43258959-77cc-43b4-88a9-dc4234feb123", "value": "24576:7ZbjBR8dZpGwkQnp3VJRFuO7qNp2t0MxDiPefjOYzVhS7N:7lQxVLBqN8HxOPeBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207045, "uuid": "6c987417-7339-4088-ad33-6d87339e8e6a", "value": 1313320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207045, "uuid": "2cdbb543-f25c-4451-968d-b20a06e0fe69", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207045, "uuid": "3774e3db-61a7-4e72-994e-7066c8f436de", "value": "INTEG-PO-2131708.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cee0da7-ff05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629168406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168406, "uuid": "80200c0d-8398-4ba3-8960-d1517ec812ea", "comment": "Malware payload (Mirai)", "value": "823f8a795109dc22c5cf35b128f6ac5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168406, "uuid": "c2accfd1-5f05-47e2-a142-6aa2bda562cf", "comment": "Malware payload (Mirai)", "value": "6e1756e799abaa9d53bfb495f48dae8c414ea201d1165daadbe524b763e874f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168406, "uuid": "e541f7f3-d8f2-4791-afac-de95e8a20fef", "comment": "Malware payload (Mirai)", "value": "847c4ad37dc9e0201353e9fd8cd9790f95a23998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168406, "uuid": "768d2a55-e3bd-42d4-b289-248006091232", "comment": "Malware payload (Mirai)", "value": "0762b9649a8d482fe2be21d72f4a874d0c4475751f5c9170a52a116b8543482e2884839ee7b27d9be1e4b824c1b52251", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168406, "uuid": "0c368e02-d344-400e-81ae-0acaceb5d8d5", "value": "T19E539E37C46EED88C1584234F82549741B93E50895A73EFAAEC789A28087EFCF5193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168406, "uuid": "69d8c241-53df-4ce0-a432-dfe0c0a7a27d", "value": "1536:5ajdxqkcVwu/ghz3sYOwtZTrzosdFZnM8K8zC5K:5YWkcSu4RCkdFZM8K8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629168406, "uuid": "91a6cda6-d0d0-46ad-b5b8-e4aef01ac011", "value": 64748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629168406, "uuid": "fabb6b62-10cc-4b62-98dc-bde09506933d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168406, "uuid": "b17c53f7-30f0-4d4a-9231-b1173c8d57e2", "value": "823f8a795109dc22c5cf35b128f6ac5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f11afb8-ffb3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629243088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243088, "uuid": "f5735f52-8298-4fe5-9b4e-371fe125d5c4", "comment": "Malware payload", "value": "d0a17ba309ddd3a78f442354e8c89438", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243088, "uuid": "0077bd93-178a-4c2e-a385-c9958c93564e", "comment": "Malware payload", "value": "6e61849c5dae0a3244cdc7d10ec7b24b8d8ba9b154685e9a194d4ed76f75b2d6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243088, "uuid": "1738229c-2664-4879-907c-a86a6190363f", "comment": "Malware payload", "value": "85d0daf3ce4e3510f4fe0422008119bdc536ce19", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243088, "uuid": "d485d89a-7e01-4594-a79e-034b463bf3fc", "comment": "Malware payload", "value": "e54c83483e069d2ac5e207d86d84a04e50e85d3fe2ca18a2c1a48756884f7bd68a62e2934464413d03fb25c6087bb9c2", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243088, "uuid": "5235f9b7-ee32-4253-a936-5c3405b3015f", "value": "T1668263B8D9DE54A4F9BB84107AECBE65053631C79BCA2E74937CD1408BE9FC22E4448D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243088, "uuid": "d0220c3e-d264-404a-bdb1-ed4b2468714c", "value": "192:WRAZa5OYiYusicXfP9l8kzRCpH/IQDpO60WR7wwNQ+q8vjf80d/WZK2VDTP/ff7J:u2vTYacX3toOiZfhjf80d/WgyNFrliq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629243088, "uuid": "d69c6193-a433-410e-a3b0-b5be6ece25ca", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629243088, "uuid": "22045e8d-516f-468c-bedc-16db26ca7005", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243088, "uuid": "95e7bb7d-f4f5-432d-a57e-8e2a65348c4d", "value": "Rwlksdnasjd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992d9230-ff09-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629170225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170225, "uuid": "cf59bf6f-2c04-4164-8b1a-c068331d9f31", "comment": "Malware payload", "value": "dca27a20594772d6c37ed575104878fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170225, "uuid": "8a4b5a58-d4f6-4c17-8930-ee5d7206aa75", "comment": "Malware payload", "value": "6e94ad2cfcfdb5b7e94f52665edc3f5aab39ef286f164db5cd136086a26bb8fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170225, "uuid": "95391519-ae5d-4db3-86dd-2cee1a879eb6", "comment": "Malware payload", "value": "e04e725908917bbf3dda4eb57495071fd787ecbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170225, "uuid": "3378a1ea-1e6e-4f9b-9fa6-532086ea0c62", "comment": "Malware payload", "value": "b47207a9428ce6a86ae3f9e938f2b3018adf6ee0526da4384159c9e3744648462527d78d25ac49f7302245d2eed29b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170225, "uuid": "c77a87ba-d7bb-4573-bdc3-67b8e732b4dd", "value": "T1F955F93816B43A37F179C339DEE4481BF6D4B55B7615AA1A72DE03670243A03B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170225, "uuid": "3e1e4071-eca9-425f-a463-7bdc47936c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170225, "uuid": "b2a64c37-69e0-42a2-9337-6ee3af002612", "value": "24576:pnugJcycWz4iXMHRNkGdFnsHqLwjjL0xrIo2RZQGmmbYXR:dp6BhLwjjL0xrr2R1PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629170225, "uuid": "6ec5222a-3a53-4907-b301-70f61dfc6545", "value": 1395712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629170225, "uuid": "b6652c70-6038-4f04-be7d-1488d5a8bfe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170225, "uuid": "e09ff7ae-9f82-4d6d-a382-fb053c31f8e1", "value": "00098765_INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f9237e-ff00-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Bandook)", "timestamp": 1629166269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166269, "uuid": "161d7157-44e6-4699-9e38-d7c068ae5a04", "comment": "Malware payload (Bandook)", "value": "853fa769127654c7a952a6727e5a1277", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166269, "uuid": "4366f446-6006-4e1b-aea0-9f558a69f38a", "comment": "Malware payload (Bandook)", "value": "6ebde71b95e8176638edfca7c75401581061f7d01162eec56b3d4ced759b4539", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166269, "uuid": "894ecddb-e81f-43a1-80d0-850989578efb", "comment": "Malware payload (Bandook)", "value": "ee1bb86681d5066aa9c83b4eecd00333e68e6665", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629166269, "uuid": "80e1b69b-bafd-4d05-b069-df468c391058", "comment": "Malware payload (Bandook)", "value": "403fcc4fe1809857eb1d24ae6da02d5b04023789d9de16388c0cae874068f7894dc4a95f0f2460f3176eeb35999a2921", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166269, "uuid": "e6e1d2f0-5da0-4570-96e5-c76ae9c9f28f", "value": "T1F654DFD17883C8BEC594E5F45860D6B85739BC506A18014FA6943F2B2E337A397FE2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166269, "uuid": "18f84e23-abf6-4a5e-ad6c-16271f33f937", "value": "d1727cc76cb77410e59de4eb81f68a0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166269, "uuid": "17dade71-73e6-4c9c-ab63-716cf8e85447", "value": "3072:bLnvd9ejRngrbyCOeBu65EAxhFhS1mG+TlrAQdjl4yuV5zL76RW8a4ROkWkCZA9:bLLryCVrS15+Jr7fE5DZOROkZCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629166269, "uuid": "d591c39c-9944-4dea-ae9e-30aebf5db8e5", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629166269, "uuid": "e6e8aa8b-f9a8-4b7c-a4da-e714ec9b9574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629166269, "uuid": "cc3d4e5b-eb1d-4e79-8ee8-974e46765729", "value": "853FA769127654C7A952A6727E5A1277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321179fc-ff27-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629182937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182937, "uuid": "eea68e65-2dce-4a96-96e2-64fa0209abd2", "comment": "Malware payload", "value": "af642e2e215aa728e79f8ad184bea685", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182937, "uuid": "a9f3fa02-cda5-4925-8d50-2ef1dde90b0e", "comment": "Malware payload", "value": "6ef6c074b1118718fa30cc9d51890c9f8d55df92e1cebfdc55f6a264fabc50d7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182937, "uuid": "4a19381b-c362-4919-9b5c-e336448e4b34", "comment": "Malware payload", "value": "12e6d831d5703d519a52a634f22c4d2345a9e21b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182937, "uuid": "bde38ba7-0237-4326-a6a3-2ab1dfd85a92", "comment": "Malware payload", "value": "605f847ee533fcf89715b5d0c473a3c01fe2dd03847b23038d47fb293667571d70261c6056863d7adf3903d8ac69bcd5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182937, "uuid": "d69dfe4c-b345-4ed8-bf9e-ca110a0bcfdc", "value": "T182066B23B2C4553FD0EA1A3649379750993FBF617A128C1F5BE43D8C8F395806A3A64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182937, "uuid": "07b2c08c-de08-41f7-94b9-cb10974eb8c8", "value": "49152:OVbMty/yStzxlWG0swX6aL3EwPfXkQTTwESEWYLFA:EtxsswX6ajPs+N1WYhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182937, "uuid": "f0ceff8f-937d-4c88-ad47-40b9c1374861", "value": 3840512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182937, "uuid": "3d39c329-c6e4-45ab-9633-487fd118ef27", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182937, "uuid": "1782adf5-4d26-4b87-a48e-43d5c57c2776", "value": "_--_-solicitar_ptqlwrehs.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3ea36e-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629207033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207033, "uuid": "c27d538a-b8e8-4049-85e8-4df921f1edea", "comment": "Malware payload (Formbook)", "value": "c6dd35e96cae0729eeb2ac08dc53d46b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207033, "uuid": "0a73b76b-cf20-4513-89aa-931d9183b1db", "comment": "Malware payload (Formbook)", "value": "700e1b5bada25cf5d9a7bd6f460b22b9a62cc48fe89c491c6de2873138df2798", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207033, "uuid": "2fb90f07-f6c3-4990-a1a6-344aa1f5494e", "comment": "Malware payload (Formbook)", "value": "7178b5b5b2f343c0a644e3a108a6f0421c5245cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207033, "uuid": "1df95f2d-d3e0-4fa4-9e69-4a709d6a4c92", "comment": "Malware payload (Formbook)", "value": "1e4eac11863436634b865473187523eae74bc55fb1aea6d068580985612f3ed04d51eef2b37907784e0dc34f4ad448d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207033, "uuid": "696d1331-cfd3-4fcd-99fd-fb316fc0f50b", "value": "T10E551296E0D4BF1BC4A28EFC2E1DF63D0498AD407E86FBC9A304759B1730B50577A949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207033, "uuid": "9f44afdb-4f20-4736-a4eb-eddcc718a871", "value": "24576:A2tUIcwx9r2vfTJKvLaLp/23ffnHJjetz1Ih2+/vuk5PcVfTgamS/A//PQ4/c5Pg:A0J99r2f9KjaLI3fhj1FWLgaEP1csEqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207033, "uuid": "0d45f866-1188-4d4f-a100-106220b96612", "value": 1349736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207033, "uuid": "6cc75897-573f-4bf6-8ea0-3d2d2042f00e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207033, "uuid": "47894bc9-8460-4186-98b9-4b8f485d101e", "value": "Transfer-form-$157,890.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726a569e-fef2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629160282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160282, "uuid": "47188f37-dedd-4b3c-801b-9d1de99e203d", "comment": "Malware payload (Dridex)", "value": "9cbf494c0db2f694a0766560d7b5d67c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160282, "uuid": "0da65d6d-54f3-4b2d-896f-fc3886d34a25", "comment": "Malware payload (Dridex)", "value": "7039457e8a3bfbd2481a0f7da6b2bd471b983e28b06f939b6726843716689804", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160282, "uuid": "88cd0c57-f2bb-4239-ab86-e8ddef5f32ac", "comment": "Malware payload (Dridex)", "value": "d0e4e018b7eb278a6d2886dc5449e7cd3064c9f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160282, "uuid": "7e7c0d61-f640-4730-a2dd-0a268040f849", "comment": "Malware payload (Dridex)", "value": "7a36cc51ad7608ad4de456d7574000808a96caa852d2ebb50213f998dd0b2c285c5e8ea80d74e6857ffff07060aff3ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160282, "uuid": "e2b465e6-9378-4e6b-bff3-d6d75b035e51", "value": "T158340217CB656D23C50CE7FFAE122A90439D4901DA0AF8CC69E36D5E2F9C67186E701E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160282, "uuid": "4f8f337d-9834-4837-becc-628ed3e96d77", "value": "6144:YogkLjLhQ3IP9Pjnpgr44xlVxwx50NK+uM0TtO:NDLZQ3IPRbpgrXg2s+F0xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629160282, "uuid": "7be056d7-760d-4dfe-9c34-59d5c4884e38", "value": 246935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629160282, "uuid": "cd376511-34d5-4f65-a0bd-a3385eef7265", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160282, "uuid": "6172cac5-e1f8-4d6f-b9e0-e358b7e58f74", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.82294244.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7343b267-fefd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629165007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165007, "uuid": "e32cfc33-90c8-466b-841c-0541b8dc30ef", "comment": "Malware payload (Mirai)", "value": "8195dcb7a976e81acd015be7436f9984", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165007, "uuid": "576d7ca3-e698-478e-b832-f71bb23c0355", "comment": "Malware payload (Mirai)", "value": "71d226302757a0a74ea2e8b64bf837627d9cb7fb6bd7d80f4b96d191b17305d6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165007, "uuid": "7279dc56-578a-4708-a129-a77dd1cda82b", "comment": "Malware payload (Mirai)", "value": "bd95e5f7c9413af958da7e37eb40b5f1890eac19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165007, "uuid": "5608c31e-3b33-41ce-bda8-3eb554634a98", "comment": "Malware payload (Mirai)", "value": "458dc57462109032ba66d0f6b7975422ccead89236033543eeee3d9ff5064c3b7bf04d44dfd80ddadbd3fd7a56dc7b70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165007, "uuid": "e712e773-83ee-4c2d-990f-e92004bc4387", "value": "T17C530895BCD29A2AC6E4237AF56E518D332163E8D1DF7217CC101B047BC992F0DA7B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165007, "uuid": "5a36c0ad-f3f8-4ac1-8e12-00b5c4313059", "value": "1536:1tTz0sZsbgUgiglejynxiGtF46+PcgpgASVxtJ0:MsZR4Ojz46WcmR8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629165007, "uuid": "0137618c-697f-4724-ae58-b2407d4ad224", "value": 65320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629165007, "uuid": "03080b5f-246e-4efc-9d98-5d67d00845a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165007, "uuid": "8afcb329-f955-4c0b-97d0-303a67a012bf", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdaec233-feef-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629159227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159227, "uuid": "0524b3ec-efb9-4ead-86ee-be3c0f1598d1", "comment": "Malware payload (Dridex)", "value": "64cee50a6cede92c5a14ca67bd2d6f83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159227, "uuid": "952911bf-e09f-4192-8dc1-2ecafb1debf5", "comment": "Malware payload (Dridex)", "value": "71d3c49796d404798f6ba3b9a38429ea9221d09a4c029d22af1443ef5193560f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159227, "uuid": "ddb05795-65d6-4ebf-9c89-71c197d154f0", "comment": "Malware payload (Dridex)", "value": "dd8257c907641ecee3eb859d2db7e1caabc75091", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159227, "uuid": "ec1b9986-4b8e-464b-9b81-bea95d875ad6", "comment": "Malware payload (Dridex)", "value": "5be8492999e28b3ee4cdd7657ec53be2630437f47074a95da91039b16d6c31298d16b04b290e97f817bb2f8b178f1698", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159227, "uuid": "86c25a8f-dad8-4733-ad23-430a240cd1fd", "value": "T194441237F83D2A53E848E77BBE00377317461783930A7AC461A56E2E2F44BF65AE5148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159227, "uuid": "6eac5039-8d68-431c-a72f-338a16ccb2d4", "value": "6144:8ogkLjLhx5epHg4z7mYilG+hQ4SORCtg8bC4uzN9orUHNPr2s:5DLZxwA0MXhQ4LREg/4uzjorUHAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629159227, "uuid": "2b0b39d1-5463-48be-88f0-e2db05751fad", "value": 275628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629159227, "uuid": "7b1ca2b3-30e9-48a8-beb2-68e8d317aa0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159227, "uuid": "3d89edc9-c512-4872-ba56-b230d5971b61", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.821441897.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1481c6d0-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208657, "uuid": "6bf570fb-8565-4b2c-afe2-cb352d689913", "comment": "Malware payload", "value": "9ee21b7bda8668d0a5e41273d0ce1291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208657, "uuid": "ddaff7c9-f3b2-4f60-8355-bcf07239580e", "comment": "Malware payload", "value": "738a485429af982afe764c392327ad1940bc0e2c53e46ccebc7e7528abaa9c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208657, "uuid": "4794d140-e1a8-4f81-87f5-dc5a11f2eacb", "comment": "Malware payload", "value": "bcd0969fa8441be09d256585a7bd7073d2725f59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208657, "uuid": "6dc82322-194c-4462-8278-34b21732deca", "comment": "Malware payload", "value": "97aaa510bc379d9a48e8ce1f8da1a2fb00229b26d424fc7f752da6c9b82ca3683aa49c585f649ba448dd001649abf144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208657, "uuid": "6958915d-ba14-4e7a-b1ca-ef4baf2dea9d", "value": "T1E4F4E0017581C0B1C39275F2541DE2AB59247E709E11898BE7B43FA1EB32AB3ED64B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208657, "uuid": "e3d5e716-6595-414f-8fd7-b1a9c7a9c8ce", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208657, "uuid": "ccbcda39-fa02-4900-8afd-50052cfc2669", "value": "12288:r7T2OCm5I7wjmyGR7GjOzv1S87j4HtkqYrp9yo0BNhc96DH/ofO/oKc:r7T2OCjkjmykyjOhH4HOqspDQ9X/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208657, "uuid": "c9902456-c08a-4d28-bd9e-cf40ee58532a", "value": 753525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208657, "uuid": "e5723735-2281-49b6-973a-f27b3865f040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208657, "uuid": "9b8e951c-0401-4831-a892-db6f899881aa", "value": "TT09879087700U.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d55b4f5-fefc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629164487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164487, "uuid": "f6d9bb82-094a-4441-b183-625e28fe0bc9", "comment": "Malware payload (Dridex)", "value": "21b40f206b58c40d8cb4b3ce9ea8fa86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164487, "uuid": "728db446-db70-49ab-9b80-d524c5466f80", "comment": "Malware payload (Dridex)", "value": "73a218670a7fc077417b0ef1083f74ea454b16b64d93a0546077b8e159ecd8fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164487, "uuid": "cb111213-fc2e-4372-a63a-afec5aa948fe", "comment": "Malware payload (Dridex)", "value": "3b778697e5644d3eaf06c1b9cc79ebf3d50d8df2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164487, "uuid": "1c64744e-58bf-49eb-990b-e44788a29d59", "comment": "Malware payload (Dridex)", "value": "07d2eaefb6132e999977f8096b42cd4fd8e2acec3cd01040aa3019154200d0222d28b3674cff32ace6c14ebb48465022", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164487, "uuid": "c1b4fd30-cdf3-4aa9-9c73-8feeaef54bef", "value": "T1B644023A4633F120E9DFE075ACAA0FD627715E5B60D01726F2E1964DAE0ADF315B108B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164487, "uuid": "978b52d8-7c93-4449-9608-5164f73f6001", "value": "6144:SONSLcq+YXEsEoX09ICS6IWWhz6lUKDqWv0bhwxTtaD:5PYXEsEoXP4jUKV0bhwxTtaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164487, "uuid": "6edfee19-abec-4761-a285-4dee545084ca", "value": 256231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164487, "uuid": "8be41735-3ade-4779-b488-f52c5978bb2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164487, "uuid": "6dde5ecb-8ec4-4665-a5b9-bdb1f3e897ca", "value": "taxve_75010812_20210816_7398552774_496116616.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1074cc53-ff3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629192329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192329, "uuid": "4e728529-cb95-4ba2-a2ce-62035ed6bd02", "comment": "Malware payload (Formbook)", "value": "650e108f6fa66e360adef1852a7342fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192329, "uuid": "64b5265a-1959-45d7-bea5-9aa9a9444e00", "comment": "Malware payload (Formbook)", "value": "73ba539a238da72c6f7bd2a0e528db1de3fdd6a1d6217613229c017eb758d4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192329, "uuid": "c7e872df-91b1-483c-b766-bed912696f4e", "comment": "Malware payload (Formbook)", "value": "d5ace13df0ab55ae7789d5e4f771b58536a5ea6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192329, "uuid": "8a3c62e6-037d-4485-b0e5-b7eab78afda5", "comment": "Malware payload (Formbook)", "value": "406e26f4153371d6d7a3208ebd6e70c6b57d449fbc1a8bb7ef5e4c90d3b79ab9f028acdd9106f62d305f86251546ad01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192329, "uuid": "91cde1c4-dc34-4732-a6c4-9f060bc36a87", "value": "T10B256F381BB92567C165D63EABD18617F04096DF3411AA57A4CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192329, "uuid": "af971d91-be06-4e37-b142-841d9081e7a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192329, "uuid": "afb157e7-b372-45fc-90e7-fdf7b17ec537", "value": "12288:eDDc9F3nC0Py3gAhGEJbjJEKyzSmxrhQci1291Hq79+ZrE2gajEA03Ugu/T5LBl:fdhhQciy1Hq79+Z3EA2U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192329, "uuid": "2e435c85-f48f-42d8-91bb-1aa8942a0c3c", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192329, "uuid": "20804d8e-63fa-4eeb-baa9-89736f50c1e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192329, "uuid": "d732d6b4-09a1-4d30-97a8-e91f35274738", "value": "650e108f6fa66e360adef1852a7342fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd17ad9-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209988, "uuid": "34cef62b-4b03-42f4-bfa4-1316dacbe85a", "comment": "Malware payload (Formbook)", "value": "ce9f21fa149484de3c45d5ba4d3565d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209988, "uuid": "10a3bac2-a9e6-42e1-9eec-87227b71f11c", "comment": "Malware payload (Formbook)", "value": "73c2ee6d691663df62c983da3572abc381a0940f2cbdfb2ed8d48cb225d7b5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209988, "uuid": "47450e45-162e-453f-9ce6-f139d25f5509", "comment": "Malware payload (Formbook)", "value": "d5378216b26fbb5adec981dbd6eddece18e5abb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209988, "uuid": "1663a295-cbb2-49a8-9671-8dc5b88005ac", "comment": "Malware payload (Formbook)", "value": "03f417d0fc5f86adfc8d10776f335f0b7f3830fa5c503c7b7e7799383fcc9a0289a47e5ae77c2e479141b1a85fa24f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209988, "uuid": "6d7c83bd-40e2-4212-bdcd-b7c3f8265308", "value": "T1E525603C1BB926A7D065D63EABD18617F04096DB3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209988, "uuid": "05be416a-c1f8-481b-8da8-dbfb16d887b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209988, "uuid": "dc698a07-f649-4460-84cd-10e3f23b7499", "value": "12288:nnDc9F3nC0Py3gAhpEJbjJEKRAhGl+KkeidIkAxZeSPFwmQAhmPg5NLvRPvTCCtN:lGUKliR40St8P+7PvmueZCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209988, "uuid": "1e12e803-f881-40a9-9d36-119e2562294b", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209988, "uuid": "811f8345-67f0-444e-abe5-7a9fb3d36ef3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209988, "uuid": "16ddaab3-8e86-413b-967e-8ba4cd00162c", "value": "ce9f21fa149484de3c45d5ba4d3565d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252c13aa-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629208685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208685, "uuid": "13207733-ccaf-46df-a86a-541b29339893", "comment": "Malware payload (Formbook)", "value": "e9cdf9f30ec16ee3e9b1221c9360333c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208685, "uuid": "a9513d5a-8b72-4e66-b674-c6f542df83bd", "comment": "Malware payload (Formbook)", "value": "7410dd3ce4d77a72c51346dba61e6aa2cc39691545cc02b42bbcecd2b0b65838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208685, "uuid": "3ff90c28-184a-4e45-bee5-589b180c42b7", "comment": "Malware payload (Formbook)", "value": "7c898450e9499593a6124211d745d461c13f6770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208685, "uuid": "d058f01f-0a2c-4d85-98a5-7cbd10f980b3", "comment": "Malware payload (Formbook)", "value": "b20e7831efc7062a11954144fafd59c78759d01700a81e4ab26ca9a1074768ab0e92156a8a9d752147b93648deae9aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208685, "uuid": "d0dde618-45ae-4453-93d7-09a8ec7b45d6", "value": "T19E64D0A292A769D1D87E9239E058597F03D3E97EE261C6CB375387C1791C0236CF2AC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208685, "uuid": "fa5db452-abbe-4a0e-9aec-ba374b16e896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208685, "uuid": "8f2bda8d-3cb3-4a07-a25f-9d2f11318e69", "value": "6144:VP1L7Rk6UDvrwJ3ILnv3OVy1wX8AcATGk91OK/9OQ1qoYm:VPzk6tYLn/OVy+1cATJ9j9/wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208685, "uuid": "472c7ac1-e1fb-4fe1-b31f-e46cd222689f", "value": 307056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208685, "uuid": "6db57946-22ae-454c-be76-ad162dd5ae41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208685, "uuid": "76fff1e9-b736-4c60-b410-d804538cf7c5", "value": "QUOTATION 26934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0941eeb5-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208638, "uuid": "77b7654f-6f95-4540-b7b9-1d492033472f", "comment": "Malware payload", "value": "8cd3d2c4c1512e855e6a94273d7a3a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208638, "uuid": "a998430f-bce1-4104-b4df-5d1df322a42f", "comment": "Malware payload", "value": "748475ad8547847d00616f2d6c8018299b6d8f058232ff1ef0e03d34068b4793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208638, "uuid": "ece39311-baa0-4b04-939a-a0564964af34", "comment": "Malware payload", "value": "5d315eb57800fa45d29d630bb2dc1dcf63e67162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208638, "uuid": "aec351ef-e17e-4b44-a8b2-788389526ffc", "comment": "Malware payload", "value": "686d6c8d0da659e3bb6c2c12d7efafcb7114daaed71b1cacfd31d07b74b373c9a34130a9fd0e452c6029489f3e2e3e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208638, "uuid": "0308699a-0216-4f26-a6e1-675f734fc914", "value": "T1CD55EA3C25B83A3BF179C33DDEE5881BE6D5B45B7211AA1670D613770702A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208638, "uuid": "ce322e97-d1a4-44c3-b7f8-008f8a56eb4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208638, "uuid": "060abf37-ed54-40c2-b1ff-ff416543d59c", "value": "24576:LY++AZcicHz00rTOCtzFnAi/ELFEEDOqlcSfx:WXzBP+FEOllx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208638, "uuid": "1c04cf46-ab4b-4514-a2be-099ad2648cbb", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208638, "uuid": "e8905b1a-1210-4e5e-8fde-d41ca8c7cd68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208638, "uuid": "de3766f2-9e1f-465b-9c32-44737bd5453f", "value": "Quotation 8566345656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0346c01-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208999, "uuid": "a7b6e181-6520-4833-84a8-78de38205815", "comment": "Malware payload", "value": "74085c53032f646177a0fcd39e6319bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208999, "uuid": "53383030-2885-4876-ad16-8e93510a63f4", "comment": "Malware payload", "value": "748f483ad379c9ebd8419233604cf919dde3a222263fca5a054c5607dd5c4a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208999, "uuid": "417ac546-1570-48a3-b56e-1b8dd9d350c5", "comment": "Malware payload", "value": "861b7f5f3883534fc838db6ec9ccc53bae41dee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208999, "uuid": "fb0bed5f-a42e-4a4e-8219-c8ef3514d4ed", "comment": "Malware payload", "value": "8d151eaca69171a10ca9d12b0c8166bbefb7d8e9dec10e12f9a8252526ec5e7f49d02a92d0cbd73daf5f626fff5c8d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208999, "uuid": "29526298-ff68-471f-958e-dda22a8c8342", "value": "T11455EB3815F8793BE1BBC339DEE8482BE7D4B45B71116A1670D6136B0702E42B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208999, "uuid": "7a3ef720-6d1b-454b-bd54-723153fc8a44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208999, "uuid": "2c757f76-41b8-46d6-b2d1-34319321cd02", "value": "24576:ScQ4vcUcPzEP/rvkSIQFnnZlNq/kDpRvFvaOFv7fDpMCWQy327x:HdIQBZrq/MRtvFFv77zv7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208999, "uuid": "6e16f95f-4f16-490f-9dc0-6ba7c3562bc6", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208999, "uuid": "09bb2858-004d-4b5e-97a5-51cf9315eb9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208999, "uuid": "df61dc24-9af0-4e6c-9408-8ac4361fca30", "value": "New Order PI-19-09878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f806c5b5-ff62-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208609, "uuid": "99ea96a3-6959-4db5-b9e0-954de73a26a5", "comment": "Malware payload", "value": "ff0551d32ad2cb24568eeb9edd75d409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208609, "uuid": "2252b6b1-45a8-4c18-a7ab-eb65072e2411", "comment": "Malware payload", "value": "7490df99d567fff4ac9eb619bedd35fe5e7ab406dbaf4a2855221855af14b18a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208609, "uuid": "e5825afb-cd14-4528-b4c4-3560cf4604a4", "comment": "Malware payload", "value": "5ece15cc7f5f96e0006cf9f6e6a27c519267be04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208609, "uuid": "ed19949e-212b-437c-bf3f-fba385589975", "comment": "Malware payload", "value": "afebf2d1435cc5bb8592f0f078a4d50b8a8a05ffe72d2a816ef6f4e9e24b6510403cee62ff732cf93190d1d4a6120b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208609, "uuid": "9adcd161-1711-44c5-8fdc-6588047f6878", "value": "T1D2550B3915783A3BE17EC379DEE44D0BF6D4B45B7A11AA16B0D603670703A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208609, "uuid": "381d58fa-8ddf-417a-9789-081ef674e181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208609, "uuid": "2af89e8b-74a1-4482-aea8-ff9feeb2f660", "value": "24576:hXeMKN0cOcWzu6vFnoS2MILqgTPIYnt2/joS8ikauIVMr:tBPkFDIYnorV8i3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208609, "uuid": "76ad18bb-87d3-4eb9-8f52-f0432e635db6", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208609, "uuid": "ccefc89f-8a31-424e-b540-6a95a622d07e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208609, "uuid": "322b6e24-5208-4fbe-b278-ba6b5f502290", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae033e5-ff48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629197045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197045, "uuid": "00c4c1ec-fe33-419b-a9d3-3c740bba3dbc", "comment": "Malware payload (SnakeKeylogger)", "value": "055d8df9f7096092a779c271a48feb74", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197045, "uuid": "1b93041b-681f-46ef-af48-461f2967c12a", "comment": "Malware payload (SnakeKeylogger)", "value": "762fb1683020a79af732503a2a75eeaa1c4c3f844472f50e5b955a71297f2565", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197045, "uuid": "6aa1c675-c144-444a-bff2-d31cbd29888c", "comment": "Malware payload (SnakeKeylogger)", "value": "f04a3bb81527033c6891daf1063eae822e8fd5c4", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197045, "uuid": "03afc046-d6d0-4ce0-b0fd-0581666db98a", "comment": "Malware payload (SnakeKeylogger)", "value": "890283f425c5c93e53a57a4c9be9786845914591f85eda3a57ddf573d84fd1952c87e3a207137451277fa6f954947549", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197045, "uuid": "e4267df2-319d-4216-940c-7bc128f3337e", "value": "T142D42360168CC25AD5BDAF9E1055E06B023C5D12BB72BF04F701D4889D5B1BF87A879F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197045, "uuid": "d4cc178e-fc85-44ce-b910-0b1f2c328fcd", "value": "12288:8nH920T1i8LPhnIBhXWHBd2+i5OBvi4MNa5cG65ZSyEPv3yADMecOOJHy:AL1i8LPhnyXWhd2+i5OBvTcG65ZSnHfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629197045, "uuid": "954935a5-ee09-44bd-898a-58a4e4dfa753", "value": 620706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629197045, "uuid": "93a26538-4c71-497f-a431-e110347f028f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197045, "uuid": "3b480398-b893-4438-ad44-ac3f7874bff9", "value": "received PO Ref-28414779.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec69939-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629209480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209480, "uuid": "b33a5e26-44c8-4f5b-aa0c-ae0807bd2032", "comment": "Malware payload (njrat)", "value": "8414a4e55d98be8c6db2a6402dc5dcf7", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209480, "uuid": "8c62743f-cdf0-4e56-84e9-6bbfbb72c89f", "comment": "Malware payload (njrat)", "value": "766d8e9d2d0de0a0ba2440a847e7eb7da3e69d51331e15a61ec1d25d3d92fc3e", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209480, "uuid": "c7a01b1b-3532-4b71-a627-213c97384680", "comment": "Malware payload (njrat)", "value": "e7b0029f57d414c59fac378cd8d96277195b0bc3", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209480, "uuid": "b775ec3b-6915-497a-b465-4ed8ec593aac", "comment": "Malware payload (njrat)", "value": "952ce7c7a75ecf6324699d6936f0f518c184b5cb9c2893ec238dca8798b2acdb650d30ef85cbc23be2001049e5ce730b", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209480, "uuid": "604032c3-a1b7-4add-b13b-4f573c45c3b1", "value": "T181317E04703319D3EA06D52231A731DDBD312708AABB8B71145EDA52AA409BF5C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209480, "uuid": "3b175033-40a6-4d6e-84a2-1fb19a845e8f", "value": "24:rEEPdqnWahNogJPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2bD:3+Fx2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209480, "uuid": "fcc0bb3d-e581-4485-8dde-5535e0c649fd", "value": 1604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209480, "uuid": "3a073cb1-5e8a-421e-9588-a1b9fa127358", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209480, "uuid": "ff62d4fe-7c17-4235-aec1-3b35c16731e1", "value": "Pending_invoice#YT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dda7032-ff6a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629211840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211840, "uuid": "a0e13850-fb6a-4812-9afc-705d65eb8561", "comment": "Malware payload (AveMariaRAT)", "value": "8ff120fe9620ce51402a34dfdd4f76cd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211840, "uuid": "b71f041a-eedb-4021-8915-efaf71fd71ce", "comment": "Malware payload (AveMariaRAT)", "value": "76c16eb82d2ff54fa2bff82c3cebdde55675de2d5525cb101a169cb841d1a561", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211840, "uuid": "c72601a1-8c20-4bca-aad4-ea62f6f792fe", "comment": "Malware payload (AveMariaRAT)", "value": "36312d57db997857d0a2f33bdb6368e43e2b5d51", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211840, "uuid": "83115727-b8d5-44a6-8877-04e5b252eaba", "comment": "Malware payload (AveMariaRAT)", "value": "2ca88488146de80a99942e4609212ef4204eb5efd17d99d39e5057d923fe05704f1bd962c1d36bf2acc6eff4b24e6f89", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211840, "uuid": "7e91f1e8-2077-462c-b52a-aace3da06a22", "value": "T17B549CD22585BC7DE5898CF19556C0BAC62DAF016DA33F432DFE7D6B7839011270AB28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211840, "uuid": "e39badee-9111-4f4f-9975-6e94236377b6", "value": "6144:JjEdoJNarUnYAzqUhyey7J0PFx1GAqeLQKFju:JjUozarUnzum1qJ0PzwENj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629211840, "uuid": "732b47ae-206a-490c-be54-b67b602ff10a", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629211840, "uuid": "4da331f4-c274-4124-a5b5-1f5c3486dcac", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211840, "uuid": "04858aab-82e5-4c63-b1f2-d0e26f076b53", "value": "PO Fwd PURCHASE REQUISITION 300321,pdf.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520e9a99-ff3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1629192439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192439, "uuid": "e88a33c5-6e9d-4e4b-bcae-a683a9576338", "comment": "Malware payload (DCRat)", "value": "aba88ae23ef00a022dd6a09105b5a740", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192439, "uuid": "1d13b562-6fed-4de1-a429-e7d3b82cc91d", "comment": "Malware payload (DCRat)", "value": "7711ab515c2fe669a40d2ee4883ededba88dff7c305008df222c2133469215e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192439, "uuid": "2cf7c658-cec0-45bc-a751-f6e9ede104d2", "comment": "Malware payload (DCRat)", "value": "1880ac009d18869d7f029bed378f7ef9276a7e0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192439, "uuid": "3f71acb3-99cb-4689-9b6d-9653a905a29a", "comment": "Malware payload (DCRat)", "value": "efceaa102334e0ab92f637b7e781b2d182da689c99c223565ef7afc196da1c540075abc5796bbb091a8919f6b2bb9d0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192439, "uuid": "1c01f86b-1627-495c-99d2-cbe5be4bbd9e", "value": "T13FC47C152BF86925F1BF5B79E4F06D6A8B72B81276A2EF4F048213D91E13740DC80B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192439, "uuid": "e54b249a-9a76-431f-a78d-e8ee320d4cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192439, "uuid": "28c0a956-9883-4ef4-8d42-b01202c16173", "value": "12288:TqnOm3Yx8DHoPDZKGdXdsXEJiY6L6/prI+WK:T+OmRoPwJ0JiF+/51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192439, "uuid": "b9f81fef-7a4f-4e06-b11e-a07499702eb5", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192439, "uuid": "190dd3d4-9cd5-4f48-ab8b-396ac115a49b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192439, "uuid": "9768b01b-62f6-468d-80a0-686b2974e295", "value": "aba88ae23ef00a022dd6a09105b5a740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c53e6a2-ff3c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629191920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191920, "uuid": "19a09f53-133e-4109-802e-5a9a1e957442", "comment": "Malware payload (RedLineStealer)", "value": "679b38d3297913cec51412919546f0fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191920, "uuid": "acf13650-8c6e-4f5d-96fd-7eb02c8e570b", "comment": "Malware payload (RedLineStealer)", "value": "77227b667f5cd74963793cda1cad94c60f3cd1a02e76677f690f683af537f749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191920, "uuid": "9df6a9da-7a83-414b-bb87-95f73ab700d8", "comment": "Malware payload (RedLineStealer)", "value": "9e8d7b30d8bd51bdcdf4ffdf3b0d5a97e77e71e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191920, "uuid": "41369a58-41ec-4ca5-a4ac-dc3f98da8b10", "comment": "Malware payload (RedLineStealer)", "value": "c48cce23b8205482c2d7e4695edb2f94b847bb2fa0809ea7e7fb2a834d2162e213d266ec540313f7a8b4b05a2d9d7cec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191920, "uuid": "8818e1b2-3824-4bed-b563-25d45e7b859f", "value": "T190A33B3263ECC629F3BE0A366870121587F1E0CB6401E75F5EC174EA6E767816648AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191920, "uuid": "86a1b699-bdc6-45d1-8ad1-8883bd690bbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191920, "uuid": "1cc6b271-8001-450b-9d43-7de6b1fbefda", "value": "1536:ko6aG75CPeGdVILNmoRQxgauwwVgbue7vouvNyAsdY1etx5REXG6WAaoigB:kdxlC7iIXN3oulyddJNWtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191920, "uuid": "c8071da1-ae92-496d-8d91-d9247c8b8706", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191920, "uuid": "a7c1a2ae-6e32-4c28-91b4-2656fabdd5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191920, "uuid": "e23a07c7-7c7d-464c-9daa-abd03f0255ee", "value": "679b38d3297913cec51412919546f0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edb88e0-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209211, "uuid": "8680a1b6-6b43-4152-a080-f6fe7f87e782", "comment": "Malware payload (SnakeKeylogger)", "value": "aec778addf308a39ace0c6e33160780d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209211, "uuid": "580fa5c7-8fb9-4443-b3f4-5ac15488ee28", "comment": "Malware payload (SnakeKeylogger)", "value": "77e8e5e5b95ad89242f5ba90a1d8acf523e1a4805d4ff438f20f84dea1d31823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209211, "uuid": "b8da8867-6e83-4809-b69c-c496568cbe58", "comment": "Malware payload (SnakeKeylogger)", "value": "7b31cfa9cf42dd9ad468e518ab50d87d98a68df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209211, "uuid": "b50de79c-071a-4363-8ec0-8a2d6535290f", "comment": "Malware payload (SnakeKeylogger)", "value": "5ea573dd7735a0c08ef4b630f5f1cf26ba1c031361ae31e11e9f75800137d60f14153642ac4f68b21c01b57dc12d7333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209211, "uuid": "03dd37d9-571a-46b7-92f5-8fbe8ef564cf", "value": "T1B3C44B243AFA501AF173EFA94BE47596DAAFB6333B02E45D109103874723E41DE9193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209211, "uuid": "3c818003-1ccb-4792-826e-f8268650e4d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209211, "uuid": "9fb31094-8fd2-413a-a123-eef7c1714b5f", "value": "12288:KbaIdXp/eiUtiXddU99nJgTj8UWQ0zbNJS1jOd5lKXzsuWTU/y1D:KbaIBU+fU3nvlNEWTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209211, "uuid": "20eb5d05-2e6d-4b95-870e-6f31c7185cba", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209211, "uuid": "7fe8397d-ad5a-4c21-9200-a5c8fa9755b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209211, "uuid": "e1c6dfc1-9d30-4d1d-bfac-63f632d59135", "value": "Quotation1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faf347a-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208730, "uuid": "91a0c2b0-e2dd-415d-84dc-06274071f5c6", "comment": "Malware payload", "value": "9e4bdfc0e5e539e1f9337184d3c2c6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208730, "uuid": "6a45bc2a-0b07-4ea6-9246-54dc1226ee6e", "comment": "Malware payload", "value": "77ff4ece037c8faf9a4854b8858a98f97222f4ad7ddcf9f42ee1cb9f3f972334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208730, "uuid": "3e32cbf6-ca69-4f09-a08a-792eb2633077", "comment": "Malware payload", "value": "25e5b5f4c79a6632fcaa9462a615cf844e08c903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208730, "uuid": "45d75db3-e256-48a7-8e82-fcc460740b51", "comment": "Malware payload", "value": "f26bf4691f6a78d93542f792c8d71025372a2118776c1b8d137cd32ee11d58a4ce1f6b253c0a2be3d8ce234a67787028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208730, "uuid": "cb5ceae5-0769-4dd8-a835-a2880e2b7554", "value": "T179651A3816742A27D07AC738DEE5881FF2A4B41F79726A1A70D617671603B42B8D327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208730, "uuid": "e68c6f7b-5cfb-4c08-8928-010bc57b87ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208730, "uuid": "c3d8e372-1511-4842-a229-af359d48b4e4", "value": "24576:L+skEc2cBz5hA+3FFnfIdCSlWDrEBOWusP5TFxmExFA:IBfG0DQ/tTFxmEzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208730, "uuid": "834fa028-b723-42ff-88c9-2f7e1019e601", "value": 1460224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208730, "uuid": "5b18d9b2-4ee5-4991-8750-6fd80b09b0a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208730, "uuid": "b4b6be83-aaa5-43ce-b07e-888ffa5c1298", "value": "210524PL &CI & TELEX RELEASE JN210524TLX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8573d08a-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209276, "uuid": "88f8dad7-c5f3-426f-b95f-cdbabc23bdb2", "comment": "Malware payload (AgentTesla)", "value": "15ff0a4c0f9b8083b0fee0ddb8a8ceb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209276, "uuid": "a4f00768-e710-4f9f-a283-ded17d691157", "comment": "Malware payload (AgentTesla)", "value": "782e7733c4659faba3d7766cf5e7dcd20e6d6173180ec9d07edb15ed9ec8f6b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209276, "uuid": "ee97440a-e31f-4a20-9361-339bb987d787", "comment": "Malware payload (AgentTesla)", "value": "df000439944f454a3c7ac51a7b820607dd31e2b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209276, "uuid": "7784d2c0-e649-4a4b-9f41-14c6476cc22a", "comment": "Malware payload (AgentTesla)", "value": "fbf82b75c050840502f997bc3792c971463f1b734236cb1e4e9d744fc8ae921961c7d984f75220105c70fafd5b2e3b9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209276, "uuid": "48b6b647-c337-4c4f-aca9-1e3223212c52", "value": "T1232571381BB92667D065D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209276, "uuid": "64f9da70-e67c-49ae-91bf-6eeedc23d821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209276, "uuid": "1ae2a126-b8ff-4cfd-b7da-399361fdb045", "value": "12288:OfeDc9F3nC0Py3gAhKEJbjJEKeaRCM3eS4nt01k8rb725MDTplylDmrAgtCbkKIu:4ACMh4vGHplEgAbRImVL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209276, "uuid": "a15a953b-73a6-4f9e-a168-861b04be19db", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209276, "uuid": "6c1ac505-2ae0-4e92-8e5a-5483e7b7feef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209276, "uuid": "20c2a6dd-c0a4-484f-a9cb-64b6a409f023", "value": "15ff0a4c0f9b8083b0fee0ddb8a8ceb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208896ec-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209107, "uuid": "c50a5194-b4a6-4fc2-8775-5593d79798b4", "comment": "Malware payload", "value": "4f13f4f5acbc860707fb4bc0a29e64dd", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209107, "uuid": "106e1e58-bf1a-4a23-92c9-328bbdd68790", "comment": "Malware payload", "value": "786f5cf445a55c8335e46f40d6868b78b36744bf16107351e8a298fbc14c0d59", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209107, "uuid": "3a36e032-6b4a-436b-a272-a26dc0376fd6", "comment": "Malware payload", "value": "ad17b37b7d7b8017a8460c8b0c6e3677fb1784b4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209107, "uuid": "fc1191be-5a6c-4030-bb9f-6fddef951495", "comment": "Malware payload", "value": "d85fe0f2c0d577f9a353888bed5f431aca1ad5268e4c9f51510579e601d2385f4e62ff0e49216ee29b394d6161af90cb", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209107, "uuid": "34a9b612-0acd-441c-8ec0-20d145c758c2", "value": "T1A503F905B391C622F19246354DD7CBDB733DBC09AE21872B33947B0EBC7A6B49A16724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209107, "uuid": "d55b2e9e-7787-48b3-90b3-a0677ab860ed", "value": "384:3S9D8yGcSdW+wRsCBkcsUAwJVVCNTBJukz7Wo8I5dginAvYthGjO2/:aVKCBKeVCTuqWo8MKDO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209107, "uuid": "0da59e64-30b2-4656-99d9-11da618b70bd", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209107, "uuid": "0d570c00-f44f-4d45-95e3-e581a7a38425", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209107, "uuid": "fee358b2-4534-49d2-871d-4e2b8280c13a", "value": "converter.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cb45e1-ff6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629212516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212516, "uuid": "2c04adaa-6ae8-4bfa-84ee-dc93eddff67d", "comment": "Malware payload (Mirai)", "value": "8563235e47c4a21e4e3db11795bbb3ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212516, "uuid": "227a5e28-f027-4b3d-a320-490d1b7264b0", "comment": "Malware payload (Mirai)", "value": "7884862da6e32c4a8a2b2d7f9909ee43c0a8ff23c95fd5a23fd9250708fad3b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212516, "uuid": "c5f75f46-61d0-44b3-86de-a9c24f0aa629", "comment": "Malware payload (Mirai)", "value": "69e684691f0f6456c13128817cf96ec2d37d37cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212516, "uuid": "6e2289ee-8904-4884-af97-43050e4108e3", "comment": "Malware payload (Mirai)", "value": "4d77e241309057bea9abd5f6a8625cccb7cce6637fb987c3faefa4f666fe1781b67aaf5f5f0889a968a053a7e64d9773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212516, "uuid": "e113ccee-5a36-46c7-9ac6-f032025dbeed", "value": "T1C7E3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212516, "uuid": "f280058a-c59c-4d14-abc4-78438fc92cd6", "value": "3072:MzBM1x2GPyaT/d5hKGE6aWURxuZq+1uPNd5R:ENORd5hKGLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212516, "uuid": "71cc8524-e918-48bc-a7bf-903e701c2ef2", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212516, "uuid": "0b604ff2-3be4-4252-9448-4688503eb46e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212516, "uuid": "9ca986ff-b166-4573-9de8-93acab7f0ba1", "value": "8563235e47c4a21e4e3db11795bbb3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4dec89-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198985, "uuid": "31c5ebe6-d204-4b06-9701-bd773f56ad17", "comment": "Malware payload (Gafgyt)", "value": "ddd098eb68a6bc2daecbbef3e3faff5d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198985, "uuid": "781d7064-690c-46ff-84d8-cd688cef2782", "comment": "Malware payload (Gafgyt)", "value": "78a7a710923b775f6a2bf8c4bb375794149a83913cf623114b80112c9e2ffc2a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198985, "uuid": "4cec96b4-10ec-4a68-83e1-aaaeda81fa4f", "comment": "Malware payload (Gafgyt)", "value": "d02d6a8f3aebfaf1681bd874fa1de079e79266df", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198985, "uuid": "4c223630-77c5-47b8-9f13-f374cfe40d00", "comment": "Malware payload (Gafgyt)", "value": "3fde829e136e0243b888ef0fb6e8c6506f11277546e76f347acf77d82492be61e1d104313fdf004075d6e49071e5bd7f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198985, "uuid": "388ffa6b-537a-4e71-ba6e-ca5793812a21", "value": "T1BDB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198985, "uuid": "af22c457-ee9d-4510-ae6e-6084071e219e", "value": "1536:ZLeT4kthhSMOCMQS+ZjN4pjuIxreg2O9N2eDo/TUmkiSFxfC7xbXe:ZXHC3S+dUresNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198985, "uuid": "43e55d5d-dc60-4b2b-b065-e4ab9477b70c", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198985, "uuid": "6d1b5c6a-2764-4c1c-8368-8bd5d4326acf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198985, "uuid": "49711330-98fe-4eaf-b120-865c82346c6b", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c41d35-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629164158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164158, "uuid": "0a1fb998-44db-4de0-9a80-32733bf9997f", "comment": "Malware payload (Dridex)", "value": "489648e916a24beee247a9cf73cd8573", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164158, "uuid": "330fc657-b247-4d65-845f-40148cbe145a", "comment": "Malware payload (Dridex)", "value": "791387541c2059c19c5032d5b5b553b1f4c6bb1f50c26ca80708b827a3ca67ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164158, "uuid": "d14576a5-1503-4269-9af4-acdee6d7db24", "comment": "Malware payload (Dridex)", "value": "f2bd5be5cfbfcb1a149d6c064a859d1bfe87fe81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164158, "uuid": "f1edbfc0-68cd-4b91-8e1a-c4dd9b53a50b", "comment": "Malware payload (Dridex)", "value": "276d34536f83f4b294c5be1514b4918872fc736740d30bc18a48765ce24149c5a023159d11021fbea04752990dbfbb68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164158, "uuid": "84004272-dff3-4ef9-baa3-03b0f5ba8009", "value": "T1DA341237BA458F47C14DEBBA2E5F1D78838346419705F2CDACB22E7A5E586B20AF440D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164158, "uuid": "5efd0846-a2bf-4740-92b3-091ad204ab64", "value": "6144:WogkLjLhpnWMEOlGneYSyoeB/bIh+aAY4Cd/1kcn:HDLZpWMEOUneYSS0+70Nrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164158, "uuid": "f040eeda-f0c3-478a-9600-e5b17c71e746", "value": 244938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164158, "uuid": "8d8e0484-a4b7-45e3-9aa9-4879a3e6355e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164158, "uuid": "5602fde2-5640-4ccb-acf4-99938a6254dd", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.951554.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bede1e5d-ff93-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629229559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229559, "uuid": "0fbc8d5d-b6ce-4cc9-83db-b4641a322b9c", "comment": "Malware payload", "value": "aadd1762bfb2453cb0003c164e5a0239", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229559, "uuid": "6a6e4194-d662-465a-a040-aa5c888a844c", "comment": "Malware payload", "value": "7afedbcc82dc9c52b5c888493bb624e62d4d2acecc414c6d77cd3f306512b3a3", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229559, "uuid": "79db30ce-8895-4605-af10-18f82ee4451a", "comment": "Malware payload", "value": "a17d2ac67f0592813d3c0df5a6c68739b0d2b095", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229559, "uuid": "e808cbfb-ca2e-4ba1-b438-919e35df32d4", "comment": "Malware payload", "value": "33df02f12a430fcf7c685aeb954b1f77aef1400df2c294be88751f284d94fd8ca4e98d3982c3a78fe01394aae2c5a42c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229559, "uuid": "75e37cbb-e13b-4165-ac37-50c4df0bc00a", "value": "T195C423B735B8B02BD6050060D185CBBC98120F7C97FB52DB86ACBAC65C93E16F8D9D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229559, "uuid": "58fe5488-ca60-4e26-b17f-a7177b1bb0d2", "value": "12288:H5ULeSAYa5RKSZfoV17Y+ue3LE9zDANYg3VkOjL8WPWm8UKRo2rE3:HDSAnRKSoZXulzMW+temnOoKE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229559, "uuid": "ea468dd1-aa92-4418-8641-90d09719ca83", "value": 586588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229559, "uuid": "c7eeb5e5-b09a-45da-b971-16e372d50ad0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229559, "uuid": "8ba1f1fe-d418-4ca9-a74e-2438bec242b1", "value": "Invoice-309-Ref-284.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3067a643-ff08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169620, "uuid": "6caeb9ab-c3bf-44c7-8869-804d5591c25e", "comment": "Malware payload (Mirai)", "value": "3db93d510a375ebab7815d7c919ba0fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169620, "uuid": "ae9bbd66-92ac-454b-8c9a-74bf5586684c", "comment": "Malware payload (Mirai)", "value": "7c66b6871002ed1d9b12de10437d2b2d9ea28e61e669f1b51c550aa3d252f68b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169620, "uuid": "ff29f7b1-94ad-4982-a60f-537b84f8b702", "comment": "Malware payload (Mirai)", "value": "0f1921773607a0c94b6080efe79e96fbceb19af8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169620, "uuid": "bb9f470f-c1ba-44bc-8409-7be15bc9ed7a", "comment": "Malware payload (Mirai)", "value": "8dc7aade3e3160a71e81c97ed473a7bb68ef7df843bea608264fbaaec5f9848854cfe163b51187486b9f94b88eb5f1c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169620, "uuid": "c5cb1cb9-9f28-4e61-9765-40c51de8c7fb", "value": "T1AB531956F8814F21C4D512BAF92E254E371617E8E2DEB2239D201F257BC792B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169620, "uuid": "f54d6a73-3102-45f8-bad9-81afdd875f55", "value": "1536:90nmKgn9ugqgJIplv85d66wX3UMqip3B2Hoqja106q:Og9uKgKdgl3B2Hoq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169620, "uuid": "fa6bd3d9-22ca-445c-bc5d-cd62b20003f0", "value": 65564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169620, "uuid": "035311c2-8379-457c-9e73-1ea688df84a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169620, "uuid": "587f76b8-c543-4868-ac8e-16fa7b2c8361", "value": "3db93d510a375ebab7815d7c919ba0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499d5726-ff3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192425, "uuid": "4fb54dc3-e54e-408a-9f65-9c23a0262cf9", "comment": "Malware payload (RedLineStealer)", "value": "af366ca287f4fff65e730d609d3f6bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192425, "uuid": "50283989-9816-412c-beff-dcb5266ca532", "comment": "Malware payload (RedLineStealer)", "value": "7e11f3d5986ac2c32716bcad3b59fd27f00fbed79ae57e1b76c3afb9762fbfc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192425, "uuid": "0bd4362c-e286-42f0-af26-0e3815a24e63", "comment": "Malware payload (RedLineStealer)", "value": "724807d310901de2f130f4a42dfd2f78676c029c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192425, "uuid": "e834a9f1-b540-4e91-a231-b51c139f7b7e", "comment": "Malware payload (RedLineStealer)", "value": "d5b3e619faa709ea6a27455cb1ebf83713beecadb55d4b0f3c549d3424ef89eb22aa882daac7df01e0fa3f79985044d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192425, "uuid": "aed462a6-4d30-4395-8f67-5895e99a3e9e", "value": "T1FAA33A3663ACC719F3BE4A366870011587F0E0CB6402E75F9EC1B4EA1E767826548AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192425, "uuid": "6bf49907-e51c-443a-88aa-20c26a951d0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192425, "uuid": "1b135068-9110-4090-9d6c-3d0d6f864f6e", "value": "1536:eo6aGLmCRUGCgKRCvwLqop9FbNcauawUgbue7vrEvNyAsdBwetx5REzG6WAaoige:edxiCEgKYibXNy3rElyddfNWZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192425, "uuid": "8b12465a-f31f-4652-9bc9-3507395af3c4", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192425, "uuid": "cd50f4fc-2731-4513-848b-455aa1c37db5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192425, "uuid": "fcf36a6d-9bea-451a-bcaa-1c1c81307e87", "value": "af366ca287f4fff65e730d609d3f6bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4921e3ad-ffb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629242676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242676, "uuid": "8d8550ec-392e-44d2-825f-6c6467cf07df", "comment": "Malware payload", "value": "43c16a3c557cadce8a74c418e683a32b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242676, "uuid": "2102ca9e-b169-490a-8710-3266e73b06c5", "comment": "Malware payload", "value": "7e3349c6dc753cd5b5ae5d89d4f4952838d31e4780dd2872cc0c6ae8b962cada", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242676, "uuid": "0d9242e4-d0b3-4a1a-a8f3-c89894b38b6f", "comment": "Malware payload", "value": "782ac9aa349761133f2d23c5bc85154015f83552", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242676, "uuid": "a9aee2d1-4893-46ca-9424-c2ac320760ec", "comment": "Malware payload", "value": "42fcb2df6376636e3dbea9236cdd768eacea50771fdab42ec5971310dce3bddd9c311b68090f5ec8771aa83a39688233", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242676, "uuid": "548b22f7-0eeb-4631-a273-44e007b7a45b", "value": "T103D18201E7A89733EDFF4B36A9B393814370B758DD23DB5F0884611A6C666914A32B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242676, "uuid": "ef52fe79-382e-4c68-8742-17316fbfd7bb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242676, "uuid": "5da974fc-0797-475e-a6c6-a3d51db74760", "value": "96:5euP6FcHLeNw76+ZwDQcI6H7qgo5Z0Amo6vCTrjyx4:5J36Nw71ZZ6bqBHprjyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629242676, "uuid": "b36ff0db-9731-4585-85ef-bca7043d1be6", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629242676, "uuid": "a0bf1952-bbcb-4047-9b75-ba336055c779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242676, "uuid": "09165725-0e57-41fa-b590-6d88b0a97c92", "value": "skfk.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a2a83a-ff1f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629179727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179727, "uuid": "fd436745-0ed0-4035-a81c-80727b82e24d", "comment": "Malware payload", "value": "8e696854a87a2bc2b7bf6a3358067a24", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179727, "uuid": "5eddfb17-e912-4911-94bf-b19e3b0eac09", "comment": "Malware payload", "value": "7ed26b0c689718b8a38b889c1299f90da39ff0106ed9fbfddb467daace2102a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179727, "uuid": "c6a6a3c9-44bd-4e3b-b488-d94b419a64a4", "comment": "Malware payload", "value": "bfa77e44d95889b47df4c0cba7351f7e563ca0c1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179727, "uuid": "61192fbe-1072-4681-82cf-97fef4d85a63", "comment": "Malware payload", "value": "3b01a664d4a222a76afb286f5a1b055bb0ae865ca0e42345baeda2f2b69688d6730243e1e1fbdd02489f8211d95ae199", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179727, "uuid": "d5ad4436-290d-4329-ba33-9e2c19cfe872", "value": "T1DF225C28D552B817D115087CD1A582F4E31E5133E612FD3E1454B2DE4BA17D347CEEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179727, "uuid": "b3c7d7f9-bd40-499a-9533-e62df504c2bb", "value": "192:ScIMmtP12G/bWvsq2VwONXrdlJFOyX3/z5b:SPXjmx2KOZjJFlnNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629179727, "uuid": "b13ec52a-9a44-449a-88a2-02d401c15a6c", "value": 10335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629179727, "uuid": "93e2df3d-0139-45b4-ad2d-6a639cad85fa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179727, "uuid": "74c0caf1-bed2-465c-97f6-46a24f3683ed", "value": "Purchase order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5d20e0-ff87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629224458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224458, "uuid": "2fc64746-92af-4a53-869a-38156b867977", "comment": "Malware payload (Formbook)", "value": "ecb6961afcce09226b552a95c6a563ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224458, "uuid": "f22f06e1-00bc-4d64-b606-366fc03096ab", "comment": "Malware payload (Formbook)", "value": "7f0599ad186f76d0d5ae5daf5e713747281b1b631bfef0cb340b2977ed53d253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224458, "uuid": "5e3d5a33-8a0e-4194-9072-f24a72e69595", "comment": "Malware payload (Formbook)", "value": "a7cd1c0b74b325665e90e9ebee79f8f6f214c683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224458, "uuid": "bca8634c-7dc3-429d-8ee8-f279b1fcc822", "comment": "Malware payload (Formbook)", "value": "b56ed77b247f0b786619d985da350759be39359fcd12680c83f0781f0b300524cbfeb5865c374febb7f9a0f476116a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224458, "uuid": "fc815d32-d669-48e2-a973-f711e55312c7", "value": "T13805F63C19B83A27E1B9D725EBE18417F190949F3521ADA8A8DE03A70307A4775D733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224458, "uuid": "beda2643-9b76-4b70-a675-d50297b86eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224458, "uuid": "76ee6eed-9e2b-4141-a1d7-15d201ca6ac1", "value": "12288:RmDc9F3nC0Py3gAh/9xqIKujVs3Q27qWx9Uc0obNevohqBDfLD/Xpqlnp/Tjm:RAxoujVWx930Y0cqxZqlnd/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629224458, "uuid": "820f35c8-a13f-4b51-983a-cc3566b4ea46", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629224458, "uuid": "7aca7395-896c-40c7-aa86-e821b1cf4e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224458, "uuid": "036619b5-d47f-4ad4-acff-6155a3964f14", "value": "Open Order T2_110721 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c721360-ff15-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629175384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175384, "uuid": "b6c01aeb-5d13-4fd4-8e03-8ddf186b03cc", "comment": "Malware payload", "value": "41b70280d39130c628e89fa36d1913f4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175384, "uuid": "1e904a3b-c32c-4d04-8416-5453c06e2acd", "comment": "Malware payload", "value": "7fbea70151ce796ab8dadbd278fc907d8ef39ce8d6f049d50eddfea2c392b1b8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175384, "uuid": "a1391f37-8507-4b30-a7cd-711cae542666", "comment": "Malware payload", "value": "58969f2dccc1a68a44bf8d62a0e67f6035f3e87f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629175384, "uuid": "91f9007b-b667-4697-8709-21c6a48a5341", "comment": "Malware payload", "value": "631022c749dee2f822702ee333c4d7dc5ff692d7eb625f01a988118e4c2e5d89f2d86fb24da0a4c5aebe0246075cd5e7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629175384, "uuid": "65f1e192-917d-4273-a0eb-6747437a5765", "value": "T12B12EEE85043D090F25E451B36AD7F9580723347F2E85AB6B7774980CBD7E2478E988D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629175384, "uuid": "135cd51a-28f1-4f37-813d-6bdadaa00a62", "value": "96:SWE3IZ2eq5XIcll9FrTXDZC9oj9bxpp5anOtAgHTgHWFBwZ3K0VRP:SWE30c5tFrTXl36O6WNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629175384, "uuid": "fde16d55-6951-4d8f-99e5-ac74fa9e0b6a", "value": 9381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629175384, "uuid": "7ae7acea-07f7-4a3f-94b1-a3b18209ea5c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629175384, "uuid": "ed6bc691-bcad-4120-8e1a-b9b5efb85bb2", "value": "update.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9563c0ae-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212309, "uuid": "2cbb0d93-8acb-4dd2-b8f2-d185100fcd51", "comment": "Malware payload", "value": "fa78d1d0ef30fafdb9670abc29deb24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212309, "uuid": "60cd16cf-d23c-44dc-a41a-3004c350ccf1", "comment": "Malware payload", "value": "80877119f9ddd3a9f4740e0b04640d3fd1793787cfb9d45cc5f23ed318828b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212309, "uuid": "fc0a9b70-73ef-46b0-8b7c-ffb8166e1feb", "comment": "Malware payload", "value": "52b8bf6a36b6f4f74718c51c356112368110807f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212309, "uuid": "fdfcc37d-a8b9-4878-ba63-a7da7d3132fa", "comment": "Malware payload", "value": "922b3262f31bfb0c6feb0c12c0a0e58427fc8d241eebad42bd13291296d7968b17a25f1f75dcf1f006a8e579ac56e999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212309, "uuid": "0185459b-84c0-4cd4-9e72-e3d088fc0602", "value": "T1CC15E43C19B93A27E079D765EBE18817B1509C9F3521AD98A4DE33A70337A4274C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212309, "uuid": "780a1bec-108d-419e-aa66-4f13ed04e319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212309, "uuid": "67b0bda3-9fdf-40d3-a4b0-b8f3d1662ea4", "value": "12288:1FDc9F3nC0Py3gAhgqeJbNo6CBN0bm1acX3x81GzE0ELQ1wBDrUYSi142+y:15bN0RKWgE0mQ1wBfUFy+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212309, "uuid": "5641506a-dc5b-4ef1-8b70-5de2b36c3fa4", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212309, "uuid": "39fc8121-27c7-45ec-9849-ecb8db8a645b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212309, "uuid": "a4e8cd09-e93b-42d8-b25e-fe15f40260de", "value": "Btc payments copy_3000 usd_________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10997ee3-ff48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629197054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197054, "uuid": "444a2cdb-4ae9-4d45-a705-fb7834e6e9ea", "comment": "Malware payload (SnakeKeylogger)", "value": "e6548749208c5277f7484e157f907f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197054, "uuid": "ea9808c3-a0d5-4cf7-8a4a-51312e853fe1", "comment": "Malware payload (SnakeKeylogger)", "value": "80ebebc8221b876c5cfd1f93d9dd6685d0e6bae8238648fa529ab2e1644e3cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197054, "uuid": "b33232fd-aeea-452e-988f-95da07dad255", "comment": "Malware payload (SnakeKeylogger)", "value": "270a15384e0d9cc1c81153346f3662c7a4e758b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197054, "uuid": "9c398750-eb5c-4dcf-9965-cf08ffa92c1e", "comment": "Malware payload (SnakeKeylogger)", "value": "4e361e9e25b7f4647cbcc20511a0223963f9958e7df14a346119e334793185285abfa5f2954a7b064c22feecedba0911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197054, "uuid": "20722984-0109-4a2c-a6f6-8a31d0dae918", "value": "T16A256F381BB92667D165C63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197054, "uuid": "bb75a7fe-8780-43cd-9a72-ae77062a57b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197054, "uuid": "20f090fc-8474-4c92-a71a-63f57800b180", "value": "12288:VxDc9F3nC0Py3gAheEJbjJEK/KpFTJWGwtNJkofEeo4Cb4+DffHRmeU2x8Czz5g/:tKpdEGwtNKo8ec5fvhBxZRMAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629197054, "uuid": "f84735ec-48c5-4de2-b590-0601367886d1", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629197054, "uuid": "8e2335b5-4f7e-4319-855d-3752c9de01c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197054, "uuid": "bfd17c4b-1626-4b0e-996a-ad31c0c1967a", "value": "received PO Ref-28414779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02f7d98-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209428, "uuid": "ec305ce9-eab4-4398-8342-1fb3d7454b6b", "comment": "Malware payload (Formbook)", "value": "6f0f781a5819806c3e0420f59138e5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209428, "uuid": "8a889445-b94a-407a-9fc7-34ef104423af", "comment": "Malware payload (Formbook)", "value": "810c39a977bd6a0103ae8a682d0210d3908440befddfeb5ed739f1469b4d1d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209428, "uuid": "711f76b8-920c-4fbf-ad92-d50db3012b8a", "comment": "Malware payload (Formbook)", "value": "02550fd8e088b42f89ac26a71e9a032427dc0f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209428, "uuid": "37e4afc6-7194-4511-a3b0-1d66dbb6fad6", "comment": "Malware payload (Formbook)", "value": "7818e68b62819c0d5f9d5dbe67bebeb9b554e3ab510889aacc464ee5615b280d80fab4d679dda013b0771797656842d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209428, "uuid": "ea149dad-f922-4338-9a9f-155ff42185ca", "value": "T17784DF12B6C29037D873107642F6A579593C7B311B1F9AEF279859B88F301D1AE30E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209428, "uuid": "453cc699-6b9f-451c-85d2-be5f878ecded", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209428, "uuid": "dca09840-6079-4b66-a172-6736d9c28d68", "value": "12288:L6xU93RxXt5OB8yvpoiiiiiiiiiiiiifVcA86z12L4+jNf+6bi7ErDln:L6O3x9/QfaA86s8+l+LEXln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209428, "uuid": "6973183d-9f4f-407d-82ca-38fc5188fb23", "value": 393331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209428, "uuid": "1788045f-72f5-443c-8c55-27363e2a411e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209428, "uuid": "2504c0ef-68df-4524-96c6-1e593d044577", "value": "bothh300123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d53d19-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212146, "uuid": "4f7b560a-fcb7-4e50-a06d-f571479b5c82", "comment": "Malware payload", "value": "fb4b33133ac61d537322520e6aacdf44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212146, "uuid": "eedd4821-0643-43bc-ac85-aee14fa25d0b", "comment": "Malware payload", "value": "81d32df1698d2cefa7a8495eac34adf2f16d62d75e19c08213b8fedd325dc048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212146, "uuid": "a1da36f8-0036-474f-827c-5b1dd1e4823b", "comment": "Malware payload", "value": "91cb7895bd31331e8ead77135b7e3acc182258c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212146, "uuid": "f48dd4ba-b114-4593-a309-b6bbb9e4f07b", "comment": "Malware payload", "value": "f5a2d2b6f8b295021efb332bcd3725d4d733410d7b542299eb1e81aada5a437de7540a7b6892e7f5794e8687f1c7615d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212146, "uuid": "93528728-f35e-4730-ae7c-ec3fb6082c14", "value": "T1A955EA3815F8793BE17BC339DEE9482BE7D4B45B7111AA1670D6136B0203E42B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212146, "uuid": "dfbcae63-043d-47c1-bb58-9a1596028dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212146, "uuid": "45ab4ba2-8c13-4ac9-8e3d-f9e29ce7f5fb", "value": "24576:jJjoFcec2zNr/VqbFnu8diY6l+hYSjFlN2Mw0MnvKBtJ8:kABRiYu+T3NA0sCBtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212146, "uuid": "cc9b206b-1580-4942-8882-8ee896ce13ea", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212146, "uuid": "c16ee8ab-dc8d-43c4-8e45-8b408432d7f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212146, "uuid": "1d2fc39d-3113-4ae7-bfa6-3f77cea8aa0b", "value": "fb4b33133ac61d537322520e6aacdf44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8681901-ff2c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629185390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185390, "uuid": "090b8b25-1da2-4fa2-9f46-fe985799636b", "comment": "Malware payload (Loki)", "value": "8af751ff0dc5ee73b9e677b2c3ef9e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185390, "uuid": "6c6ac907-0674-4394-8b22-eb396d34e34e", "comment": "Malware payload (Loki)", "value": "82b74f8d92c48a8fb1d81c9ab0fd19d7b22cda935f3a53072ff8cb84295f57b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185390, "uuid": "e366ea21-04be-4e7e-ad8e-2dcb3e88311a", "comment": "Malware payload (Loki)", "value": "b72343732b7b2437b33fc23b3591fc899da372bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185390, "uuid": "2ffd900d-5e37-4859-a979-6c80bbb61ac1", "comment": "Malware payload (Loki)", "value": "0d3f6a9409c46d26cd31571045b1d4c5ccbdfc863ad8a39d290ee29e1a86f685fad97c3ab182bc23f414e2845b81955b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185390, "uuid": "e77731cd-4750-4ece-83d1-05c56b07e501", "value": "T1AD35B73A15B82B27E079E365EAE44417B3E0955FB225ED59BCDE03A70206F4265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185390, "uuid": "50d1337a-3376-4296-a5e0-8b272bfc38cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185390, "uuid": "03610ceb-68d6-46ac-8be4-555834823985", "value": "12288:ejoDOQVRDFCFYJDc9F3nC0Py3gAhhIIalhByIiQqYRxOreiAkwAdfqJH3f9wZPj:e2O4JCFYqblhB6YzRwUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185390, "uuid": "7eaf91a7-afa1-4be6-8c1b-d2d5f3a7a139", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185390, "uuid": "a0f75a67-dfa4-43bb-90cd-822f4f61c86c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185390, "uuid": "952bb978-9d3b-41a6-9397-3c1c6971eaf3", "value": "8af751ff0dc5ee73b9e677b2c3ef9e9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e89cc7-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629213359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213359, "uuid": "414a4417-910c-4581-9c7f-f09e3cd55e1e", "comment": "Malware payload (njrat)", "value": "fa976fd4ba38d31a2ff450289b214e97", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213359, "uuid": "cfb9c075-c319-44ed-b067-66a7cc3ac5b4", "comment": "Malware payload (njrat)", "value": "831d7b676bb75c44df50f40798fe739cb07d4c0b1ee217a7e8fea443f7b00346", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213359, "uuid": "3707cc95-e920-47f6-98e3-c56c2ebe553f", "comment": "Malware payload (njrat)", "value": "2c6583a86b29e4cfb12a8d2ea67855542b102a06", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213359, "uuid": "ceed3a00-9ec7-4b02-b958-1e173caffcef", "comment": "Malware payload (njrat)", "value": "a86fe659e7c509dd9d7267158970f7290473bc06a3653f83dd01a95a29df29b43de806bca24eae808171c9e67dc82632", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213359, "uuid": "edfd0027-881c-4231-bd99-1224757f1ff8", "value": "T130317E0870335993EA06D42231A731DDBD312748AAFB8B71155EEA42AA409BF5C5CAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213359, "uuid": "072b7d58-16b1-404d-b75f-5aed06f6215b", "value": "24:rEEPdqnWa9SN5JPpUI0I2rWGItUIZOIIIPITI3uFIJwIEIfILdgcjacdgcquU2bD:3tRx2Ahn1wE+FIzhg3Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213359, "uuid": "1b6c241b-107b-4a9a-8948-d0eeed4284c1", "value": 1597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213359, "uuid": "f8925141-b91f-4e8f-9e26-09f7d50637f2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213359, "uuid": "6074873c-d1c1-4e99-bca1-2a8035c1e620", "value": "In_WO072.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf2a85-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629206921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206921, "uuid": "7e8fd17f-957f-4157-903e-f405449d08a2", "comment": "Malware payload (CobaltStrike)", "value": "aed10704bfb8f9eff057d5523b9ad431", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206921, "uuid": "3ae19092-d7aa-447e-a0ba-a0101172d186", "comment": "Malware payload (CobaltStrike)", "value": "8370b5aaf5d21fdfe7052c90b1e6b8fd3e0fa0bc26007badd416b1d4a99bc3cd", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206921, "uuid": "b0e0df52-fed5-43b1-a240-fed72dca896b", "comment": "Malware payload (CobaltStrike)", "value": "ff6966a1e5c4d087dc248eaec4a5f7335bb6ea8b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206921, "uuid": "0a7460c5-fccd-4ffe-86bc-33ec3f4cdf0b", "comment": "Malware payload (CobaltStrike)", "value": "09562800ef538eeec1139fe6486ef06914b340396ca35366eccaaa7a28b0e1119999edd7d826ba22546a138d2ae1a23d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206921, "uuid": "a93b8f15-c362-401f-baee-8f773798ac84", "value": "T1DC233B62BBA4595AE8F14B3B1DED3B1608217D73883CD05C73C8558FCDB2A06E9517B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206921, "uuid": "92e48d44-f416-4da6-8ef7-260e746c8f23", "value": "06e8f0aa78077662ed7dc65b668aaf46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206921, "uuid": "84bce435-5cf1-4ad9-9579-3ad7befc6489", "value": "768:YTLREdIbQ3eHapzEMPKBLHLi8fUCUNR/llS7Pgasu2ZbykxpTrs4duRxa:FIbQaapfK9HLJsCyRj/u0rs4dcxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206921, "uuid": "bfbccda9-4624-4a5f-be34-ca6fbb4030ad", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206921, "uuid": "f732271b-796a-45fe-91fe-4fb8dc5b88a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206921, "uuid": "bb31e59c-abfa-4cdd-b561-ae9ebe983eff", "value": "cobalt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72892de-ff09-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629170275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170275, "uuid": "afea1ae3-51ff-43ba-863e-430e385a7194", "comment": "Malware payload (Formbook)", "value": "815a3dbde4d501e96222d6de9b0be3fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170275, "uuid": "19179550-38a1-4e82-9160-dddf98821ee7", "comment": "Malware payload (Formbook)", "value": "8402867c8ded316ffb97af7aaab3fb6cea74a31bbcf4742e614f927d98b84914", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170275, "uuid": "f05dedc5-9521-4360-9661-4a0c01655914", "comment": "Malware payload (Formbook)", "value": "7dbeb3995445a6143043490dc44530f283d26afa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170275, "uuid": "9a54ba93-8c8b-438e-8b85-a46e6a29411d", "comment": "Malware payload (Formbook)", "value": "1e506cd13c80ed450cb764d3caaaed6190133817264badbb6f6e9db90fde34bff9a85b274d48925eb7314df32dcf8b37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170275, "uuid": "a5e3db98-f04e-4c89-baa8-eefc84130bda", "value": "T1BA25A13D2AF92627C1B6D379CBE69823F04498AF7415BDA598D753660303A8735C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170275, "uuid": "318d960d-0942-4981-a21d-53ecbc584ee9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170275, "uuid": "c727f1c3-54fc-4caa-9708-6a47922b5faf", "value": "12288:yDAxqubTcpG5y8b61SY9UOX5xb6NQC+R9+ufQDDn1PCgj/Wn:hquIG5y8m8TOXDbbRsDbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629170275, "uuid": "b1d24abf-4a5d-4398-87d6-1542af5a5d56", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629170275, "uuid": "20d9abcd-db59-431d-a69e-64e61f6a68dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170275, "uuid": "fefdd49b-c7c2-4848-95f6-43af0e8ccae4", "value": "815a3dbde4d501e96222d6de9b0be3fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b2f204-ff05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629168400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168400, "uuid": "8bd5a451-c89b-4451-b04a-1cdc28a86dfa", "comment": "Malware payload (Mirai)", "value": "1fbae4e1cbe062c2635cc18b96c0963a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168400, "uuid": "20e4634f-69fc-4650-8b42-2ecbe96c6d02", "comment": "Malware payload (Mirai)", "value": "84f0aed1295f5a29a86064c654967a330636a203dff0875b08e5e6c4bf8c4ce3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168400, "uuid": "1c53e6e6-a4b3-456d-8a7c-6484220374b9", "comment": "Malware payload (Mirai)", "value": "9d784c8ff24edd0c680d87bec38c041c76490af8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168400, "uuid": "4f4dac9c-a3d6-451f-82d4-03d0f8e0c04a", "comment": "Malware payload (Mirai)", "value": "6b229e3a44be5dd411ef24d6eeb24b255d7d4b3d11fba50231686de266a464b56095a6ddf2aea04276d2c97a25ac0a08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168400, "uuid": "0b036803-1de1-47ef-8d71-371acb7d88c9", "value": "T14E634B0272280F47D1A65BB4253F17F083FEE9A020F4B689264F8B568636E371486FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168400, "uuid": "7bfe696b-5491-4f11-be9a-1d165d2b3b93", "value": "768:xfRjT0f5qRQ1hSGviBmJBrk8o8IatiNE8JKFwt1jXbQqvp2MUhtBTHZ22q1EyGjV:V9e5qWStmloKcbt1jXt2ttHq1EyG9n3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629168400, "uuid": "954d8195-73a2-4fb6-916a-32277956be6f", "value": 68656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629168400, "uuid": "f3d2e98b-e3c6-4555-b9c0-dba98dff8c39", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168400, "uuid": "29da2c3b-8a50-4f74-9597-6a24a6c6d634", "value": "1fbae4e1cbe062c2635cc18b96c0963a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275c4670-ff08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169605, "uuid": "88ee7e28-225b-446b-bca2-b5ebc4c1639f", "comment": "Malware payload (Mirai)", "value": "d4de6425af09766494b9f725cc7b0921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169605, "uuid": "fc3fffec-7b41-438e-87d9-0fa00a3293d9", "comment": "Malware payload (Mirai)", "value": "856d2d378c060a3dbc338af6e0dca64d4d44b42600cfa26b3e66a4fd50215c57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169605, "uuid": "d188e561-5ee2-4d53-94ab-7326fc66ceb2", "comment": "Malware payload (Mirai)", "value": "e9a4fbaecab14b769c032e6581f4a1505c1cb263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169605, "uuid": "ab0c6d21-14b6-4564-8b16-b9456bfaa367", "comment": "Malware payload (Mirai)", "value": "6ae18ba7176ec401a377f1f9b30696c61e94269272a9f1dd19d0361fb11758110b201338d4ef67e84df57e633e44276c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169605, "uuid": "2c1a3bb9-39d3-43a7-b1e5-561a92b647b5", "value": "T113338D75F8291E94D15642B4A4248F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169605, "uuid": "711fe777-45a1-449f-9105-1553c882015f", "value": "1536:mamyClrLp7wnwib4dK7a1oZLXrXCr/3a10:mVyH03oNXrXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169605, "uuid": "c674ccd0-d7d3-4b10-a7fe-04b6688538fc", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169605, "uuid": "090e1a5d-4166-47cc-925e-e0a0ae828a78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169605, "uuid": "3548cee7-aa64-4cc9-816a-341c983862c2", "value": "d4de6425af09766494b9f725cc7b0921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb5bbda-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629206871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206871, "uuid": "64311342-f840-4a0f-90d5-1ba4599e7fdc", "comment": "Malware payload", "value": "9c9e61bb17c37a99e69ce8a19866b755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206871, "uuid": "9602e71e-5daf-427c-9357-0ee049d4e2a0", "comment": "Malware payload", "value": "85c33710a2a0b804e04d953029df47330b86b90752130210226617cf51efa24b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206871, "uuid": "086ed158-7102-4d3f-8889-77bf2681a105", "comment": "Malware payload", "value": "14e83c5a384a093185dab06a63230478053953d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206871, "uuid": "25f32653-dc23-4dbd-8ddf-1da9943e2f46", "comment": "Malware payload", "value": "9375303a36ba6e597061c84c53a5b16037bb3afd236a8f026ca75d818e33b7c3f28d797b0e528c19ce4e7cf3b7b054b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206871, "uuid": "1728eb5a-13a6-4988-9469-874c71577ad4", "value": "T1A5B3CB9D766072DFC85BD472DEA82C64EA60647B931B9203E01716EDEE0D89BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206871, "uuid": "efbd018e-985f-4969-8ff1-84aab1363983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206871, "uuid": "bf8cd942-87ef-4bc6-815c-5c336edae969", "value": "3072:Pd5Bpo22WM8jPN8BNRoP/UPo1iFjbkBXYxAe4S8Y:JiWME18XyP/UPo1iFjbkBXYxAer8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206871, "uuid": "08e87c09-aace-4690-92f9-b382de6cf145", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206871, "uuid": "5fd07ced-2d7e-47fb-a8ac-29434f43fe41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206871, "uuid": "9fa58d80-ca07-4906-b91e-62a3bf2cb0d0", "value": "9c9e61bb17c37a99e69ce8a19866b755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1c6c97-ff34-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629188757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188757, "uuid": "4c58ccfa-0ae5-4f7f-9573-f9cc7498930c", "comment": "Malware payload (RemcosRAT)", "value": "9f32409ee55f0db63b58b3645a6b1943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188757, "uuid": "ada7efb2-cf69-4ba6-afa5-c780cafd4f17", "comment": "Malware payload (RemcosRAT)", "value": "864081d9870b1b81cb2c750b630a828b191f7c664790c54115a8033351f50ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188757, "uuid": "0e56fe0f-a7e3-445f-9cc8-19be6f4798d9", "comment": "Malware payload (RemcosRAT)", "value": "80be2d5f474eaaffcd9ad3b5b67ed7c8e2833d45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629188757, "uuid": "9ddec977-688b-4eaf-9f15-8606c9f248ff", "comment": "Malware payload (RemcosRAT)", "value": "50cd7c2f9b3523ee0620406bd05115641aba941810690f5326b234cecaea11271f68c4a5f0263aca5ddd5e618974b518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188757, "uuid": "bc033cfc-81e3-4b31-815e-b168284bcbe8", "value": "T108457C5F7E916E34C55609771B4289B8693C7DA0BC10681E27FAFE8F2A770E07D44A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188757, "uuid": "194df6a7-5194-4411-aa8f-0db2e04f7303", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188757, "uuid": "36260837-1c6a-40ed-b7b9-9003ffa41419", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0F:8ej+XQUeET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629188757, "uuid": "f3d2409f-c770-4f0e-8cee-95b550f13d97", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629188757, "uuid": "ab33bb63-73ed-409e-8f12-ebcd99898656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629188757, "uuid": "05a62adb-5c25-404b-9f24-f9fefd848f46", "value": "Birchmeier RFQ_AP65425652_032421 urgente,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b73b787-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208722, "uuid": "b0d17010-52e1-4818-882c-9c72fbfa7294", "comment": "Malware payload", "value": "c8f1cf0b8cff3863078bb420f16ce4e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208722, "uuid": "b126d691-726b-4c18-aa63-1f598d7627c4", "comment": "Malware payload", "value": "879cf3f6a752243ff5d4cc2cfa4a5266a39104594688e7a0068ea21d6e07c070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208722, "uuid": "5850376b-9020-4702-a332-e558758f03f4", "comment": "Malware payload", "value": "865bbb1041c555448ed9e564d666306f7b776117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208722, "uuid": "2ca591f2-f59e-4d9f-b9a9-6f3934850113", "comment": "Malware payload", "value": "1ffe4cecb7eafb57f59d28e2bc1dd2fbae78f483ae3ad6c9cfa11db1704f4995d80ce305701fae64d96e74494fade081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208722, "uuid": "23794675-55dd-43f2-8527-f92aa801513c", "value": "T1FD550A3825B4393BE17AC339DEE4481BF2D4B85BB5116A16F0DE13670352706B893A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208722, "uuid": "a25dce65-56f5-4699-b31d-664ff3e29669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208722, "uuid": "a0d44c00-610c-4f07-a64c-2cb03a7bb129", "value": "24576:b34oUcucWzls0FMPsQzVFnpHIXtxO52OQ8z45XhkhVXTiQ:G6BBQtxO5dQ1uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208722, "uuid": "db910e61-2f3a-432a-9a66-789b4c4e6916", "value": 1406976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208722, "uuid": "ff46b63a-2530-49d3-a8ce-4f433fdaafab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208722, "uuid": "1fbe54df-6d94-4715-ba49-7b687a23bb5c", "value": "PO2021V1Kp3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a6b6f5-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629192737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192737, "uuid": "98db29b8-8abc-450a-b7a0-995e0fb9e976", "comment": "Malware payload (Smoke Loader)", "value": "d8d1192b054172a5421790d411f0f949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192737, "uuid": "b2b4ccff-d9e2-4333-bd74-76549004866a", "comment": "Malware payload (Smoke Loader)", "value": "881809c7838ffda4805b1968e37c25dd5f1d9d02a6a2aadb7695705167d45cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192737, "uuid": "2e6e8ea7-cbaa-4f35-8215-31449bc04f1b", "comment": "Malware payload (Smoke Loader)", "value": "6c3e323c9e3f902f3d2d57217d96296d8741ecd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192737, "uuid": "faedf1ce-f7b9-4e45-9e5e-1903b9cb3e70", "comment": "Malware payload (Smoke Loader)", "value": "0429fda5d3caf7b8188af661796ac508b0d576e05bbd5df4e650cc58f90b70f743aceb13e8d5d544342d19d3212942be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192737, "uuid": "bb876754-535f-43f2-9608-c2dc15e359a5", "value": "T106547C30B790C030E5A605F495BB83FC65297DB1DF2490CBA2D52AEE5A346E89D3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192737, "uuid": "5136578c-e19e-442d-8496-396d5280a1e7", "value": "e16577a15d2f4b952ae6a4b3a61075c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192737, "uuid": "2834a590-bcc3-4034-8492-fe77c35920e2", "value": "6144:SEktNtsAr1rrlfnMEyJ2DUyYbW3Hfeh3z0kA:OtXsArplfnMqUyh3yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192737, "uuid": "a9681d28-048f-4bd6-bfa6-021b20f73170", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192737, "uuid": "900cd4f1-5a76-4d35-a129-1d47f3240e2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192737, "uuid": "2eca26ca-758c-4c3e-89ba-d8922f72a5ca", "value": "d8d1192b054172a5421790d411f0f949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5d874b-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190256, "uuid": "91758eaa-7008-46df-aec4-42ae31b31930", "comment": "Malware payload", "value": "ac05f8aea8b2ca5cc7f574f852584ad0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190256, "uuid": "23c09d65-6381-4828-8eb2-ad2a7b511dbc", "comment": "Malware payload", "value": "88465f728f7a1d9efa419e8c4c4688346a7b8caf1960bfba20c2b666687a8e4c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190256, "uuid": "73c12f16-4ff8-4e88-9b9e-e117ba03ed8f", "comment": "Malware payload", "value": "f940715e53472dd13312057e4664b4971236fde7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190256, "uuid": "ab49e94e-2e43-40e1-a682-a10762b65efd", "comment": "Malware payload", "value": "8309474f93e02bd389979ebaf5159022570952ea39d90e5387bb15b589f863dbea67a0bed9fabeaba3891f99bd642131", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190256, "uuid": "dc27caf0-2fc5-4c5a-960e-a57a7e5947c4", "value": "T1BB167E23B284523ED0AB2A364A7795945E3F7F7039128C1F5BE4394C8F35A406A3677B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190256, "uuid": "8d82f7bb-53b4-49e0-a6d6-db06fa839348", "value": "49152:aCE/9WkVwumQ8D3ZjUkKd3ho7XapMd9YS/cebslHxra2BO10XUTPzBzL7+KD0TT3:A/97Vw9aXRraN0cCKDipOYTMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190256, "uuid": "f01e3494-c627-4d41-96b2-2859ba73bbfc", "value": 4159488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190256, "uuid": "3d2ed86f-d9cd-4565-9689-7493724e28a9", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190256, "uuid": "8e97a60d-6e4e-4916-b720-73ace030a22b", "value": "_--$rcru_documento abierto.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1957519a-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629229711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229711, "uuid": "bf755f61-ce53-43b4-ab2a-c7b9d5562a55", "comment": "Malware payload (njrat)", "value": "44831d3a442b0c6a9e5de879e3e99621", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229711, "uuid": "ed611877-f092-4928-8772-3aa574dd8bfe", "comment": "Malware payload (njrat)", "value": "8aeb965677a1c620341bb314a7c4c59d2692f572fb1f79de81fceee647d2c0bd", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229711, "uuid": "2400283a-1ad6-426f-b2ac-2b4601687adf", "comment": "Malware payload (njrat)", "value": "3950817943f762666a4aed29bd07945e76002c6f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229711, "uuid": "d3fba85b-3329-4310-98c1-9dd0337ea69e", "comment": "Malware payload (njrat)", "value": "d6acf93821c75607e8555416ae615e21634d25fdde71a710daed2c705e87e4637bcb932cd74af87c54d9e85191d2af88", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229711, "uuid": "c3bf2433-4578-492d-b099-6675d8574b0a", "value": "T16F612B735D8344A2C6A924B7548F6751D910AB31086C85B2FB8221787D52A68888B2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229711, "uuid": "8b4eb64e-6aab-43ec-a521-4b93b83948d5", "value": "48:9144vSejBuSSOcNfi3TyY+uLRNOvz2mpbdVSKefBHQH/1sSM/f6bFURF:LjBuBOcNfwyG3ObgmeB36Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229711, "uuid": "5af4f991-6051-4ab9-90ee-5487c8a91f4a", "value": 3392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229711, "uuid": "64c484b7-93ca-485d-a90d-847b20e7aef3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229711, "uuid": "6cfd58b8-8b51-420f-86e5-6d9477ead6c2", "value": "Pending_invoice#YTT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f861073c-ff5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629205603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205603, "uuid": "9cdca6ea-80b8-4491-bf18-1c712c533dd4", "comment": "Malware payload (AgentTesla)", "value": "0f975f603c913f90b719c02a3c7ded68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205603, "uuid": "b21d2f01-c503-4998-b978-c4b1c044d888", "comment": "Malware payload (AgentTesla)", "value": "8bb23545488e0099f6bf018d0b105ab10ca079ece74a19dde9c4149b8d961bd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205603, "uuid": "33c82615-48ae-4267-a252-f6df1247985a", "comment": "Malware payload (AgentTesla)", "value": "0700819578683598a8830055988cc2721fb16980", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205603, "uuid": "01477b38-7073-4679-85a7-a72c2fe97023", "comment": "Malware payload (AgentTesla)", "value": "2974dbae21e2ef6f485c241510ee21d4bb9d21e2cee3d5c43ca3dbe3131ebcf6e1ff9fa7306dadc481500244c82f7e56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205603, "uuid": "825bd593-b69c-4111-8143-05d471ad832a", "value": "T1D5E46B7C3150B5AFD13BCD36C5580E55F66068A3A2CBC613E0932989D93D3AA9E443BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205603, "uuid": "84cccf9f-3a18-4cf9-9792-ee6b8385984a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205603, "uuid": "ef53b309-5876-4681-8453-aea74b54b603", "value": "12288:RQGxaTxXfSxSCy07R5dus9My0Y/ibU6XNw9J23qJzpuRPmGKnnmWTzJveY:RJa1X6xSCy07JtuyzU/NGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205603, "uuid": "6dd73d2f-8b0f-4598-8bf9-00484777d2a6", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205603, "uuid": "be57b2fd-2796-4cd2-a48d-0d24e87ef1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205603, "uuid": "0da77d37-577a-477a-bac2-11b0b4557ff5", "value": "SecuriteInfo.com.Variant.Bulz.598676.21961.11318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bfb2a6-fef1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629160071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160071, "uuid": "5a1f529a-bd4c-4b13-8670-a12a3cc3122d", "comment": "Malware payload (Dridex)", "value": "ab667c342e83997121b7a9c78f340e23", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160071, "uuid": "202f8def-dd6c-4546-8359-fe1e7434eb20", "comment": "Malware payload (Dridex)", "value": "8d4547fa89823eb34301fcf14ba38a04af3285937c86b8f615fe421dee808f87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160071, "uuid": "3f262d26-e43e-48dc-9caa-90fff0fbc436", "comment": "Malware payload (Dridex)", "value": "1fca4d57206e1a7f9dfff6b9bd69d64d593ce176", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160071, "uuid": "5f1ff823-e23d-4e0a-91a9-d82db3fc2dd2", "comment": "Malware payload (Dridex)", "value": "21d2fb6540a533180c6ee7a60dbf9ca06540610ac4c01ae841c540bbdba81786f392b77eff197fbc025be08b6d1cdc27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160071, "uuid": "167607bc-2da6-4855-8555-411897ba9224", "value": "T1C8240133D9595E23C45CE3BA7E9218B01385A506931674CB69F11EBC3B6DAB10FEE20D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160071, "uuid": "1c8d01cc-d3f3-4c4c-ad9a-703451bfc7ae", "value": "6144:FogkLjLhDcxGxXZ1KQDGte8rlWEHDU8Mf:aDLZDc4xp1Jat1njU8Mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629160071, "uuid": "8fe90ab9-38f9-4aa4-b495-b263bdb31894", "value": 213379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629160071, "uuid": "75cea149-14d9-4ff4-9aef-3a2b1b7f388f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160071, "uuid": "5925177c-a3b3-46af-8bf2-5d7dfe13e0c2", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.158413380.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ba632f-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629229698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229698, "uuid": "e11d6517-129a-48db-8437-5709ce1b3a89", "comment": "Malware payload (njrat)", "value": "a6c98a761dd236a114ba9bc3f21b53d3", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229698, "uuid": "3e0af15e-1a68-4320-b037-5c924756d999", "comment": "Malware payload (njrat)", "value": "8ea3486c9b64a0940f97d247d565c11b23324b46cd85c7f78a98bcbad838e1ef", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229698, "uuid": "bef88ca5-40d9-43ab-9bfd-5178bbab7ec8", "comment": "Malware payload (njrat)", "value": "097f468299ece42839515d3a6d6f6ea71659603f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229698, "uuid": "991042d0-ce69-4128-aca2-a2cfd90552fa", "comment": "Malware payload (njrat)", "value": "4a9a2f22d827146d03c853a97a0dd25ee6452e96e7e76501ed383478a26dd4a9153ba9dada12628c0bf53b6f9df373fc", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229698, "uuid": "a29921e9-1b40-4e20-9cbf-e151ce8f56b6", "value": "T1FA45B91077320593F245A23212EA36E8BFB4BD45B3B24B76350C93154F549FB0E695BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229698, "uuid": "fa2f7f47-8103-42da-8839-772424c476b0", "value": "96:55NZUW++0tDv+UtUfqJVaDWyftF0pFx2Al1wErhg3N:/NZUWx0B2UeaVly1GpFx2Al1wErhg3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229698, "uuid": "c1522771-d92a-429e-bb54-07ec998efe97", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229698, "uuid": "ba277c3d-bf8a-43e4-90c7-48a99bbf6526", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229698, "uuid": "4137ece3-369a-47a6-8e88-1de97e38a8dc", "value": "Pending_invoice#YT.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5f067e-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213365, "uuid": "c37f7f54-f042-4ec2-a83a-7da077d40002", "comment": "Malware payload (Mirai)", "value": "92986fa0f89c16f8308e5a92298da2ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213365, "uuid": "5274f223-d91d-4b5b-b628-6e0d1351dc99", "comment": "Malware payload (Mirai)", "value": "8ed8d2b1a8564ed74c89470619599899a71e5bf7c5e4e26718cd6ff1de05d68f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213365, "uuid": "a6159254-95fe-4dcf-a986-2d05dfddd5ab", "comment": "Malware payload (Mirai)", "value": "0b746ffcca20f7b163d939f909383a80ec873089", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213365, "uuid": "1230a163-9bb0-4d4b-b5eb-0bd6c5eab57b", "comment": "Malware payload (Mirai)", "value": "53155f0d2d7e4d2932515111741878407091be2b03cbc0a7a538f27ab9b502db2eee274b1b8312d63618400d0df8400d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213365, "uuid": "0709ba07-3e39-4bc9-af27-8a3081258582", "value": "T12BD33B05D8909767C6D227BAF79A428D73236B68A7D733115A28AFB02FC1B9D1D7D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213365, "uuid": "049f0ac1-1f23-442d-81c5-6932d13436e1", "value": "3072:IVfyQ+d+pceQGftb3za5fJhWOiwTteOHS45hLMO3K4G5ZZPMmydQCYMhEFg:ub3za5fJhoIHN5hLMO3GvkmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213365, "uuid": "f2037c5e-a24f-4a69-9335-4fa2de1987e4", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213365, "uuid": "60e54a02-59e8-468f-876e-42614cdced3b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213365, "uuid": "5faf9cb3-1552-4ded-a395-76609d5e808f", "value": "92986fa0f89c16f8308e5a92298da2ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3229a89-ff62-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208601, "uuid": "69960dab-3d8d-4ae8-ba3a-14648de18874", "comment": "Malware payload", "value": "e5e1ece8e91a873eb73006d477bcd1c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208601, "uuid": "979c4795-bf9e-47b7-a405-213d377e533c", "comment": "Malware payload", "value": "90251be1167aabf09c3674c2cbbd32303fc37564b2185de0eae968ddd6016493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208601, "uuid": "d801991b-03c7-4965-a81c-f68838375c26", "comment": "Malware payload", "value": "a1eb97e9a4753555f69598fff21e914de86e7f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208601, "uuid": "464c1edf-89b5-4fa5-9fca-9c831775fedb", "comment": "Malware payload", "value": "014c4965007d28dcde2a696da03bdb3e94e98f40d1f1fbfceceeb40853991e3ff29c4a20fc2280ab77de19bc20071967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208601, "uuid": "80ebb01c-b43c-4874-b781-0a7f26df61d9", "value": "T10B6509385678393AF56AC339DAE4080BE2D4BD5B7125AA1A71D633670733643789323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208601, "uuid": "f9ec1947-76fa-46b0-baa6-92771e60a88c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208601, "uuid": "9f2370d4-4914-4853-bf88-e811ce0dee5f", "value": "24576:jCR48c/cPzrrVpqS1FnHnZoAYHWYGWUQdviFZYQ:C1BHuL2Y0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208601, "uuid": "7e431a3a-0624-4b5b-a0fb-651660c24092", "value": 1505280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208601, "uuid": "0608683c-0e4d-469c-8b19-f78397ffd1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208601, "uuid": "625fea6a-cda1-4a86-badf-f5b5fc1a9d6a", "value": "Sourcing Event RFP-000000012069 Due Date 17 Aug 2021_scanned from a xerox mutlifunctional device00221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bac057-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208688, "uuid": "8e719ac2-06ca-48bc-9f8a-0b254339cf95", "comment": "Malware payload", "value": "e40e72397ca7e7b466cdcc68c0fe23bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208688, "uuid": "1f75c51c-1b31-4968-95ff-77e305deccdd", "comment": "Malware payload", "value": "91269e08723292675c9bdaff7f82649aac5c270c6424c893a87dd9a9f401d5dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208688, "uuid": "76abf042-67bb-4096-aea0-db1c0708be65", "comment": "Malware payload", "value": "cf374af792cca649431fa72b1db92a0b75e19e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208688, "uuid": "20a71e53-be95-4d3d-9f5d-4a290e5760ae", "comment": "Malware payload", "value": "09b768f47d6324d5d73af06ca794f5958b51f55c2031f622f2804c90c3e5c7679ccd7379976ab15aad89cc69dda6b2bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208688, "uuid": "367199eb-eb2e-46fe-b354-a9c31ecc113f", "value": "T1EB55FA3819B43A37E179C339DEE5481BF6D4B45BB211AA1A70DE17671343A02BC9327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208688, "uuid": "55ffc153-76ab-4112-b9b8-d828a5e96f38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208688, "uuid": "f9d073b4-59fa-437d-843b-5d688420a425", "value": "24576:vyuYccWcWz6WDnMy4P5AFn9lxJZhpzf0QVBg8Poota0eMdv0:JYuBRjzRg8PoogdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208688, "uuid": "2bad2d6c-b023-4d80-8113-05a99fccbf6c", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208688, "uuid": "bdde3536-05db-4881-9174-2bf628606e97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208688, "uuid": "eda8afdb-b9eb-4676-b15c-b963b3aae5fe", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a1862a-ff3c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629191907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191907, "uuid": "6f0fcab0-4d75-4697-b92e-f12b233490ea", "comment": "Malware payload (RedLineStealer)", "value": "30d75d7d5fe9cea029423a625f4e7802", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191907, "uuid": "3784a70f-9d18-4a73-a440-6c6993af8bd3", "comment": "Malware payload (RedLineStealer)", "value": "912e87d951fb0303ca22db42510cce17e8f12bd37c23937a69e2f8a0c81b3c06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191907, "uuid": "745061b7-1e94-4a50-967b-4058f8a869a0", "comment": "Malware payload (RedLineStealer)", "value": "d25004fdccf1f731de492e83e615d4a6b96c686b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191907, "uuid": "059cb148-a240-4a5b-9350-3215c1c4c81f", "comment": "Malware payload (RedLineStealer)", "value": "ad5c49f4ce0e018713d0a26728dd0fa50b42ebbafa47fcd453da9029fd7d476c3a317276bc631d2a77669e389ddfac16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191907, "uuid": "3ef02040-8d8a-43c1-8890-4794bb3bc3f6", "value": "T16FA33B2263ECC629F7BE0A366470011587F5E0CB6401E75F5EC1F4EA1E76782A644AFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191907, "uuid": "7cc4b91b-d3eb-40b1-93d8-09e21a425e17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191907, "uuid": "78f1cdbe-f3e5-4302-b390-3749d0e46552", "value": "1536:Po6aGLRC1g2W+0OD6gGsauyw/gbueqvcuvNyAsdN5etx5REPG6WAaoigx:Pdx9CflOFPgculyddGNWlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191907, "uuid": "3a98ffe7-4920-46f6-9f1b-ffdb87a05d50", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191907, "uuid": "b7fb0047-4848-4e62-b1ce-1419107533c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191907, "uuid": "b72534e8-30df-42dc-9dab-6d09b829e16c", "value": "30d75d7d5fe9cea029423a625f4e7802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6eca88-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190259, "uuid": "fb77fa78-a01d-427f-9cd5-2b1d3681ef23", "comment": "Malware payload", "value": "58aa4cb03af81cb0ebcbccb3a8ba6dc8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190259, "uuid": "2f7d580d-ba3c-4229-bfd3-6ad3424fb2ac", "comment": "Malware payload", "value": "914463a5eed999418d3201221fad54340c70cb8ce02c6a03aad35ad163f832b0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190259, "uuid": "ba0a6e9b-f406-4d81-bc70-205aceef4562", "comment": "Malware payload", "value": "299a2675f5d6c0d1b0777becab32704cbc9c6625", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190259, "uuid": "a4537956-be8e-4e58-a5ba-bdb9f903f314", "comment": "Malware payload", "value": "face319c5e0d96bd0fe99531fd81591ba10194068a827e1291f1cb078bb69c241ce884dcb3f1eda9ef52ae0e7509e420", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190259, "uuid": "fc1c6afd-098e-40b3-b9dd-eefeff3e83f6", "value": "T1B78109B51634D812EF6949E6C8F2FCE685F6F2D788CB4984308EC5D3078233A6D1A488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190259, "uuid": "4e5b8c51-3c06-4cb4-8b8d-33af3cc52529", "value": "96:cZxJnHPnrZr5sWUl82FIMT7JH/IGsQvabdN3x:cZzfrJ5cEqwVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190259, "uuid": "4e264493-e992-4989-8063-4c22e122db50", "value": 3904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190259, "uuid": "b88de6a0-0004-4bc3-82ed-590b3dd39f7f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190259, "uuid": "36099192-02ba-4450-b8fe-6729cbe9c4ae", "value": "Product List.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eb1650-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208983, "uuid": "b7a7793d-8b0e-4982-ae76-c9aba083bf24", "comment": "Malware payload (AgentTesla)", "value": "c88d1183fbea6dd55f5a6933268128c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208983, "uuid": "6bd1d5f1-6a43-4227-8041-8ab93c79431e", "comment": "Malware payload (AgentTesla)", "value": "918abc6d287cca1282a6c7b819d26b3eda5deb338af11738411db23be7e29173", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208983, "uuid": "a83f71f5-891c-4a06-be8b-10fe1b8967ce", "comment": "Malware payload (AgentTesla)", "value": "e99f15863d05877688587a7322ab3b4c9a0ccdbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208983, "uuid": "8ae7c7e5-8d16-4ce4-a771-0115a41adc00", "comment": "Malware payload (AgentTesla)", "value": "dd6b35276bdbd2d2743a6564c125b2ece6a970d552a9a2f06cbc44ed4ee14db1f96d89278a7eff5014a773775102c72f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208983, "uuid": "0cda362e-c3bd-4812-8be1-bb768be5ab8a", "value": "T13705EF2B7F1D9ACBC29834BF4710C741D2A493E67C27A79369800E1BF7962E4F70A195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208983, "uuid": "ef1c7582-15c3-473f-b3e9-3dc4d20eaaad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208983, "uuid": "65bf7001-38ad-4549-888e-46d869938485", "value": "12288:ba4EJbjJEKXBGunNyC85PsZqopwgBrNhRm1Vac1uH6MbSb5iCM:ew9nPsQopjH0F7MewB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208983, "uuid": "74e8e84a-36d0-437c-ba5a-60e5d6aadb57", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208983, "uuid": "df23ad50-ad25-48a1-8f65-885e87747cae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208983, "uuid": "f8764331-75f0-48d9-9ddb-b5ea69838da9", "value": "New_Order_List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85778ff7-ff4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629199398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199398, "uuid": "6794048b-cd0c-4132-91a8-a41f3219ef2c", "comment": "Malware payload (Formbook)", "value": "eda2f736aa2185aab69b94d776d884aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199398, "uuid": "8cc1f4a2-d6d3-45a9-b3b8-8493de40d65a", "comment": "Malware payload (Formbook)", "value": "93f0775c5a5512759f85db7b3d1c4b3ee7049369cd0dcd1d4f778626621bfa0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199398, "uuid": "66ab8859-ec6b-4079-b40f-af66cfe77b9c", "comment": "Malware payload (Formbook)", "value": "23bcda1179408bc7a4683ee707cb238f27f7d295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199398, "uuid": "860a9206-37a9-47b0-b782-673f8c30325f", "comment": "Malware payload (Formbook)", "value": "afe2e3b5b4c4cfc19e3fa0c4aef7a695519fe9625ad4af9c34e5dbf644c4b1de069cbf173b8442c1954f652eca12d80b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199398, "uuid": "0c27fb53-30b4-4bb9-a6ab-417b1149a800", "value": "T11D05F02A3F4C9AC7C2A8B4BF0B41D381C3A093D27D16E36369911D9BF7992C4F706599", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199398, "uuid": "5af5a5f5-7158-4e5d-9662-5632165b7379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199398, "uuid": "947391fd-d360-4b05-8ab2-fad8a87cfbb3", "value": "12288:pu/EJbjJEK7VzieYAT0XvssghBE9JMzxvF002+OOedc2JRduas:RuXvsskm9JMzxvFPOOt2fduas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629199398, "uuid": "e0087edd-3fa8-4fae-92e8-004025457a5c", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629199398, "uuid": "c543805b-26c1-4dcb-9c4a-7768e689c63c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199398, "uuid": "e4f81a63-7ea6-4cd8-a173-57e03e6f353f", "value": "eda2f736aa2185aab69b94d776d884aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d5dea0-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164372, "uuid": "d17ad85a-e3b2-4896-8e24-8bd3e2daa6d7", "comment": "Malware payload (Mirai)", "value": "9425e11e02df531e1a7c148f71b704ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164372, "uuid": "d6ed651b-679e-4543-94c6-b860afc81cca", "comment": "Malware payload (Mirai)", "value": "940827c2340d66fa19d7504bc9cbca91dc42063fce9c260e8027ccb907741939", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164372, "uuid": "f2ab295a-53e0-491b-9fdf-49acecdab7f2", "comment": "Malware payload (Mirai)", "value": "e7b93f58f085b3e8ff64ad58071512dc24a218c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164372, "uuid": "dc68b2be-ad24-464c-9237-6ed3c441061e", "comment": "Malware payload (Mirai)", "value": "41b3e536da2d2c77a59150d7a509c821aeb4c2a4fb97e422ccd55a84a8eb7b5b2783fd3c4c846194bc0e29b3ab285e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164372, "uuid": "398d610e-4169-4d82-8728-c346b7c0099c", "value": "T14673C519BF610FF7ECAFCC3749E91B46298C945621943B367934C818F68B25B5AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164372, "uuid": "bdcc43b7-238f-4a4c-967e-5cabc40cffdb", "value": "1536:cJfEFvGQrH19rskjDosd/dTuIROY9lbWZephJT:cqGQrH3rskjDou/VxbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164372, "uuid": "cd021882-3906-463c-b6c5-5040d21e475b", "value": 78244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164372, "uuid": "1326ce63-8310-4baa-b20d-e6a7bf2e1097", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164372, "uuid": "ccbd3504-1580-4f30-aeab-13d3b600cb8a", "value": "9425e11e02df531e1a7c148f71b704ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c8d9f2-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209037, "uuid": "3f837cba-271a-4ae8-b00a-3b1c682864a1", "comment": "Malware payload (Formbook)", "value": "a554c9203d7d10c9ad64a56ec87a0ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209037, "uuid": "7e84b720-84c7-45b6-9a7c-66737ea5abba", "comment": "Malware payload (Formbook)", "value": "940a0ddc445a53994ab5249bb78cbe3748868765d83d6fc654866591adf64901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209037, "uuid": "c74749e6-1ad3-4487-abe8-fc445e729d97", "comment": "Malware payload (Formbook)", "value": "d91908e3a8ab91b8ccafc7b6e5123324cca2cf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209037, "uuid": "55bf72d9-aac2-4468-8180-78776f273c76", "comment": "Malware payload (Formbook)", "value": "0f4f8e3a7b1c350e6638251ea9c09e30cc0d28ba1e7206d03b5022713bf13d743f86e11797027934c1072481b2cb8c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209037, "uuid": "2ed9615f-4b50-4b44-8b24-9b16c1dba78b", "value": "T10B2570381BB926A7D165D23EABD18613F04096DF3511AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209037, "uuid": "cae98d1a-e7f4-4ba9-acc7-bbaa6dadc54e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209037, "uuid": "79012052-9c45-428a-b493-247f56c1f390", "value": "12288:tANjhDc9F3nC0Py3gAhaEJbjJEK9RUKJ4Rd1qHqMhwAghL8gy0AJqYuH+3jjJa:5d1qKMhwHt8uAJhuM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209037, "uuid": "458c342c-78f8-455f-9d25-3ae3a782b168", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209037, "uuid": "990b3244-ac56-469e-9ff5-b334b0298a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209037, "uuid": "9f42858b-4902-432f-8318-e9dc48026c48", "value": "Payment Receipt MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088f8e65-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1629192746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192746, "uuid": "4501bc13-e896-4836-aad8-abab1e3317fa", "comment": "Malware payload (DCRat)", "value": "3f472c0afd077919abb0a3ddb2378135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192746, "uuid": "327cdcff-ccde-4c22-a1c8-622477d47628", "comment": "Malware payload (DCRat)", "value": "947353d30445b95510ff4fb83584d7b28c61527aebd05fa56591e1f65e64fe1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192746, "uuid": "d36c1f64-b2f3-4858-90d9-5eeedaa62bcc", "comment": "Malware payload (DCRat)", "value": "2d1af3947fd91d0b579efaffe45553802de7b15a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192746, "uuid": "e6d510a1-4470-4219-a873-9155fa9a378b", "comment": "Malware payload (DCRat)", "value": "42de591275c95cea875634943213d54b43d597799d0a4a5d3c115ef05ebc274b79b0073b1492f84486273226e4c592ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192746, "uuid": "8cd8cf5e-e5af-44fa-becf-40ea2eaac1d4", "value": "T1AAC47C153BF86A25F1BF9779E4F0696A8B71B812A6A3EF4F04D213C91913740EC40B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192746, "uuid": "11ceea6c-dbd9-4558-8cf3-5db6dd178f2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192746, "uuid": "755e5e9c-9c86-4a97-99a2-214081f165c6", "value": "12288:cqnONCo087two2XfwitKl18JibvL6/ABsMIB2:c+ONfwonMJiT+/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192746, "uuid": "fb28b3bf-c928-40e0-85e1-c3d87a2a28b8", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192746, "uuid": "5696e86f-ec84-44d9-95c4-83f5b6e739b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192746, "uuid": "5460fb91-6692-4198-89ee-a81236d50a7e", "value": "3f472c0afd077919abb0a3ddb2378135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07320753-ff3e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629192743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192743, "uuid": "fcb9441d-be10-4e73-bc92-b3c4ffb0d8b4", "comment": "Malware payload (Smoke Loader)", "value": "2cd78f656c99359fbd2c63b786bd6214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192743, "uuid": "52d20a2a-2ab0-4518-82bd-cd583922d36f", "comment": "Malware payload (Smoke Loader)", "value": "959ed9b65f2c1dff0e7f16367b4f8b04dc091350219a80b63d58e50799e58ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192743, "uuid": "c1802d6f-0dec-4cc9-b7ab-f7fc66f427cb", "comment": "Malware payload (Smoke Loader)", "value": "938e95b0f0c34681554b8cd4f4c0c61e06853b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192743, "uuid": "e36d64ce-8401-477f-84b5-a8c1b2d1118a", "comment": "Malware payload (Smoke Loader)", "value": "1d0f74e12649a769eb5f3dab51929558cedf35f89cc497687fc56020db17dd4e05d1fdf504cefab807ac15416269acfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192743, "uuid": "87be8dbb-f367-4e17-bbde-5ed8d1e9cdaa", "value": "T184548C30A691C035F5A342B495B983BC65397EB05B2451CBB2D92BEE1B303E9EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192743, "uuid": "c60cf488-920c-471a-9905-74a3d2482df7", "value": "e16577a15d2f4b952ae6a4b3a61075c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192743, "uuid": "37c8ca6b-73f5-4144-bc76-24a2b6717f1d", "value": "6144:OLg5NkUA1H/XXgrMMyJ16ZgYtRQ7qnR4Jh4a65uqQoP:Z5SUA1/XgrMKZg1kx0qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192743, "uuid": "1cc11978-10c8-46a9-a3d6-4c50d7af48e3", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192743, "uuid": "1cc35e5d-6bb5-43e3-baa3-45bc6bcc4757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192743, "uuid": "0a645086-f418-4d1c-b320-5c5abbfa88fc", "value": "2cd78f656c99359fbd2c63b786bd6214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03196235-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629209057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209057, "uuid": "5ddba11d-9d36-49be-b94c-16bb0cced5c7", "comment": "Malware payload (RemcosRAT)", "value": "9a29baf08bfecd718cb8d767cd0c9c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209057, "uuid": "32c0dfd2-1812-45eb-9cb8-2bd1eb7af551", "comment": "Malware payload (RemcosRAT)", "value": "960db513ca9e4b7748f7d7f8356a713d5bdd761547560460fba5852b4314a6c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209057, "uuid": "c60b3091-57cf-4835-bce2-a31cd965429c", "comment": "Malware payload (RemcosRAT)", "value": "fa44a1f2a55d87c14535053241fbcaad2f4c45ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209057, "uuid": "76f8c4e9-cc44-4f03-a0df-6765cb520be0", "comment": "Malware payload (RemcosRAT)", "value": "fd2e734e2e3605a0fd68921977ac2293c59dcd6a900f070dd50f0fd36ac1c6f227c95ff1136232585c5c0c7a741476b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209057, "uuid": "613e9f03-a3f2-4ff8-abbf-60cd4ed6dcda", "value": "T13D35D03E7B91FEA0C1994E32C66343CCA3F085176372F3EB15D51AF4A9E9A0A450F562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209057, "uuid": "5046f5f8-3906-4c36-bdb5-0dad11c2f597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209057, "uuid": "6a5fe7a4-bb5a-46c0-ac6b-430a9656202c", "value": "12288:TwYrGTMHEQWC6Vjhmc4cshJn+suJx7LHMU9z9ADKYElV6cRy:TwUiCA94ci5i7ADS9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209057, "uuid": "84cc17a5-b94d-4cd8-857a-614404e7c6d2", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209057, "uuid": "2f4bbe43-c6dc-48e6-9753-fd8d1bbe99e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209057, "uuid": "b51bb511-1d5c-4fc9-b757-73089e7be88d", "value": "U\u017dSAKYTI 0021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084565f5-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209496, "uuid": "a4979767-431a-4417-9497-866b067721b6", "comment": "Malware payload", "value": "a5b75a74dbd14b8b408e3a21dea6dc65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209496, "uuid": "29b79ec5-2e22-41d5-a941-c53ab93901e5", "comment": "Malware payload", "value": "9634abcafe5cb7be07035e0173a2a96708014b56dcf22a970149368bbe75f4da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209496, "uuid": "5f526e31-111b-4ac7-b30a-4261b07bcbc5", "comment": "Malware payload", "value": "b9cd65640790c336c2a347c9a30fa1f3aa7c37b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209496, "uuid": "87cc34f8-622a-4968-8087-983ae34c6eaf", "comment": "Malware payload", "value": "86b3f6aeb221ac3dff0b0ed7a2cb4c8e87d789031fef35d3463d8704ed698b7870dc086c101ea760cc8b26c565dbfe13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209496, "uuid": "78d0c62b-a866-4361-9718-6342c3140141", "value": "T14994D012E685807AC4B3243648F1523869383F751B1E9EDF57C83ABE4F741C2A935E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209496, "uuid": "3b87d616-1b4f-42d8-9a8c-6463451b7728", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209496, "uuid": "7876aaeb-25eb-4758-9f79-e0881f0f09c6", "value": "6144:/lbjSEFFvG1oBHV9zLmR1vknKJ5q/yGDraLvJN7fs6cM+g8X/LfQ3ICddZWSTj2d:/04G1oBHV9z3zyHvJ1kd7XjLCddZHjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209496, "uuid": "4fad7f9e-f95f-4f93-b0d7-42a815387ac0", "value": 408708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209496, "uuid": "b596f3f8-6cb7-4280-afbb-88138b4e91f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209496, "uuid": "a83b7ea8-31e7-4d06-9315-ee0140793877", "value": "gunzipped", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaf668d-ff41-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629194125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194125, "uuid": "8cd32d29-d29a-4ec3-bb92-e4e754515070", "comment": "Malware payload (Formbook)", "value": "bfb92fc9b5c53f326d2169e552454f5f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194125, "uuid": "f5a7d2e4-4eba-4cc3-8342-037ffc9d7f41", "comment": "Malware payload (Formbook)", "value": "9640b32c7489c4b78f3e98dd19f1101b69dbba230ce531275af4873d1b42328a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194125, "uuid": "7f7662d7-34ed-4227-bcae-98694684e79e", "comment": "Malware payload (Formbook)", "value": "311b90c1b2e7f7c98cc04e6cfa739f135320eed9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194125, "uuid": "5d3c05f4-a1b8-47e3-ab67-d4387cefe254", "comment": "Malware payload (Formbook)", "value": "6ad895fa563618471316109acb438bee7bdd6f0cc3198f00ea7ee908896e52850c96d61643ff3972791e76d955866f7f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194125, "uuid": "9b9d3638-a242-42f3-9fda-607391c6757e", "value": "T160D43308BFC3D09D05ED273EA85ACE7435B24CC2E84CB2E61E094C65F8AED9DCC62516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194125, "uuid": "c83ab0e4-1a09-4791-a2d9-19f4fac3f1d0", "value": "12288:kh5dMhcpIQEERDEBgyo52Rlvcz/JRme8BrvxbLdZYLwCyFevvacITzOAvdKcd:k3dcQfqgDkRBqHmeer5bJC9MeadDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629194125, "uuid": "fea5611b-c0e8-484e-82f6-c6ee10cbd2f0", "value": 620525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629194125, "uuid": "06f0408c-8efc-4ecf-b26f-2578c1ae06d8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194125, "uuid": "94318ee2-bcb8-465c-a881-76fdd267b15e", "value": "Invoice-309-Ref-284.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bacc00-ffa4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629236932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629236932, "uuid": "931bb2bc-1158-4ae7-be1b-224f673b9e2c", "comment": "Malware payload", "value": "7a922c0bf516574c776dfc4e24c2e70b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HubExpertStealer", "colour": "#A13B4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629236932, "uuid": "21ce2860-b560-45eb-a9d0-aeb4d69382e9", "comment": "Malware payload", "value": "9692122f93b862ecea613a1e3932763125d14ee97ccf2b42557474fc0f1f8bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HubExpertStealer", "colour": "#A13B4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629236932, "uuid": "81746545-3b4a-4678-8f0b-b350271df3f6", "comment": "Malware payload", "value": "57a2d08202e32c7c977c6f8c2b85bfe36ce30d5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HubExpertStealer", "colour": "#A13B4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629236932, "uuid": "f561ab17-6c65-4361-a007-729bcea66fce", "comment": "Malware payload", "value": "ace22fe9013dcee052ec09eff012cb33667ac64794d7ee6b5051c3c032ac376c1adf4762fc4d4818e14479eb5da2b13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HubExpertStealer", "colour": "#A13B4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629236932, "uuid": "e4f0811e-e15e-45fa-b14b-5bac32ccaf47", "value": "T18B352222F7D3C338D46EF2715784AAB555B4DEF06A2708E377A6F60A76F01889815232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629236932, "uuid": "5af6e8f3-e4cc-4e37-b929-2096c28b31ec", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629236932, "uuid": "988afd80-fe5a-4462-9706-d9182bd183f9", "value": "24576:FSLXxywTtpW3KS6/CeXNdxNl6M4r0EsjE3SygIL9ERgzjq9oQCpIJJJ:GgwT3XL/fXdNkM4rejvygeBzjj9wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629236932, "uuid": "553c38b3-0467-479b-967a-c3f716fad60d", "value": 1095553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629236932, "uuid": "66f853ff-a218-439d-90f2-c2731cc07247", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629236932, "uuid": "b6279b58-9389-44d2-8c7e-bfe33befdf05", "value": "eufive_20210817-154800(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903456dd-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198986, "uuid": "3f5a1008-6014-41b8-b486-d15a4f7ae533", "comment": "Malware payload (Gafgyt)", "value": "589b8ff52b4b66227bf75c4db409ffa2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198986, "uuid": "d12810b1-ba18-4048-af11-28ab8329c027", "comment": "Malware payload (Gafgyt)", "value": "969275f27c5d2993c0a57cd0e4ad976aefd459b1f0af16e3e19ab8e4a6ac2d7b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198986, "uuid": "7669b14a-ef53-4238-ae01-dbca5ac63b6f", "comment": "Malware payload (Gafgyt)", "value": "62a321524d871011e9186767493d40f57c257142", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198986, "uuid": "434740a4-5bb5-46be-aaf8-f021ddddaf70", "comment": "Malware payload (Gafgyt)", "value": "84bc18b61c8c132e2173d483737162241b658775005a8d11f4305b61725f7887f2d0293da6c08798e215a65067a592be", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198986, "uuid": "99e17680-c287-47e8-a103-319cf81322d4", "value": "T11DB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198986, "uuid": "14565d06-4703-46fd-8a9e-711d77633d86", "value": "3072:bRan17WtsWhdgYJZ0D6mbPbmTQOWsXAOn:tan17WPJZ0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198986, "uuid": "e6d272ef-3102-4d33-8a92-bd643e9f9549", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198986, "uuid": "3e355fe1-7b5a-460a-866b-73acb1f4764f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198986, "uuid": "bc7976a9-897a-464f-ad32-0a25f30b3878", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69150118-ff4e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629199780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199780, "uuid": "83ab6184-8928-48da-acfc-d03c6048bd6b", "comment": "Malware payload (Formbook)", "value": "e752ae0abe724829b72a2df162596e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199780, "uuid": "9d3282c8-4e1f-4e7f-b6bc-224d5b7aabdd", "comment": "Malware payload (Formbook)", "value": "9744a8f624cc86bce830db5caf4a5a8b2263b51f53ca384908b2557e5f9ce99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199780, "uuid": "8f136fb1-abb7-4320-8d5f-d11746e87ca0", "comment": "Malware payload (Formbook)", "value": "123a9f1b3ef781f53833216bba2f93db069d017f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199780, "uuid": "1829ccfa-9dec-4434-a7df-fbcb61c3e2dd", "comment": "Malware payload (Formbook)", "value": "ec3fb31567c8ae83aef9cf7782bb1d41902998a6d83eff914f921435a541d5753b7028f9bdf3c0c3f3dac3bb95ab0696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199780, "uuid": "77b4a323-cfa9-4f29-9188-574c916ad789", "value": "T14A256F3C1BB82667C165D63EABD18617F04096DB3411AA5764CA0FA7B306AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199780, "uuid": "016d7ef0-e19e-4e8c-87fc-46fb16899b57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199780, "uuid": "ce046258-8fa1-4583-b53c-b64eabbf9ab9", "value": "12288:y/WDc9F3nC0Py3gAhqEJbjJEKuR/pKhAgjqzkI9ymd4txhJrqU3Glk5u1EBbCaj:Q7+hX2zywkxhJrRcOuuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629199780, "uuid": "8e94b3b4-ff4c-40b5-b039-cc7aa4264ba7", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629199780, "uuid": "1f3a4182-bad3-48fb-ba7a-cbd4cb8db29b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199780, "uuid": "8db689f5-c37a-4c2b-89b7-2e78e05b01ef", "value": "RFQ, Scope of Requirements PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98938b8e-ff6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212315, "uuid": "e866049e-a8cd-4e89-8e84-6d94165d1169", "comment": "Malware payload", "value": "bc375ab869353f5c6f603e1d006a82a3", "object_relation": "md5", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212315, "uuid": "f74922cd-b77f-4f60-b9f8-cf4e4ee192f4", "comment": "Malware payload", "value": "980fd1e947a8dd578c45bc76254b6aaa95b35e6ec33b8f41da268623500bd0f1", "object_relation": "sha256", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212315, "uuid": "02f769b3-d46b-4b47-a554-2d04bcd0a4f3", "comment": "Malware payload", "value": "c8b548a81cb9cbad4bd165b662001e3552b94fcc", "object_relation": "sha1", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212315, "uuid": "5eef3601-4f19-4fc7-8c5a-c78e9944d0dd", "comment": "Malware payload", "value": "92bcde7413510e2355ac592795fc0baeca6ab097284ecb3a439b91bd54e4d8b0dce513e940aeb3d01b66de2450193560", "object_relation": "sha3-384", "Tag": [ { "name": "EarthWorm", "colour": "#12E0B3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212315, "uuid": "410d2080-7a13-49c3-9704-b5df26e8883c", "value": "T12E14441A3E12AF7FF568867007F38A70575921D636E19684F1ACD70C5F2028E685FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212315, "uuid": "952ac5fe-6615-4023-b767-dc9010ea0e5f", "value": "1536:ZrtXdF/m/bSsD+MLBKY/3EwS+WFF5UOMp5v6lrYgnTH+W5Ze1C0560arCXT1p6Tw:zduOMPvYrnn5IC0lhpllnDBy2dISd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212315, "uuid": "aa2cba77-9452-4a54-92df-67dacb292a87", "value": 197400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212315, "uuid": "5694190a-09fa-43d9-b2e0-7d351d502528", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212315, "uuid": "3afc9ccb-b581-49b5-869f-46fc17d80f76", "value": "ew_linux_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415a5290-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208732, "uuid": "c4f5f667-fe31-4ea8-a3c7-fe5b73ea8e51", "comment": "Malware payload", "value": "d535ae5237e679afd61fb9be411413fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208732, "uuid": "1a1698ac-3af4-46a8-8d5f-2985f8f2313a", "comment": "Malware payload", "value": "99c692171116b52ea724b6f740a825c680db973e3ff744e9a1b7bb5c34a0c962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208732, "uuid": "36217575-f8ac-44bb-8790-dcf50ed2eeb5", "comment": "Malware payload", "value": "302af1ea505be794c64f29d818ef00f13da8b90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208732, "uuid": "80ab67bd-3c24-4e43-aae3-59d11d6273c5", "comment": "Malware payload", "value": "bcddd7165354c750260aeb6e30f9c0b3b5ca4c9c2e18c74d387e2217ffc1020c6110d991cbc81843219455e8aacd10de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208732, "uuid": "7a7bc35a-93b1-4ed3-a3f9-99e03dddee47", "value": "T1BCC423823F98891FCF2B0BB188235D0502226E35165BD97D945E76436BF3B409BA3F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208732, "uuid": "926f0888-00a2-405d-8336-c5b55d7efe42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208732, "uuid": "c46bcdb5-39b6-4021-a3bc-826d4f57615f", "value": "12288:SHw1uARwB7XfVjDJPkZyuSMe0/gwHVieGPYKgJMAWnYpcqPysHjoI6OCkX:KwsARwBrVjNP1uSJkdkYKgLJpc2Zjmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208732, "uuid": "a132f4d6-3d3d-4cb5-bc8e-809d1bc75e2b", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208732, "uuid": "bb4dc99a-fc41-4959-8551-02d5d6555d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208732, "uuid": "9affa71d-5e16-4370-927a-cee7287cb4ba", "value": "Shipment Notification 1935121773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78ed85a-ff95-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629230405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230405, "uuid": "ac704089-4ace-46ab-903a-278aacefabf8", "comment": "Malware payload", "value": "b1e996efa259a0e1e273972c1a41e266", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230405, "uuid": "11ee4fb7-3a8e-473d-9aa2-2f85c7feb95c", "comment": "Malware payload", "value": "9a4ac19f62bb4e7dbf79ea9e4076b49deb9843a3648a0bab06679d8b1dfc3eac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230405, "uuid": "d2f21aaf-a325-434f-a8fd-947704a4f178", "comment": "Malware payload", "value": "7137c4cac0533bf833ef2b8f5eadcbad1a2d95fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230405, "uuid": "3e841d38-3397-41f3-bd94-8316faf04787", "comment": "Malware payload", "value": "f261b4eafdb2af0f62339ef5f139f81a6211f0855f758c1159761ac47a39525a7f27de35e50f085ec3a44f6e6d8dc3ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230405, "uuid": "80e76617-cfd3-4702-8cc5-3ae2c4bbf2f3", "value": "T19B5302814C574571CDBA05B98F130152FA2D9ADCF09A323B20265A4E8DF079BF7FD49A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230405, "uuid": "83ce7923-a65b-4c9f-835a-e24825117443", "value": "1536:DurKmcjb7qiiqL1HBHMmhbAn1et556tq/WAkRnNA:KUPBD1H5MmhEep6tqEJNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230405, "uuid": "40f24ea6-5a6a-4440-b065-1f9396386c37", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230405, "uuid": "75790183-b4d7-4922-9d32-df702aad24eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230405, "uuid": "16793af7-291b-4b2b-a705-cfd2204ce608", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea61a13-ff82-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629222150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629222150, "uuid": "cba8abc5-1004-4f96-a43c-12299d0005c4", "comment": "Malware payload (BitRAT)", "value": "97f1a585a7b4c15df61fa892fb3fc76d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629222150, "uuid": "fa934fe7-b5b1-43b2-870c-5148eb3a7f93", "comment": "Malware payload (BitRAT)", "value": "9a6e4a0945252684df6638c58bcc3f0eeb38923ab8b56972585692d43ecc532b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629222150, "uuid": "f40a3c0e-377c-4eb8-ac32-ddfc5987b35b", "comment": "Malware payload (BitRAT)", "value": "9d1564a02e8cd72e9cb188da42e05ae3511762c8", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629222150, "uuid": "ebd8f15d-8018-4e86-893d-1241a14a2583", "comment": "Malware payload (BitRAT)", "value": "149b62895451f020c0146a31983a1b48d0164f73eaefe439f975b9a992a98c1be606a84b5c9a51bc7c30d1302ff16214", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629222150, "uuid": "f16e71d1-8918-43d8-a504-68b0931893f9", "value": "T1C276337A24F0922BE1368774955D031AE2F09CD3F8DCD626E8C3648995716E2ADC0B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629222150, "uuid": "7533e9a2-911a-40bd-8f14-abfc69daf880", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629222150, "uuid": "e71df43f-90f2-4925-a48d-31b696bca57f", "value": "196608:9fXscaDbsQoXznnH/UAhB9ZOjy+puQqw/LMBkJzIDluZpK1:9fsOnfpDmKmTaMCloK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629222150, "uuid": "e514f78b-0f81-4143-8e41-2424ca4eb60e", "value": 7429120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629222150, "uuid": "92ed9f7d-7026-4e03-b238-59207cfa54a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629222150, "uuid": "87b59ddd-56dd-4dfc-85b8-a7b4c8c3933d", "value": "SecuriteInfo.com.generic.ml.654.29627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa378521-ff2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629186709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186709, "uuid": "39ffebc8-b252-45d7-b945-bef5ce80d2e0", "comment": "Malware payload (Loki)", "value": "fc9bb08703623f16b3b6fd654ab14b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186709, "uuid": "7c54583f-eaca-48c8-ac4d-2ff30234325d", "comment": "Malware payload (Loki)", "value": "9bdcb8eed0ddc7b700e3ac1ded641d2f5f703ea3cdfedc5eaad228f01cbb94d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186709, "uuid": "4c52f256-4e8b-4b46-9cf7-79657413df3a", "comment": "Malware payload (Loki)", "value": "6031a2a5e8be0d2004f4422a6bf88ad11909c75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186709, "uuid": "e4e05966-9ac3-495d-ae9a-8c5ef94910de", "comment": "Malware payload (Loki)", "value": "21c1d1085ce0e266c7f04ad0fcee88165214b7d244104085e632e88682ad13ee5b8436d4dc1104004bf816b6361c608e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186709, "uuid": "fb5484ad-9a0d-4c4a-b05a-724d26b8ad7c", "value": "T1F694D012F180C131E47104B5D6F593BEB838AF70272B54E793D46A39AE716D27A34B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186709, "uuid": "99f5239a-729c-4495-9e46-d068f91bfa2d", "value": "53c59b75f4f7c3e4cf3b5a4fc5238353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186709, "uuid": "ade2405d-b4ea-46fe-a39a-9b02bed9fcee", "value": "12288:WWAQN6SlDqx/YBUY7kpgr8GHlSoF+IsGq:WvrSlE/Yq9roF+PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186709, "uuid": "73216d4b-a138-4130-8446-df0a67af77c0", "value": 425568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186709, "uuid": "46da1d95-161e-48d8-bb20-590dfe02fe92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186709, "uuid": "95b06b28-7d54-4270-9d60-e655849bcd6a", "value": "fc9bb08703623f16b3b6fd654ab14b4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7a1af4-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629213425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213425, "uuid": "245e17b1-51d3-4455-bfa3-be91fb4857de", "comment": "Malware payload (Vjw0rm)", "value": "eeb0261c57ae2557a73b0a66f862e982", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213425, "uuid": "0f732143-c162-4452-ad94-7086e2f78963", "comment": "Malware payload (Vjw0rm)", "value": "9c048a52d161626ba45d49ba1a412b4cd1fc05520d4193a57d5b2edf7bbb885e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213425, "uuid": "2580c9f8-b633-4a81-958b-6fd9671c8254", "comment": "Malware payload (Vjw0rm)", "value": "aca3295dea76d1d31730bff6f30d3ed453eaca0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213425, "uuid": "0a70fd0b-2cdb-4a4c-ad8e-e644e08bd90a", "comment": "Malware payload (Vjw0rm)", "value": "0c5195156035382112845eb8cc3cb20bd1d12eaa5785b55c1dd058a1932e7411a4b3dd6e6a5884d68cab46c3bdde4239", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213425, "uuid": "383a7e07-559a-4783-9eb2-e2452bfcbf91", "value": "T1AA42AEC7B9C76E228B92C422960F4C4141E39390A18BFD8C9DF3B525F9E6E6A5D02547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213425, "uuid": "7ec3dcbd-6744-4539-82c6-5949fa80612d", "value": "384:e2e2itotH0lahotIvlLa0w3B280D15bXiRXJzTlNt0Th5P:e2atotUMotIba2Nx5bXqJzzt8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213425, "uuid": "9897c6e6-e9ce-4693-95ec-55ee0fc70eae", "value": 12842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213425, "uuid": "d1c31551-38c7-45a0-b3a7-8df4f7b43c3d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213425, "uuid": "9b998ba2-ab3c-484c-8406-40f3f55786d8", "value": "In_WO071.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5085bff4-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629190289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190289, "uuid": "0f42effc-21d4-4ef6-81ef-d77948f6feed", "comment": "Malware payload (AgentTesla)", "value": "fe9838e23a32c49c3e2f60efc5a09c84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190289, "uuid": "df26f5f7-96ac-48c1-bf7f-3d5ba00eb121", "comment": "Malware payload (AgentTesla)", "value": "9c50bc70c5a532f76b95ea8631bbb988a12c31f8ea6c0f848a6fa9ae1cb8d870", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190289, "uuid": "6cc41d03-bafa-4917-bc19-ed74241eef7c", "comment": "Malware payload (AgentTesla)", "value": "7b28d7394760ac66aa6e618875ce6141544c8b0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190289, "uuid": "9a8a86d1-572c-401e-a38d-9287295bede5", "comment": "Malware payload (AgentTesla)", "value": "cad12a67e853bdc20c371497be391d1d180292c4ddcf11e7bc44e4b041a61e19b847184f64ef468e1ee587f51ff1545b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190289, "uuid": "b38b7c31-2a91-4728-ac17-01ec2474163d", "value": "T11B53FE5CC4670288CF89AB781B6B6E85114C777DF7849932717C973827D2E7A601393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190289, "uuid": "18bc74cd-f80f-4a5f-a6ae-a9b33fde88d0", "value": "384:5GigTo/zU0ZEG5pb4idLQkdIgAzXH5WwqtMca4Vnq7iTrBOm5d:58G9hLQ5XjrWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190289, "uuid": "64a0b800-edfa-4794-9e78-b1e3a5bd509c", "value": 61427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190289, "uuid": "1978a95b-95f8-4c75-86dd-36e304771617", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190289, "uuid": "a6ff9d45-0a3a-4ec0-ba01-e7112f8718a9", "value": "specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bc56b4-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629209456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209456, "uuid": "002f4140-65b7-4c93-848c-d050d00fbf74", "comment": "Malware payload (RemcosRAT)", "value": "92f7d089a45779898e9e2fb3fb540d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209456, "uuid": "4d268419-af31-488a-8f3f-efe3dfffc4c4", "comment": "Malware payload (RemcosRAT)", "value": "9d524a914beb136ee8fdb96a99e046babcb3494c9f52b9f5ed5bf0c057beeb84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209456, "uuid": "d1c783cd-2630-4a57-b66d-6f3bf42a3d0d", "comment": "Malware payload (RemcosRAT)", "value": "e825370a90ca0d82f26175b1d44fc9b87e7d3857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209456, "uuid": "42fe4f40-6032-4c0d-9d42-3e981137e51f", "comment": "Malware payload (RemcosRAT)", "value": "c75a22db0196fd04fadd0c212167d02dc7f1651ea424e0a9e16945c73efdcd3790662525a29ff34704bb564f8b64a923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209456, "uuid": "b8652d5a-2405-4f9e-89a5-7407eb13f8a2", "value": "T15005D001A1825036DBE671350FB0DA7657782DAC5B2A9BE727F84D673BFC2832530627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209456, "uuid": "cdc9a530-4a31-47d3-8e92-7f5267b1e42f", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209456, "uuid": "0382698d-fd25-460f-ac35-562507223048", "value": "12288:GrxReILAqtDnzMyAmj8TeQ+eC2jaXqYp+cmA/JMR7ewDbX5VFo28Fyf:GrxRxACHMoj85CNXCcmNes7Fo28kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209456, "uuid": "730e4f98-d00a-47ed-804d-880a966df2f6", "value": 810150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209456, "uuid": "0934ab46-9eb1-4d88-9b6f-e389dd60b8fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209456, "uuid": "54c2f1ec-7852-4293-b052-fb905cb07eb4", "value": "invamppl\u00a0hbnbca-2021-001.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365ac17c-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208714, "uuid": "1d875ac2-cbd1-49a1-9912-64f85c69010f", "comment": "Malware payload", "value": "ace93056a44f8903f2f7e1f3e3784aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208714, "uuid": "aa4f97cf-ed6f-409f-98d3-a83decb5ed36", "comment": "Malware payload", "value": "9f03b7d0e39b50fca2ea43348487101ce4ee2d8d8e28d3c93ce628681804ced5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208714, "uuid": "0ce6b428-4613-4d8f-a658-6c7cb2eb82cf", "comment": "Malware payload", "value": "61082a8f02906366f76d4339d56a93d4dd236a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208714, "uuid": "68d8a62d-ddb8-4ae3-9318-2b23bdddf634", "comment": "Malware payload", "value": "4671df51242d8fb9deb3b25c555226104078a958d6c22099ae4803f5f3044e4687200401b74804dfded738e09bed0b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208714, "uuid": "24dcdb29-65a8-4bbc-bdb8-c925b706fa05", "value": "T17555E97825B43A37E17BC339DEE5481BF6D4B45BB211AA1670DE13670342A12B8D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208714, "uuid": "6ae2e6c1-1767-4bfa-85cb-e0342eb3e622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208714, "uuid": "e944ab77-5450-48bb-8321-d8533bbfabbd", "value": "24576:hlGQwcDcXzPRYUTMe87DFn48r9ggSi097tg0AS:AnKBZ9ghp7dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208714, "uuid": "87903e5f-9aef-4def-b8ff-46837a72edf3", "value": 1374720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208714, "uuid": "d35dbe7f-0dbe-4b50-b1b5-ebbfc63da6c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208714, "uuid": "4480cf29-658d-4e36-ba2a-a13b163edf9c", "value": "PO60452787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfdef8d-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209210, "uuid": "c7dd90fe-4162-4b47-9cd3-765e5c3342ae", "comment": "Malware payload (SnakeKeylogger)", "value": "5104d08c22968e304993f92a02080d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209210, "uuid": "c6a7af89-f171-4956-9753-7bdf9dce2e6c", "comment": "Malware payload (SnakeKeylogger)", "value": "9ff44ba44707bbdda0a858a2d0c11725b146fb4671ed91295ce2e0a3ac8b175c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209210, "uuid": "59be4fab-eaf8-4741-8afb-f28f61e5e38a", "comment": "Malware payload (SnakeKeylogger)", "value": "1361ea4b4044c23fe893b34f04da4e00ec526d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209210, "uuid": "e476a0fd-548b-4721-a346-5f06dc168673", "comment": "Malware payload (SnakeKeylogger)", "value": "79cefe5162982b4b4b1cd9a3e24f731a1f9edf04da6c2626ad88f90568542724e57c66d7b4fcf0d2e65dbaac33d4032c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209210, "uuid": "9287baf6-0fee-4466-98b6-a627c32d19a3", "value": "T1A3154F3C1BB925A7D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209210, "uuid": "6ced2999-5d1e-4d2c-b6cd-f7618dd0db86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209210, "uuid": "9036bf85-19c8-47af-b674-6b6245155005", "value": "12288:URDc9F3nC0Py3gAh5EJbjJEKJVzJlE+rOEkfW1Mx7MAfCFE+IHVDaaUIwthIBjdJ:NpJlE+rOEX0Laa+IHEztojzBXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209210, "uuid": "eea7efdc-2e0f-47bd-b2ac-4c1e3b5b2bfb", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209210, "uuid": "53b950b9-32a0-4b4e-ae1a-af48ad7b4f46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209210, "uuid": "a62465db-05ae-4140-8638-f276ca2ebcdf", "value": "HBi4lXErtcfIbap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac402595-ff26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629182712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182712, "uuid": "41c8b738-d553-4d2a-8956-481249d2380b", "comment": "Malware payload (Loki)", "value": "86350fba3fb9d12995160bc98a0b231c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182712, "uuid": "a55439ee-d521-4554-91f8-c0ba5fff48ce", "comment": "Malware payload (Loki)", "value": "a0846459f175f0d4b614759bf41caa01bcecbbf51a54b1278da7dc64ba884e29", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182712, "uuid": "f25387f4-6a21-41d7-8449-6464db43e03f", "comment": "Malware payload (Loki)", "value": "5832f89a60809d747aae2e994fea868a33a11ead", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182712, "uuid": "100b2dca-a89a-4f4c-bc75-f1266f06f1ef", "comment": "Malware payload (Loki)", "value": "d8e58fb8d29502a504a37b0d628d4dc6b6c97ce321da736b69e45b518497793255ca5517bd072d0b9b41660cf48e5a5b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182712, "uuid": "07c8ddbb-ea84-4a1f-8454-c67aba30a64c", "value": "T15A45224175A0EF26E32251B1A6E2EC102FB8DED39F219F2EA76C31570536BF9085B351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182712, "uuid": "e424675b-bb16-47b5-ae80-dd47c3feae95", "value": "24576:BLJWHNN3vix5olsaUMdffjbwN3pTRATPvwul2B0P0Nfs2N5Dccz8tVt/+Yv7K1AI:BVWHN5KQDA3p9AjvwuDsNUYxz8tuYjl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182712, "uuid": "9dc885b4-4799-4d06-a83e-4fea9b8d7f0f", "value": 1269976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182712, "uuid": "de052954-8137-4af7-a941-1c5eecbb3f05", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182712, "uuid": "f0d9fc15-80c8-47de-9216-3b89a2671121", "value": "Bank Swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9ef6eb-ff44-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629195383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195383, "uuid": "a43954c3-843f-4235-9365-f8a373c59bce", "comment": "Malware payload (OskiStealer)", "value": "b43ae45b39a0647231b51c2d438a554e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195383, "uuid": "dd9809ca-5f6a-45ba-9176-fa0e7e2ccedf", "comment": "Malware payload (OskiStealer)", "value": "a2013616892886b9fcd2067d2e77436c5233653772f6a6f235a325b1122c34a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195383, "uuid": "28735ad9-b847-4b9d-a7b6-6f7df80f9414", "comment": "Malware payload (OskiStealer)", "value": "7f7f55ef05410e17329dd3fb3c26e325f227592a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195383, "uuid": "e113dee7-a5dd-4190-8d6e-227cbcf231e9", "comment": "Malware payload (OskiStealer)", "value": "f0e4499590b3cdc30e803f57951577c47a0e48981f12669125705da3cbebfe2c78e86d3f335eba5bc2f31fe0bf3635a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195383, "uuid": "0d1bf44e-ae74-42e3-b174-c73427843506", "value": "T183E46B6D3150B9AFD137CD36C4580E14F660A8A7E3CBC613E0932959983D7AA9E443BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195383, "uuid": "94964497-a9e7-4758-b14d-5e70a7f56853", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195383, "uuid": "226ad657-793c-4b51-acca-5f135dc07145", "value": "12288:g9bDKZtBLE5x4T7RejE+BAdB1JLsSe/RXz/ZwgQiXG/IPQQ0pvRCph5kz1200CZ:EgLE5uTdejkRe/11wm21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629195383, "uuid": "617036c4-7924-4e3a-a398-01f2583dc449", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629195383, "uuid": "563fa1f4-753a-4055-ab8c-54dd346368da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195383, "uuid": "04124958-3307-4062-8ed8-af7362766af9", "value": "DHL DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51b9f03-ff3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629191774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191774, "uuid": "75dc4326-dbfa-478a-8d9a-b39ea73e758d", "comment": "Malware payload (Formbook)", "value": "ba6be7e0ce59234fb039ef981d7c3278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191774, "uuid": "16cd6377-d453-4488-b036-14f2a6faca7d", "comment": "Malware payload (Formbook)", "value": "a2beda57a5e0995d2108071e88e5c70bb171d4434fa2a3c6c788ef066e9d43b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191774, "uuid": "16a6ec04-660c-44d5-94db-0784fd3afe17", "comment": "Malware payload (Formbook)", "value": "b1258c9f9920443ff88a0ad26e91c054fba01f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191774, "uuid": "32ac0001-8031-4853-a642-4b03ebd3f3fa", "comment": "Malware payload (Formbook)", "value": "542b307d1e15ddc2de6e861318c607d9989aa849218fb86849fda79fd1a3daeef0e27781d6190ab09e99d6f6283a27aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191774, "uuid": "702bf755-d284-4d4e-9419-a6af3eb1b34f", "value": "T1D3C406DA52418C63F4A29F3397903370DDE49B7DFBA589AA11D72D7C5228B4328530AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191774, "uuid": "60a35eab-97ae-44b6-a8c9-5ee75e973781", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191774, "uuid": "65be2170-3782-4d2d-8467-1b7ee12d158b", "value": "12288:Irx5eILAqtDnqeVySvaJF9Se039ZyIqf8:Irx5xAC2OTI90tZyvf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191774, "uuid": "9990fbc4-25c4-4a9f-95d9-2f5f46a4320f", "value": 561569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191774, "uuid": "07b02598-fe64-4779-8385-1591a488bcdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191774, "uuid": "7a8c7462-088a-4cc7-a56a-dc631b363058", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.23328.19757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1132fde4-ff09-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169997, "uuid": "a57a8aec-3c30-4168-8a6d-ebae360a289a", "comment": "Malware payload (Mirai)", "value": "f1afae12e8a09435adc80ebe8c4b5f4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169997, "uuid": "1aee0df9-bb18-40a0-96e6-b5f93910eef6", "comment": "Malware payload (Mirai)", "value": "a34417c8918f4e282e7b76f5bdd2b24861df72a8e112f9174ece6adfe9948ef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169997, "uuid": "11c35289-8d64-487f-8a6e-4d46ccc91e3f", "comment": "Malware payload (Mirai)", "value": "ee9a196e133841899550044a4dd3b168f095dfcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169997, "uuid": "35e6abc0-b9be-4cc8-8bea-4cdea39b010c", "comment": "Malware payload (Mirai)", "value": "1f86e6411474be1f9a69a93b25c2023333970e5f6a685946e7a5f53787e2fa3c665795b95362cb99b5fde93d7c3abb51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169997, "uuid": "c355e709-edf3-4b1f-aa1b-3927c573ad71", "value": "T19B73A61E7E258FFDF799823447B78E216A5823C637E1D2C5D29CD6012E6024E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169997, "uuid": "a89dabc2-cc11-4ef4-aaae-a664ff9c571e", "value": "1536:qztcPRFA6olzsswoBO4ko9lOU8uzNZWMbobAgwbFa10L:qC8nwoBO4QmzNZW8gU8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169997, "uuid": "a1d1ab64-c7ad-4466-824c-cda0feb28a6a", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169997, "uuid": "f060d590-ef8c-41cd-b8df-874bd1447643", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169997, "uuid": "b11b163e-262f-4ed4-866c-a68c36ebe9d4", "value": "f1afae12e8a09435adc80ebe8c4b5f4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2202eb-fef5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629161556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161556, "uuid": "c5b8ed89-d3fb-4169-9cf4-3085f312c781", "comment": "Malware payload (Dridex)", "value": "1b60acb82b95d28742594513bae7c9a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161556, "uuid": "c47d989e-2fc0-4f1c-9516-998a980f7613", "comment": "Malware payload (Dridex)", "value": "a34cad96dd43ab4784b0b96b601719a123d23daba217e37803afd3baab323810", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161556, "uuid": "7f950ca0-b601-4da4-a8a3-087f84641a78", "comment": "Malware payload (Dridex)", "value": "f2fadc54bd2cfcb23c4d3ba73d70952463450677", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629161556, "uuid": "e588e4e3-d2ca-47c7-91a0-8251c1a86f8f", "comment": "Malware payload (Dridex)", "value": "642c4191aeef3bcbdaef66ef2948773c686c4c0e1cc26b64a16d9380317636b31719f1e9130f48765229e03fb811cd26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161556, "uuid": "175d5b97-59cf-4446-be19-b3e5111edfb4", "value": "T16214022BDA6D2903C648D7B97F472D5013CA4642D70BB9C85DB7399E2E98AE347D600C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161556, "uuid": "23f88203-56ca-4bc7-8681-a6a8b011d44e", "value": "3072:IJ/ogkBdPxNLho1Wi3ywBU5jNg43DBYWhE9aUkFY7BCjzqaJASsI6qYOuAHZnNOj:mogkLjLho5COQbuwE9aWw+aJ0IBuok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629161556, "uuid": "66070c9d-f2c6-46ba-b8f5-f9456261e267", "value": 206010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629161556, "uuid": "5ac8792f-8ea4-4fd3-86a6-3fc2b492fc9c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629161556, "uuid": "98ef1dc1-9e69-4805-93de-34e8f8c3732c", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.034298999.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a46c45c-ff47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629196856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196856, "uuid": "7179b64e-f4ce-4423-b561-d8f113786e30", "comment": "Malware payload (RedLineStealer)", "value": "325dd7c825006968846e9cd8e5d3ddbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196856, "uuid": "ad342612-6fd1-4156-87a3-5c9ac16ab30d", "comment": "Malware payload (RedLineStealer)", "value": "a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac9e34c21fde5f2b13eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196856, "uuid": "f99e140c-a35c-43d5-a903-70e7d783e626", "comment": "Malware payload (RedLineStealer)", "value": "cb5aa59c64b22a3fb33d83fc3086b0d2b5ceb0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196856, "uuid": "c1658a2c-37db-432f-9f77-e06854bacc4e", "comment": "Malware payload (RedLineStealer)", "value": "4127317c136f4cf7cc9ba87623c7517cd6d306d0475a5a8b124c0f223b46fec3bfea9daf5f4f8d030ef416acbf852a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196856, "uuid": "70397cfd-8b92-442d-93a9-256a90921d7e", "value": "T132A33A2263ECC629F7BE0A3664701114C7F0E48F6411E75F4FC5B8DA1E767826A44AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196856, "uuid": "178183a1-0104-4322-acb4-87cfa90b7f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196856, "uuid": "c0605e9a-7490-4bb2-9d44-b2104dae4080", "value": "1536:Po6aG75CPeGjuo5zkdXv3QIuoau0wQgbueivUuvNyAsdj3etx5REPG6WAaoigz:PdxlCF9IpuB/qAUulyddiNWlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629196856, "uuid": "600ea8db-1bfb-48dd-b598-5b77a626fe24", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629196856, "uuid": "185d6dbc-7e63-4345-a10a-3d063fd84971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196856, "uuid": "051237aa-a9f7-4975-9efe-dd2fb7f0ab13", "value": "a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc8cbad-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629210095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210095, "uuid": "0a3eb557-c6ce-4e31-ac88-346cd3ff390e", "comment": "Malware payload (TrickBot)", "value": "45d60426d3e2c86de3a9a90dce32672d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top115", "colour": "#B48E68", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210095, "uuid": "cd7c6e61-ae62-4066-baa3-12a97f6468e0", "comment": "Malware payload (TrickBot)", "value": "a36663051732f55a2234bd46bd8d0cda539be2bf2aad3a0e1b27be1686046127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top115", "colour": "#B48E68", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210095, "uuid": "ab52e55b-f9fd-449c-a45a-a0e9510d84d5", "comment": "Malware payload (TrickBot)", "value": "06070081e9a98f60ba4d6d49b85cd686c5933b4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top115", "colour": "#B48E68", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210095, "uuid": "55f5b774-f5ec-421e-bc5c-dc6bf06a6c1f", "comment": "Malware payload (TrickBot)", "value": "1772a30f95ef8cf87a77e51b262e9a97f1b2c9893e592b3bc96b07f4f80664291a354cf3808eb51bc1856e1a1c1c76e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top115", "colour": "#B48E68", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210095, "uuid": "5e006bcf-ef9d-4468-bbdf-9ba35231d93a", "value": "T1B5F47C09B6BECC35C09A143F5FD25664626BAE025B25F58773872B8C8630B62B53731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210095, "uuid": "732fc732-48fa-4d2f-9fa5-7c5e0215d9d3", "value": "ec99d108fd03acbc59a2a6c0a950d47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210095, "uuid": "d440be84-f865-4ef6-97db-646f981cf195", "value": "12288:weTBslq08I3L92xhqmqUVWFxjPf/jxEnU2vMQsK:5tI3L9WqdjPV67j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210095, "uuid": "5a5fb709-bd27-4930-89d5-89f5aabfb0fe", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210095, "uuid": "dadef5e9-f6d5-4701-8a4a-ec909e9a509d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210095, "uuid": "889cb4ec-4e6d-499a-a1c0-c539680cc06c", "value": "45d60426d3e2c86de3a9a90dce32672d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e45abd-ff60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629207661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207661, "uuid": "760871f1-50a1-48bb-b847-2a24e930dac7", "comment": "Malware payload (NanoCore)", "value": "604054d63b8bab51e3336cbfde426271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207661, "uuid": "a449670e-6b97-4043-8d05-e851fa3b7743", "comment": "Malware payload (NanoCore)", "value": "a46b3e0a2f558e89da3c71e7a626201824243315c37970cc34dd60162f9640a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207661, "uuid": "0aa09737-f2af-4712-a631-b6373dad00d9", "comment": "Malware payload (NanoCore)", "value": "f08e839ef734e423f5d4d45d25f1377f61396bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207661, "uuid": "1a044464-dcdd-4d8e-9333-232a321c8206", "comment": "Malware payload (NanoCore)", "value": "86ad4636518993bc25cbe5ceb77cbcd3532c31c7b7aba6b0ea32c1b4c661448863725e48a314bdf9de9e9c95570ac4d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207661, "uuid": "6a81b304-b9f7-4ebd-a5c0-d7254943f9ca", "value": "T12515063C19B93A37E0B9D765EBE18817B190989F3511AD98A8DE03A70707A4375C733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207661, "uuid": "a43fada7-1329-491e-9297-f475b847a577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207661, "uuid": "958ea45d-9662-4fba-9873-c6255cab969b", "value": "12288:IqRsbDc9F3nC0Py3gAhEwpQQIPoigJy3wPTDpshA/271OUFjDCVeWErBTSVbYhkp:Ic3gM3Uq7NjlzrlSVEhkNtbMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207661, "uuid": "2c946dfa-797b-42d6-b6f1-02be76bbbfcd", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207661, "uuid": "1b77966e-c856-4da7-b081-65fa8469bc3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207661, "uuid": "7cc30904-3c77-4561-9cc9-ad13428d9ce4", "value": "604054d63b8bab51e3336cbfde426271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026e056d-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209915, "uuid": "75db54fe-de13-4497-a049-1dd8032cc327", "comment": "Malware payload (Formbook)", "value": "443cdabab07bf375f119a8c22e2114be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209915, "uuid": "49b3a652-bc45-40de-9224-fb78acdc7528", "comment": "Malware payload (Formbook)", "value": "a57f84d7e89cc76408c67fbcc2c8e3c03bf98a8daa93209f3650ebffa09faabb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209915, "uuid": "bb6869fa-03d5-4533-83bd-5c97bf8c4c3f", "comment": "Malware payload (Formbook)", "value": "2e155cb516dd9071271785a3f991e9255929e4ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209915, "uuid": "8004a171-80d3-4bf9-9381-264264ff8e01", "comment": "Malware payload (Formbook)", "value": "65f2e8c664af6bf31ada3d88ebbc71f47c9bcc6e50382405bdabdb542c9e97e22ee76084cee62c32b88c23cf7d5f15fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209915, "uuid": "8a5ad8b7-bae2-4db5-bf07-61105d58b937", "value": "T14505E53C19B83A27E0B9D765EBE18817B190949F3521BD99A8CE03A70707A4375D733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209915, "uuid": "3b622319-c32f-4fa2-b872-f17c60ef1cce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209915, "uuid": "c008e591-4259-40b6-9084-54a8c1bf4c20", "value": "12288:rgDc9F3nC0Py3gAhMa0L7Gyf0fQbN7CGfyCwgztRfVZiEm28cn4OvNG:rnnMf27o7afVZzBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209915, "uuid": "ca2746df-2780-47f5-ab21-ed230dddb40d", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209915, "uuid": "b3c37b7f-a767-4215-ac20-4d98ee7d7463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209915, "uuid": "c062f446-7762-4d93-bb1b-f69f72ebbe09", "value": "443cdabab07bf375f119a8c22e2114be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dae100b-ff27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629182983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182983, "uuid": "4e981998-aacc-4fd9-a996-3c55596ddcb5", "comment": "Malware payload (Loki)", "value": "0141449a7260bbbbe39b7b42b8e4db35", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182983, "uuid": "aba33510-5d4b-42e4-858d-710dbe58d14e", "comment": "Malware payload (Loki)", "value": "a5b437cf394788484a5aa5a372a6c037f18b55893d277efab3f252d51c59df45", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182983, "uuid": "d6e738f3-d7c5-4885-8e2d-a5535f5283bf", "comment": "Malware payload (Loki)", "value": "0fb3d969eb1e7e7ae7004a3a2c3975f33ed74689", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182983, "uuid": "5d0322be-b79b-4f25-8785-05f34af76b13", "comment": "Malware payload (Loki)", "value": "865ea2c877cff9389ba5e59adf7260982e311be00dbe9af7581fe4520b6db6e6f3b6d8e5ae4d01f582942b558c9dab4e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182983, "uuid": "321cf1eb-b278-4ef9-8d79-34d9aa457236", "value": "T14F55121058EE1753D31318767A653021FE17AE9C63BAF8CA660F3720AA71E7A1D95C38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182983, "uuid": "f725a089-7dca-4f3f-90a1-88e2c34d349d", "value": "24576:3VcpFWW3OKqQKSbcfY7sBKg98C6+vqe/3E01PR11dQXBG6:lcwW3OK2hXKSzS03D5EXB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182983, "uuid": "68533ad9-1d47-4b01-9578-dcde5d51d2b1", "value": 1295912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182983, "uuid": "a1587680-9ba9-4f3d-b907-109f871594d3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182983, "uuid": "51b8b50b-d17c-4dbb-9709-27c64165a434", "value": "Remittance Advice LHN1800152.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ee2b75-ff6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629212800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212800, "uuid": "ada308ca-d30c-4665-830d-e8ce04592f56", "comment": "Malware payload", "value": "2b26fb332ceca5db7983d7734d26db2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212800, "uuid": "6cb49908-971e-4113-b7f4-7720ecf6f9c0", "comment": "Malware payload", "value": "a5f1d868554f25c62ae765535b0b8adff7fd8e307e51cb0b8d96417dbe4e0f60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212800, "uuid": "105a1097-0562-402b-af2b-535c2beca6d0", "comment": "Malware payload", "value": "9099c1828cd54dde4662a74953bad9fd63383c79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212800, "uuid": "0a3d0241-eaa4-4a67-8457-938775f5a5ab", "comment": "Malware payload", "value": "e53f8c272ab02d0fd361fbd1042c4eab442b642a5b419d5a82dd85b22334e6712350fd3a865bc5e25b46e9cef56a0aea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212800, "uuid": "7b531613-6cf1-4d1d-9dda-62983309fd13", "value": "T16555E93815B43A2BE179C339DEE4482BE6D4F45B7211AA1A70DE57670343E42B89327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212800, "uuid": "e2b2b0c7-1541-4633-836c-da03e17d4989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212800, "uuid": "9870ebba-4b82-4215-ac5d-f34c449e3f1e", "value": "24576:Nt3gRcacWzhfLbiMPHA2FnQpVBYsaz5zO8gJvRDTWYs3RqvHmkU:yCX2BUQsSlO8gJhCWvH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212800, "uuid": "e63300cc-bc20-4493-9215-e4057daa0986", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212800, "uuid": "daa5fd51-bd1d-4876-a82a-b9ec304249f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212800, "uuid": "81cbb17c-d5b3-4273-b686-3dd8bb588bdf", "value": "2b26fb332ceca5db7983d7734d26db2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c6b193-ffa5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629237358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629237358, "uuid": "272286a9-e08a-4b40-9212-e7853f8a35a5", "comment": "Malware payload (DiamondFox)", "value": "2d3e5a2a2243d788901fb182156f4031", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629237358, "uuid": "b5bffb1d-c31f-4e78-8258-37f65861edd6", "comment": "Malware payload (DiamondFox)", "value": "a5f4eb3b915bcfdd72cb81b7d89c0c0fd6b190b637db6ffad25604d24985f9e8", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629237358, "uuid": "5c86fe97-f535-4570-9d36-b1beb5c9b5c8", "comment": "Malware payload (DiamondFox)", "value": "acf66cababaeba6d72e72d2962405f41052d79a0", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629237358, "uuid": "14ffb13e-30b5-4676-811f-c3b98035e913", "comment": "Malware payload (DiamondFox)", "value": "822220a5f1c61d521c8a2c66be3e09c19ab05dfef72d51012264529ddde8f271d5144bcc9e0907bf46dee8ac998da5b7", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629237358, "uuid": "33f99e5e-5af8-4fa1-a9eb-22ebf5d86bbf", "value": "T1DC2633387764C043D8E0977024139336C6767C21146E65962BB217DAB1B2FC9FAAF36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629237358, "uuid": "d7862abc-21be-4587-9679-9d3d66b4f27d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629237358, "uuid": "e7f2ae8c-be43-40eb-8cac-8f61bc2adf44", "value": "98304:Jwg2hGtNVybTZMYTX1Wnlz1vdN0J5Nfm/Fb0bIQ81NN25Fv:JwvhoybtMYxWZBGBm9b0bIJ5Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629237358, "uuid": "5481cc45-3976-4751-be87-eb888cdcfbe4", "value": 4749755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629237358, "uuid": "99a5dc1c-9282-46f7-a995-2d52fd903a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629237358, "uuid": "89dfa90e-9d69-4039-baa4-cbe84f99cacc", "value": "A5F4EB3B915BCFDD72CB81B7D89C0C0FD6B190B637DB6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee74981-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209023, "uuid": "3be3504b-1df8-4920-b85d-ac5c897bb032", "comment": "Malware payload (SnakeKeylogger)", "value": "be288caf291b8a450f3f3dd403bfab50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209023, "uuid": "f5b99649-7484-42cd-9796-e04a12df8c52", "comment": "Malware payload (SnakeKeylogger)", "value": "a6ed502eed06dbf0ca6a59b67e845318952d2b0e4c64c34275f6083f68231818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209023, "uuid": "b908ad46-6e41-4ee2-803b-eb1e695f962f", "comment": "Malware payload (SnakeKeylogger)", "value": "af5d45672acefe0c143c594b37a96032427934f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209023, "uuid": "e62492af-4cf9-4548-92f1-40431dfa4b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d352cd494888c217a8b059eed809bfddf0d300dd28abb1dfe269c2add69d9ae3873eeb93d6541a50881dbbcbaf4762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209023, "uuid": "62b77203-076a-4d7d-bc66-94bee7588dd2", "value": "T15A154F3C1BB92667D165D63EABD18617F00096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209023, "uuid": "6d6ee8df-6f93-4623-bd28-bf30a310c21d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209023, "uuid": "b5bed849-a91d-4df4-8309-18cc2fc9ce70", "value": "12288:ONAs0Dc9F3nC0Py3gAhQEJbjJEKmE5agNZVy6t9uSGm9jdxxdM5txOySM:qeaybPtYSGm9dxQDxORM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209023, "uuid": "c78b3e1d-9ee9-4639-b3c4-ff15ce6e3e9b", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209023, "uuid": "632a9e1b-6f86-4576-88a2-e5b435e7e160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209023, "uuid": "2ee8cf69-63f9-4176-891b-733c0bb3ca2f", "value": "SKMBT_28321063007131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2f23ca-ff3c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Lucifer)", "timestamp": 1629191893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191893, "uuid": "fcaeffd3-2494-415d-a828-2c15d627680c", "comment": "Malware payload (Lucifer)", "value": "3293d248334ddddee4641669b7899edf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191893, "uuid": "3e9ac093-d4f2-4a42-9a42-9e70f1380535", "comment": "Malware payload (Lucifer)", "value": "a6ffcfaa969678a5e2a0b365f4ab1cbec05f428bd7d56b5b3edf08ddb6a70166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191893, "uuid": "886f41bc-9fe5-445a-a558-42156cb29a09", "comment": "Malware payload (Lucifer)", "value": "a956da2113c26c7cc482187273fc5b8a0f9b3c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191893, "uuid": "5f68ddff-c6b8-4eac-86f0-e3f76dd19527", "comment": "Malware payload (Lucifer)", "value": "3d404ae61bcd82b6f02e9c503a65cb68de74dc1793511b6cd9eed7ff38baf4f76e7a9eb3d718746bee7877ea4bb0c4eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191893, "uuid": "d38961a1-c637-4f05-9cb3-77b2614bd5c7", "value": "T1E055F73A16B82B27E079E365E6E44417B3E0945FB225ED58BCCA47E70206F4265C733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191893, "uuid": "3efb3564-dd8a-40d6-bb0d-c39df96913bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191893, "uuid": "9af49252-63e2-40ea-a799-c51fa570f41f", "value": "24576:b6cuaFYLblhBQIxXbyPY4oeUlJOuvJdarONcBhq6Y:Hy31hJ0oeUTPJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191893, "uuid": "454ebc02-d4db-482a-a77c-0dd1e2c2a694", "value": 1345024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191893, "uuid": "c25327b9-0c35-43c9-8ca5-11bca4e2f312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191893, "uuid": "2bf3a254-affd-4c49-89f0-abce76e6ae01", "value": "3293d248334ddddee4641669b7899edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbef1792-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1629206898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206898, "uuid": "b56670cc-cc0f-41d1-9467-d9b6dda42cac", "comment": "Malware payload (QuasarRAT)", "value": "4db130891e3112bdcb25aae206c8d324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206898, "uuid": "c8840a69-ba38-41ef-b44f-35e2a63aa390", "comment": "Malware payload (QuasarRAT)", "value": "a7d8154bb436ed2e91516ab13e82aaee5f76e9af2d16d6ce62758aa3c17f0b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206898, "uuid": "58034606-cffd-48b9-82c9-1a67801c7aba", "comment": "Malware payload (QuasarRAT)", "value": "3f6e78c1d0789bc1c194f569eaabd92e6699496e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206898, "uuid": "e99be8e0-1f9e-48c1-b7ef-bcc8d8f99d69", "comment": "Malware payload (QuasarRAT)", "value": "0fdd957ecd5d61317106b7f223b6f9f8d5f78501f7ed088edb20fdb172f822a9b53c8bbd20c6abe53c53def50f59ad91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206898, "uuid": "f7a4ca7a-ddd0-4e36-9182-32863cf6b3d5", "value": "T142C449122BE8CA1BE1BE6771E4B004249BF5F116B666D78F1A8461F91C63B41ED013BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206898, "uuid": "657b6e06-a5c4-40ce-9214-e5105fc40521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206898, "uuid": "7db08827-737e-401d-adc3-05821ffaad1d", "value": "6144:0uPIHzXADn3gObC/yAkdu8f7HJpUUdUbB1tdAsWLfMcN5hdK:0xynHdp5ytqJf3N9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206898, "uuid": "7f8ef1a3-1452-4fdb-b9be-6e4faf189b90", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206898, "uuid": "63afba7f-7a4e-4ee0-a847-3a7984b81704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206898, "uuid": "ba4c4263-a48f-4afe-b625-3be74a980e4c", "value": "4db130891e3112bdcb25aae206c8d324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8010e02f-feef-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629159016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159016, "uuid": "1a0142fa-1e8d-4cc1-b44b-9dfd05316336", "comment": "Malware payload (Dridex)", "value": "6e91a59509fa5b21802bb4f9bd27b8e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159016, "uuid": "bff0e2a1-8705-4d5d-87ca-13e478695518", "comment": "Malware payload (Dridex)", "value": "a8685738da4ee54d933de931cb44d625947af5fcbf17c5dc9b434559020a91a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159016, "uuid": "5debaf30-ea52-48b5-a017-e5501ca89a3c", "comment": "Malware payload (Dridex)", "value": "bc7774d6a8ac11a7b54f970a447c806255a868c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159016, "uuid": "087f2460-dd0a-4fdb-a198-a0094bf725ef", "comment": "Malware payload (Dridex)", "value": "ec02c8d1e26b3e8685f6a8f84638c1705c24059b600a88f09758b6789a03f2332706853e83218e706691764b2bc57c5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159016, "uuid": "3108e728-b366-47d3-bce5-8479ffa949c1", "value": "T17E24023BD9105D03D55CD3BB7E0918B0038C9E05A306F6DAB9F12F696B989F82BF2159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159016, "uuid": "6f9d0580-d17a-4c33-b658-aa9f6621ec31", "value": "3072:yJ/ogkBdPxNLhhy18rlhI2m2l3cI/6CDskGm4arFrR/PFfwXWP0luU7LxGx5KZu9:kogkLjLhhHlLmg3cIiTU191XkO53Z3jP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629159016, "uuid": "2dc48d0c-8ca2-4a25-931d-9e859b6486e4", "value": 215679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629159016, "uuid": "9051504f-ea8d-43c7-be41-708ed47e8836", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159016, "uuid": "dd672932-a2e5-4bb2-8917-f1a80fb40008", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.5829682135.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c83117b-ff9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629234575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234575, "uuid": "07b94e33-4539-4ccc-bf7a-01b01da1ae89", "comment": "Malware payload", "value": "84af38b9410928291a268a93334d23b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234575, "uuid": "a9eed298-5d11-4e4c-b5ae-a9af116874a6", "comment": "Malware payload", "value": "a8f05fa9e5f1791bc81e786b5480af8ae9b4334887b8d939bc365e0fa29c6921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234575, "uuid": "beec42fa-750f-40b9-87e5-e932ea552e95", "comment": "Malware payload", "value": "14d465574601fb289bf48399132ceed16f4f7fe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234575, "uuid": "a25bfb2b-69e5-483c-b71f-ec75235b478a", "comment": "Malware payload", "value": "6143481552dbe3cb896a1703ad711331b3bebed1058ff2bb632b7d0531dd24a1605e7fa6035b9917e45963752f2350e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234575, "uuid": "fcc000b5-c5e5-4241-b99e-e47f244006da", "value": "T11EF2F216CD47BCE1F9FBB9F51C653AA1B7F28E476216C5629782BE13D7100322214DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234575, "uuid": "7b02e388-dc84-48d3-8610-efac0817f65a", "value": "768:Xb+S3FhHkQ1+7ZQuUu9RrTdD8DI06MWnQWDtBmG1pKVus4uVcqgw02NWXR:Xb+UF17+qA9Rr5bJrphHKVB4u+qgw06q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629234575, "uuid": "a4a4768c-9354-473c-bb23-304cc16dbe58", "value": 36052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629234575, "uuid": "99c5c96b-fd32-45a3-a948-93eee3b9c096", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234575, "uuid": "49a2a67a-621c-4913-9614-3a7d3f2c90d3", "value": "84af38b9410928291a268a93334d23b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695d5b69-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629209229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209229, "uuid": "bc7957a6-5372-47b1-8fa2-4ac7abf21ff1", "comment": "Malware payload (SnakeKeylogger)", "value": "17eed9e5eb1a63817d7d896a8f3a71f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209229, "uuid": "bd87191d-9c04-4b77-8d82-dd465ae38e00", "comment": "Malware payload (SnakeKeylogger)", "value": "a8f7039e38c57a47b41ba78a2e0b78efb9c4438f8f36bb15df8b36ae04cce60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209229, "uuid": "54935904-bb67-4565-814d-09f39e03379a", "comment": "Malware payload (SnakeKeylogger)", "value": "6cf8fb3ba241e4833b40c793509d6fa4a12d83a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209229, "uuid": "5596401b-4cb1-4380-88e2-28adc67af19a", "comment": "Malware payload (SnakeKeylogger)", "value": "54c7e54fa82ea1ce36416951c5c460f1aef5963b36a12367b090d0a5f952091756f8fd36b33b85615ab09f22e1df164f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209229, "uuid": "7f4ab7f2-c34b-4ca9-9bbc-c03b88e0eae2", "value": "T1BF154E381BB92567D065D63EABD18617F04096DF3411AA57A4CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209229, "uuid": "7839048a-d27d-4d3c-ba8f-b7d31301ad27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209229, "uuid": "39520106-4c26-48a0-be24-226a3a282eb7", "value": "12288:PJDc9F3nC0Py3gAhXEJbjJEK5nzKfIh+OWJp10s07snoA:unzKfIHWJp6n7soA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209229, "uuid": "1bd96422-9f8d-4769-811b-be9ebeb18267", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209229, "uuid": "2ef44971-e66d-4d57-a17f-6a223e749b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209229, "uuid": "29be7aa4-bbef-46ea-8bcd-ef3c8f30fa1e", "value": "Swift Bilgilendirmeniz!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b9f507-ff37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629190107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190107, "uuid": "4d70902f-bab3-47c7-a309-c2a34d06a2f6", "comment": "Malware payload (RemcosRAT)", "value": "8c7183dda2641762c505f644e4d60a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190107, "uuid": "6a1d7c59-70de-468b-9237-dd5ea17bd05f", "comment": "Malware payload (RemcosRAT)", "value": "a9584f63d38c2dec8fa79a9f0e1d9d2c30d8afdd84bea99e2139ff65898f0df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190107, "uuid": "4e98b23a-384e-48d3-bd3a-98a3ad969f6e", "comment": "Malware payload (RemcosRAT)", "value": "03a2aa1c198960d16fd83f94a5553aa8238d1b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190107, "uuid": "f3e1173d-8009-4a52-b947-5ee8e66d66ee", "comment": "Malware payload (RemcosRAT)", "value": "e9569324226cf86cdeba9bab8ad9ddc474e3f87aeb2fb9994520fd6999e3f952d1f3948090aface5f1d5fdb2d528376c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190107, "uuid": "5576dc3b-b9b4-4600-9ac9-0b136d1af816", "value": "T1FB457C8FBE92AD37C50A1AB31F1E5668851EBE603C25684A77E4FB4F25732C1780494F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190107, "uuid": "ef2859e7-6e01-4453-abf5-6747d1155bb7", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190107, "uuid": "b8bfb2ac-9a68-4132-bd3a-6d57035aef09", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0F:8ej+XQUeET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190107, "uuid": "fd9dcb6b-5bd2-4dc8-ae54-fe749a95f49b", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190107, "uuid": "327376ab-1100-4a8c-9d3e-2efea05fcced", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190107, "uuid": "6d7389e9-756c-4209-8164-dcbe14870f4e", "value": "Microsoft Excel 2010 sipari\u015fi WJO-1460911120343.xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66349642-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629208794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208794, "uuid": "b4037164-e6e8-4b6e-888a-ac57f21307b7", "comment": "Malware payload (SnakeKeylogger)", "value": "5919a66be63ba1de279a0a78349613d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208794, "uuid": "13a64f73-bfe7-4804-8123-3c93d16b8a57", "comment": "Malware payload (SnakeKeylogger)", "value": "a9d91022595afb8ce8aa5d00f0bdad8e887b9a3ddd3e3207daa2c3cdbb1a4181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208794, "uuid": "b333920a-6300-4949-839a-36023dd22b7a", "comment": "Malware payload (SnakeKeylogger)", "value": "b828d0131153dfaad6861f27867663756943aff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208794, "uuid": "5cbbc1fb-ada3-4dbc-a4df-a1c043c51aa7", "comment": "Malware payload (SnakeKeylogger)", "value": "76c5f2098f0914c2454eba2f421c8029e647ad1b5a6ddf1bcd20203d1e392dcc71104fffadcfb578603b159115b6ca75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208794, "uuid": "f48ab235-5998-497e-9262-14ad8dea5377", "value": "T1E3155F3C1BB826A7D165D63EABD18613F04096DB3411AA5764CA0F67B302AD2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208794, "uuid": "6727803a-1d78-42a3-960f-926ce2efe3b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208794, "uuid": "28140a8f-9675-4522-b4a1-24ea3e51f44e", "value": "12288:+z5Dc9F3nC0Py3gAh0EJbjJEKjbKoPnE33sNXwQ2149v64u0B7uZJTaVzlNfklbK:YbDtwQEESmWbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208794, "uuid": "c1603946-f467-4986-9b0a-bfe62969e990", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208794, "uuid": "76cb83f7-42c9-471a-8227-91a006572cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208794, "uuid": "9d7ca0f2-6c43-44bf-a7f3-035ef68c42af", "value": "PI - ORDER IS01AU17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fe094e-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629209010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209010, "uuid": "cc849558-bc26-4776-a2ee-32f308cb5751", "comment": "Malware payload (AveMariaRAT)", "value": "4627b8f82e1b0181e4e7a92a49fedeb6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209010, "uuid": "fc4dc5fa-7ac9-47df-ac3d-87f2556811f1", "comment": "Malware payload (AveMariaRAT)", "value": "ab2261ddf24d2524a3ffe99044fac988f6178be9bc78d28cd5db289c414c3a4f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209010, "uuid": "b4a6e487-8fc2-45fa-aba5-abafcddb3937", "comment": "Malware payload (AveMariaRAT)", "value": "37d14b0fc546c67f6c2eebe79db0a78d2b2c4b57", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209010, "uuid": "e1f7b46a-79c8-4921-b708-5bd1d285f0f8", "comment": "Malware payload (AveMariaRAT)", "value": "0dce3be78324aa4653becba4b6f5239fcb76cbeb61544569a68e9f9b759c4364eee04ae20591d91829a29e7eb877bf7c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209010, "uuid": "f7910d34-773b-4647-acac-cadcea1f9224", "value": "T18C549CD22585BC7DE5898CF19556C0BAC62DAF016DA33F432DFE7D6B7839011270AB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209010, "uuid": "1a499c31-86b3-43d2-a3c5-5c9c2109c0ce", "value": "7fde35894a769a57e681b5b66d3803c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209010, "uuid": "d9daf18f-6835-4556-924d-903c8655bdfd", "value": "6144:7jEdoJNarUnYAzqUhyey7J0PFx1GAqeLQKFju:7jUozarUnzum1qJ0PzwENj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209010, "uuid": "f7af018e-f99d-41d1-9e3b-06726763f503", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209010, "uuid": "c3bb88e7-a295-4221-a37a-2a4c999ed97d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209010, "uuid": "6a34bfd4-17d5-4b81-a74b-7bb03365b20c", "value": "PO Fwd PURCHASE REQUISITION 300321,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9ede03-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198980, "uuid": "f78faabd-b8b1-420a-96d4-2f678b52f3fb", "comment": "Malware payload (Gafgyt)", "value": "bd63b8ef1987ec34478f8eb2891d8a8a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198980, "uuid": "0d39f653-e111-41e2-99ff-9da7dde8f130", "comment": "Malware payload (Gafgyt)", "value": "abd369ae015650b40761d1e3c5479d968737bf86945fa594f87e332424f36256", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198980, "uuid": "acf20d1d-1679-4fa9-85a1-481819604cd7", "comment": "Malware payload (Gafgyt)", "value": "ce8ba9d75431d0e21cea9516a228fbdf2d78ab17", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198980, "uuid": "dd3ef2ac-c479-49a8-88e5-b3fd9277831c", "comment": "Malware payload (Gafgyt)", "value": "f6acfc9de9a94473af500ae08b01a02231e4aa6933f507c6abbcfe95cd0522427e926851527b58ffb7fb8935f95dccba", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198980, "uuid": "098d6a81-1285-4d22-90df-778af4998313", "value": "T1DF836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198980, "uuid": "65ab4a43-698c-4b23-a42d-10b6d9cdd37a", "value": "1536:UB7crF7FelF5tZuEqdPUq0aJb9sqx3CjrM3XguWIr8UmoIYuOVje+ZNne:URQFeD5O7dPr0oSwyjr4XguDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198980, "uuid": "0cc5a244-d2b8-493b-b2cd-a60abb327153", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198980, "uuid": "f8e017c9-abd0-4330-abf0-2630108eaada", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198980, "uuid": "b27c5b1c-b3fe-4699-8c4e-d62895b80e10", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7118b53e-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629206665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206665, "uuid": "2281b5fc-1f5b-4cd9-b46e-5fcfa4878885", "comment": "Malware payload", "value": "9f60434f6e949c6d0926172caa9911b4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206665, "uuid": "08265bf7-3c0d-40c7-9929-f2e27469a676", "comment": "Malware payload", "value": "abdad56eb6a3c7a3cf87f77ae1ce36cd44a7fd0f983c8d46635dbc0956cf15a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206665, "uuid": "5e6ea298-448b-404f-bd85-6bf9478b2eb6", "comment": "Malware payload", "value": "e53e223d12c36e699ca535029c2ba5b56240e5ba", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206665, "uuid": "143dfd8e-6891-4bf6-9395-a8dea2d00669", "comment": "Malware payload", "value": "d1513a655d085c6bd284a642fbd944f83b1c582bcc65b0c468298af01f0c34a62d8d960859efe31facfd253f2c00422a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206665, "uuid": "3a9e776f-5e63-428a-88c0-b5a24169e40c", "value": "T139910B6657395412EE1AC2B6CD31FE6212E3F2A5DAC70B90731EFDF10FAB321144254A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206665, "uuid": "bde1200f-ce4b-49c6-8ccf-88259dea54ad", "value": "96:+tM09wQLAyjhMAPm7+EbMdpalXcvRNF3G9HC/W/fxGN:EH91Af7+zaXcBw/UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206665, "uuid": "b975f8cd-440b-4cd5-8cea-8296e32a2671", "value": 4413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206665, "uuid": "94e59722-7d8b-4b1a-bce6-ba29a048018f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206665, "uuid": "b54ed7f7-e258-4b3b-b627-1ab6ccb1bb64", "value": "DOCUMENT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab3e216-ff6a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629211835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211835, "uuid": "5bee2309-b7bf-4fe6-b2ce-d3c19b89599e", "comment": "Malware payload (AveMariaRAT)", "value": "b2f472f87b1ba2e34ef04d011b98dc4e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211835, "uuid": "b1d4da59-9220-4797-887e-ef5a9e903145", "comment": "Malware payload (AveMariaRAT)", "value": "ac4495146b2c63e94ef3a5e5ce0f72e29ce5d05cb4e0a0d70cd7ecfa0641945a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211835, "uuid": "344ae7e5-0506-4e60-a771-e694aa3bd4e9", "comment": "Malware payload (AveMariaRAT)", "value": "1eba8af6b9d1d0750e21367df1b34295dba8f936", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211835, "uuid": "a4d53d9f-c1c5-49c9-8920-c06c865a7407", "comment": "Malware payload (AveMariaRAT)", "value": "38ff80b9ced275f486b47622ed7954312033d269fd7e215f52bf17b41df34d18fb78c3cfd111342c91f8b28249d6c053", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211835, "uuid": "d9b4f6e2-8a10-4f8c-b8d1-3ac297466c9a", "value": "T13D041220E116247E7CA0A32847FF0A29369075525CD85589E5F7C3DEF8A729217BC36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211835, "uuid": "a8b6f723-707b-4914-9bc9-eb3a2eba8c1c", "value": "3072:TKdeKUcLa6r96nya52ZGRhlvcdUngnEgdwD/tOs9vMffF3bs7eFEDIscYRs:Gvhr9ayQ2UhmeoJ6D/0sBMffdsaFEhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629211835, "uuid": "f32191e9-fe8b-4a75-b321-73164484ae9c", "value": 183527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629211835, "uuid": "4776d85c-8f46-4fc7-8950-f6489ae720d8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211835, "uuid": "fb66c63c-b5ca-4e1c-8209-f9a74f05a4b9", "value": "PO Fwd PURCHASE REQUISITION 300321,pdf.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a8735d-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209466, "uuid": "c87f35bc-d435-41fd-972c-4662fbe1832e", "comment": "Malware payload", "value": "d3772b773363b05f17254968b7b72e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209466, "uuid": "30c5d48b-f042-4fee-b358-66633fb7012c", "comment": "Malware payload", "value": "ac8476b4dbcca9870efa524f205a1d91c638fac3b98317575ae0b6120dbe2b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209466, "uuid": "de86a06b-d7bb-49d7-9eb7-a0f9d25e528e", "comment": "Malware payload", "value": "2901d7ac2c468c6e889678408a6a75c72d19dfc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209466, "uuid": "ac0b7efb-e7c6-4c7e-b98b-44294ee90a9a", "comment": "Malware payload", "value": "6c9d078a09d70a44a508f5e7a953005dda9b350cd74ad7fe2ebcf55d146f624f1d1f3c193acf3c096ae1357b13a484c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209466, "uuid": "0bccc738-0aae-4dc5-adef-b07e4bcec60f", "value": "T16B45FA381578393BE579C339DEE4480BF6E8B45BB311EA1674DA03670713A12B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209466, "uuid": "fab80769-03a1-4026-b036-3248d0b82611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209466, "uuid": "df3e52cd-db29-47ca-b2b6-0370a269c707", "value": "24576:VMCdMcGc2zQo/dDRFtml9hFnld1DrG7XIdmNRa:0/dDRFtwBlDrG7XIdmNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209466, "uuid": "491a767b-06e3-4604-824d-acf0b0dad6fa", "value": 1275904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209466, "uuid": "c2eac396-3746-4558-b25f-07bba5f09ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209466, "uuid": "b578e1a3-2d1d-4e20-8772-6e2f59c076ae", "value": "Saipem SpA - Model 231 (includes the Code of Ethics)_EN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6cfc95-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629230066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230066, "uuid": "816af1ac-912f-4d02-b92d-a06f98c2dda8", "comment": "Malware payload (Loki)", "value": "03d3c567bd1b0e6cc51fb98f438e607b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230066, "uuid": "8c49ab3a-9837-42ed-8edc-031ce9b66afd", "comment": "Malware payload (Loki)", "value": "acf60e0120d2d85b6944d413ccd3c642099b3fd82445d8bba51ee50c520abb33", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230066, "uuid": "60d2b9fe-cb7f-42f4-8492-c565419872c6", "comment": "Malware payload (Loki)", "value": "99501bd49e97265a8e714c63203a9912f7f2820c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230066, "uuid": "5cc9058d-dfdb-4e92-8fd0-191b8db0828a", "comment": "Malware payload (Loki)", "value": "e14bbd9375e247282dc1cf555aa264dd9a01522ef81ea53c200f6f22e69dcc1d4232ee8bf8a200054180de90a0ab72c3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230066, "uuid": "144789ea-42bc-422e-9884-e624b7d86215", "value": "T1A6155E3D1BB82667D065D63EABD18613F00096DB3411AA5764DA0FA7B302AD2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230066, "uuid": "b83318cd-ec63-4e31-9c61-47f2d7e070ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230066, "uuid": "9b422251-8f57-4cb7-bfca-8bb315b8d7c9", "value": "12288:M5oEJbjJEK0ppqbkUSD6tVqG+HBnWXUVeAgDXVx7olDgVfh2jJ4qPaDc9F3nC0P0:M4/7Urnq/nxVeAgDFxk5SZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230066, "uuid": "f46be262-fc12-4c24-bdf6-c7ad2c651891", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230066, "uuid": "821da8e8-4748-4924-aef5-104111afeb21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230066, "uuid": "95f1608a-5600-4c34-b1b5-16bb574432dc", "value": "PRODUCT REQUESTS.pdf____________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd34d240-fefc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629164756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164756, "uuid": "4c401cf7-4413-4cce-a558-6f4582c96254", "comment": "Malware payload (Dridex)", "value": "e1b369c95f454a0dda52c0229915cbfb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164756, "uuid": "38787bce-11b9-4e30-826b-5b3806ef9467", "comment": "Malware payload (Dridex)", "value": "ad0e4fbf49d942461e8c04bec7191fc8d029be1be224063c9195b9cb6c347542", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164756, "uuid": "fb310dbe-3c41-4f18-bcd6-70929456bbef", "comment": "Malware payload (Dridex)", "value": "7124213cbda52d345a85e9cf9875f113db0f5916", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164756, "uuid": "6a5985dc-adc0-48d8-bdcd-ac2e1971312b", "comment": "Malware payload (Dridex)", "value": "75692135be64090bd001dc63cea628698828e2729008c96f5c4b4febd3693d87468581e9548f57cde250207404b3f4c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164756, "uuid": "89ddff8a-661f-4860-a80c-436f4ec48319", "value": "T1844401182D03F86DFA4F7D798CDF21B06F8ADDAD5604286F26B4A65CDBE02D19C1448A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164756, "uuid": "eb3f3a44-fd84-4f1c-8231-7a807d7d6eb5", "value": "6144:S3tZbAPPimNA/kjoitkYwxMu5iBB7QOhmGpcjrq04t:StZbAPDNAcMowxMu8vf5pMq04t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164756, "uuid": "d9d426d3-4d92-4330-b680-91fd99b25b41", "value": 258144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164756, "uuid": "366a90c3-b154-4757-bb29-83a6ba35923f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164756, "uuid": "6326092b-9a77-4944-894f-f578cf716778", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_7_85898.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26697b32-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209117, "uuid": "b9127ed2-87e4-45e4-a95b-4b85961b0150", "comment": "Malware payload", "value": "7f3acf7755e6f0c0316eefa875c09fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209117, "uuid": "fb97c87a-e0d9-453a-a1d3-ab954ac417b7", "comment": "Malware payload", "value": "ad51f60b741a62983b7ae84dc29a93a44aa5eae750b145334d5faba698a3fe27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209117, "uuid": "026b062c-bc27-4dbe-87d5-52fe8ff2c55d", "comment": "Malware payload", "value": "aba5d3c5f8b05b35d4cb1ff5dc9cf874f778b98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209117, "uuid": "aed8bbfc-602f-4656-9ca3-cbd8864e1ee3", "comment": "Malware payload", "value": "8749d5baa60a3e06a8fae5b744fb380dd4db55a1c1acaac115f47d6bc723453b4413db09185115c598fe16b5421caf4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209117, "uuid": "6897ddfa-dbcd-454e-bd3e-1c00ad1cbefa", "value": "T1E855FA7825783A3BE17BC339DEE4481BF6D4B45B7211AA1670DA13670703A12B9D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209117, "uuid": "7fd0229f-18c6-428c-b336-fdd41107197a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209117, "uuid": "7a4f952c-8c1b-4fd1-beeb-cff147d8f186", "value": "24576:FuaYwicAcezvItHj/vJ/IERzGFnf6q7YE6XtzinfUiVKI/uiC3X23+YEjO:NtHj/vJ/PGBH77tL7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209117, "uuid": "da926917-dd5c-44d9-b07f-d35227d529e7", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209117, "uuid": "40d4aacb-4aaa-43a1-8f27-62629e564ef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209117, "uuid": "b09f660c-1cc8-4716-854f-27d2cf42f1ad", "value": "Project AVN-563 NOTES 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b75f62-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209461, "uuid": "dc3d3dd2-07df-42ae-b2dd-544f31f557a6", "comment": "Malware payload (Formbook)", "value": "3363472ebc791937443a1d82e5a1363f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209461, "uuid": "7310988f-855e-4619-9ae2-1bab67a89290", "comment": "Malware payload (Formbook)", "value": "adcb2a80c0d7861f7ef398ae5bb4e26d9e44c8d9eea4c5ab2bdf74e928d891f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209461, "uuid": "e373653b-4d4a-4d2a-8854-248ce29b8eca", "comment": "Malware payload (Formbook)", "value": "fbd2b1e7edf5f69701bf6cf2546500d5c527842c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209461, "uuid": "a835023e-86ea-4d06-8ea7-26a6837ff8ab", "comment": "Malware payload (Formbook)", "value": "74b8dd7bf890d75fd73c3886daece5ddd611ab79febe97e1ebb3dcf1089d6c507afbdf5927e207dbe0234876bd5ce726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209461, "uuid": "f610f698-4b53-433a-ba02-c10a9f3dd385", "value": "T1B81512427BACD212D2F6197650A9C5F047317E67A512CB0D8CC93EBF6DB2360EA4B217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209461, "uuid": "3f0acb5e-19ab-47c1-bc09-bb08f4ccba11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209461, "uuid": "9ae06670-0be4-4270-8b55-a259a445418c", "value": "12288:8nm0/Sa9wuZG9DznaXaFeZNXKQBzTZdVizi+IlA4o6gQ1OVbiHECDMbeJl5XCQhb:8nm4FwLaqHazT8zAS4X8aZDtJXnj6Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209461, "uuid": "ae65951b-acba-4903-a324-b8e7b6a84cd4", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209461, "uuid": "0865d2b5-5ef2-44b4-8d39-042cbe44cbc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209461, "uuid": "d9663e6e-7bd3-4e7f-bd4f-177228da23c2", "value": "especificaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14164833-ff6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629212522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212522, "uuid": "a3c50bee-1d92-4663-bd63-aff43ade6916", "comment": "Malware payload (Mirai)", "value": "8953f3b4561ba44988cce4d2a8b6b221", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212522, "uuid": "4fdae8bf-eede-4bb4-8110-c61836d1079d", "comment": "Malware payload (Mirai)", "value": "ae09d7a817d010c2c0d6f0cf540bb098c591112a8cc7641519c34e5976bc3187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212522, "uuid": "be3c69e8-e32a-4a7e-b14c-6b0878013184", "comment": "Malware payload (Mirai)", "value": "5f6e6ea17e33d3d26859ac4982d6de798838992d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212522, "uuid": "0a6d4483-001a-4e17-b354-c0522e597999", "comment": "Malware payload (Mirai)", "value": "456336adcc177432c575811271d858f3e1fa47500aea257eabd9d998459702dd4cff1754de96272cfcdb8d12abcd3918", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212522, "uuid": "0543c9f0-d964-4c13-be35-4ca3dd2d3a2d", "value": "T116B33A0798615F73C045ADB529AB5530072BBA120F4F1F9AB57DAAF4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212522, "uuid": "26518859-7de6-4fbd-bb98-4872417c6f3a", "value": "3072:moNToIWzKoFIon14C5hLwDecr68LkY0Px9gQNfR:TNUz2Ej4C5hLwDecrfLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212522, "uuid": "77957af1-e7fe-4884-8426-8b5503bd7e69", "value": 108419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212522, "uuid": "4b3183c5-a524-4ee2-8bfe-df7836d23c83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212522, "uuid": "76342e78-2751-4d64-ae6e-ff59838602b9", "value": "8953f3b4561ba44988cce4d2a8b6b221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c9ab45-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208738, "uuid": "29acba52-6def-45e3-8e31-6baa0d3433a1", "comment": "Malware payload", "value": "a17b2d30f67f68a13866a5e129c5593e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208738, "uuid": "5e446e26-1274-4a3f-a0fb-568bc0a42943", "comment": "Malware payload", "value": "af997bf4ea239f032d4a343c6a9022f3781eb833e13c5410b0cf45879b50d107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208738, "uuid": "3d118c9a-ebdf-47f2-9c20-fee6eea0aad9", "comment": "Malware payload", "value": "823c234754990abf902b66515f0295f3fe105cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208738, "uuid": "d702eb0e-d489-49f8-a6e5-27c0119e3172", "comment": "Malware payload", "value": "68686e73ae5c989095f1833c2ccebe63656a7b2ea99fb49f726585d2a027f1f35c10b4139539b46bfb4a2e111d48365a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208738, "uuid": "d12d2824-48a0-4f05-b90c-e7a86804493f", "value": "T16E550B3815783A3BE17AC73DDEE4481BF6D8B45F7211AA1670DA13670713A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208738, "uuid": "43624176-4385-48a3-91ff-d65800ca29e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208738, "uuid": "eb09477c-51a2-4b0f-9cde-b68adffd8e34", "value": "24576:7lGQwcDcXzP5p/mHD6FnXamUXAPZ6MZiWwUkFtzsezyft8mtJx:ip46BTUBoiLVsee8KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208738, "uuid": "c18d2dbb-3ba3-4871-88c1-b9adb03c79dd", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208738, "uuid": "8769ebe6-aa4d-47f7-9a84-88f7833decb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208738, "uuid": "69f7e8c0-bb0d-4877-8735-cf1f7bebff68", "value": "RFQ_17.08.21_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7121200f-ff2b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629184761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184761, "uuid": "e8e9a97b-51cd-4cf4-a1c8-09be5fe6fe22", "comment": "Malware payload (Loki)", "value": "ce63bff032c0e85e315037f42d4468d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184761, "uuid": "b80ec1fd-dc6d-4611-90d9-58562d25d4ff", "comment": "Malware payload (Loki)", "value": "af9ae89a82d33ddf6151753f94554301fc2719b446175865aa919eb64c2fabe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184761, "uuid": "394eab59-51e8-4823-ad99-43f98793bfbb", "comment": "Malware payload (Loki)", "value": "2aa4ef657624420ea01786f876bdbfd1336bdb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184761, "uuid": "920cbb66-ec5d-4812-ae19-342f561ff7d4", "comment": "Malware payload (Loki)", "value": "a602beb51ab0e4b3c8de6d7f97cc2d3ac272aababc6b9335f68b49ab01c998ffd220e5c744673f42301f4565db89609d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184761, "uuid": "4c1932c2-84a2-4d97-ba2a-45e49e19b450", "value": "T15945E73915B83B27E079E369E6E44417B3E4985FB225ED59BCCA03A70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184761, "uuid": "b06f435d-990b-4f9f-94b1-3eb7aa7d133f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184761, "uuid": "ff465efd-2908-433f-9f34-09cd7004fb81", "value": "24576:ZJuQRXFYTblhB2asdIjE1mfPK+nCVJbz:TDyf12ldI403KeCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184761, "uuid": "e5db0b51-d225-46d9-859d-9515138d7a97", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184761, "uuid": "5e10c5a8-1e75-457e-89d3-5d7104240400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184761, "uuid": "1995a882-2c2b-49c7-a0c1-dce950770d90", "value": "ce63bff032c0e85e315037f42d4468d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a6da70-feee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629158591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158591, "uuid": "8b89bf40-1bd1-42a9-b73d-09a2b2596056", "comment": "Malware payload (Dridex)", "value": "3987f1cf14310ca1c8c1d8e7c8c452bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158591, "uuid": "f0d6e4e3-8104-4a7f-a619-ef0ab2f07e54", "comment": "Malware payload (Dridex)", "value": "b10ab1bf64d9a7dde2080fc10e8f77a95c33a0252b5c4b02d13854a3e1dd0b59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158591, "uuid": "d0d3a14f-ead9-4746-9ab1-03f3a4008e4c", "comment": "Malware payload (Dridex)", "value": "e9a60f34067274eb9ccee2bc9f9fa11e9e747ec3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158591, "uuid": "2b012760-4afd-40b9-8a3e-39f5118c6734", "comment": "Malware payload (Dridex)", "value": "d24d23173a0c3bc9527fc71757cdc1ee6456c6c7f125324ad19283203c2268b74fd4f7e12d3aa15c18b7ca3317cb37c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158591, "uuid": "7d71b044-4210-4ede-8a06-18aab31aa892", "value": "T1C134123BDA048E07D19CEB7D6E2738A2138A57454B0DB0ED9DB12FB9BF04A751BD5208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158591, "uuid": "617dbf52-8824-4589-a113-47b7acb3cd46", "value": "6144:SogkLjLhWAFXqrPgoUStqibukyU5tnHmLghyxdeUsYvUShCh:bDLZq8PS8YuJUHHWghyx8UsYV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629158591, "uuid": "78da9b85-aa3f-4139-8bc5-81fd0b4f585a", "value": 244400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629158591, "uuid": "d51babc8-237a-4b29-9aa3-7160c478f00d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158591, "uuid": "446ced8a-6416-4880-a16f-a769e99dd139", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.5606503.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d017dece-ff3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629191792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191792, "uuid": "8f41bd16-5131-4046-8250-7124060aa842", "comment": "Malware payload", "value": "909803a265e197a39b0374da396c9bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191792, "uuid": "bf799bd4-54b6-4837-aadf-625255747db1", "comment": "Malware payload", "value": "b110d4435d9040763899b6a322a243adc74809781a66780f63d51ee5461f431b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191792, "uuid": "0047ab6e-ca6a-4c49-9ae4-0b417e565a4d", "comment": "Malware payload", "value": "b4bd131ff0357d323de67d6476c9b348fdeb51fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191792, "uuid": "af147a04-1a82-4a43-9f42-ecdf6550f1d3", "comment": "Malware payload", "value": "0fd056b7507a6441e6317651a7fc5439a0bd9c54451072c9240b7bbd3507d0712fb3e82aee7a74491df427f072c24d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191792, "uuid": "e242c819-03ea-4bbf-b2fc-b92968f18b2d", "value": "T1DD357B1F7E816E34D55609772F4285B859387DA0BC10681B37FAFE8F2A7B5E0B844A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191792, "uuid": "87c4a059-1b88-4958-bcce-04d2ed8aff7f", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191792, "uuid": "14748ef6-67ea-4650-92c0-71163c85a5e8", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0FQ:8ej+XQUeET06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191792, "uuid": "324e7a9b-1ce0-419f-8dec-bc3a89496b7c", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191792, "uuid": "51669a35-069e-474e-9016-8ab4150bd943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191792, "uuid": "c9d6f2a7-80ff-4ba3-bb8a-19a8e070d59e", "value": "SecuriteInfo.com.MachineLearning.Anomalous.96.16387.14295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae1852d-ff29-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629183945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183945, "uuid": "71352761-dabc-404d-adf2-a916096cfcef", "comment": "Malware payload (Smoke Loader)", "value": "7cf0cce669d871f64a441f4389149062", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183945, "uuid": "6aba9215-908f-411e-bc3f-964f9b27f784", "comment": "Malware payload (Smoke Loader)", "value": "b154a67642bc039bfb7f0f258c799b445e5b0b2ae155507e1cc9e2f376878749", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183945, "uuid": "1c259ad9-53e0-41b3-baba-7f0daea38818", "comment": "Malware payload (Smoke Loader)", "value": "78da86a287224385786b75ecb4e8ff382eb34f95", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629183945, "uuid": "453eff5a-9e3f-4688-8d0d-f416e78d2c15", "comment": "Malware payload (Smoke Loader)", "value": "6cc86ada24003d00a05f0d45786c73e976fa4734d5aa48cfbb290fda3bf6ddd06805408df696f46c5386a83a3f59ddb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183945, "uuid": "66d6d4c1-a13a-42db-87ea-eee08bc9fab0", "value": "T19214D0A13DA0DD72C696443480A2F7E05969BD71FA20454F27E8BB6F1F3C790562B38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183945, "uuid": "80553c8e-5489-492d-a1b3-2bf9e6a897c4", "value": "477c037bd85187d535326c948fa8e5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183945, "uuid": "ace272c0-6103-4e75-a11c-9da0ebae8438", "value": "3072:XAKkKR9aM9UOqjPxBN2qRgQuKT0yB3rugF:X+KnaOCPbli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629183945, "uuid": "e5f43570-597a-4fe1-88bd-8fca7c3f8b32", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629183945, "uuid": "7d081caa-9210-4485-b8dd-c4ff9ad90410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629183945, "uuid": "7444c58b-8b40-48b8-8c1d-5cfb1ac8248a", "value": "7cf0cce669d871f64a441f4389149062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ad5cea-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208666, "uuid": "2ace8999-9083-4548-b38f-c2fb4adb7ff9", "comment": "Malware payload", "value": "91916609a5370e5a7bb56a8b462f73dc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208666, "uuid": "a7d646d7-c02e-480e-8693-0d9e643b1ebc", "comment": "Malware payload", "value": "b172815fda73443d28b675ae58b1bf2562ea5f2947def1a278cc102cef497b1d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208666, "uuid": "04fbcd34-2a7c-46b1-a3a5-41ea7efd4630", "comment": "Malware payload", "value": "738a53e2c2dd4bc2c5cfd2c7075fd5aeeb63afd3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208666, "uuid": "ff4a145e-bdf6-4ab9-8a32-56c5cb279a38", "comment": "Malware payload", "value": "484cf1e3db6024031f191b77a3e3aa1a034d73889c8b4bd6bcef69d8e37bc31c5d882c35f17b5f3c9a0b60d28097c1aa", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208666, "uuid": "1f98cdbe-bb86-43eb-835a-b651bacc0784", "value": "T1C955FA3B15BC392BE179C339DEED581BF6D4BC5B72116A16B0D613670302A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208666, "uuid": "73d03372-4bba-4953-a91b-e9446af7f117", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208666, "uuid": "f0208a4c-3adf-43e4-95d7-b03f2aca204c", "value": "24576:SzLgpcScnzd3wMKar9YAFnrBVVgZjPXzLQco2opGt6wIH:ZapBlcTYZjPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208666, "uuid": "b63f5127-afee-4117-a044-a85c3c46c2e8", "value": 1370624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208666, "uuid": "86d62044-0212-4c2b-9b5c-8c3949d3eced", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208666, "uuid": "2ceed7b4-10e0-4ae3-956c-2deef0a10b84", "value": "DHL Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc910be-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629209424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209424, "uuid": "fff40e2a-c725-4784-9ca1-b459f6b9d010", "comment": "Malware payload (RemcosRAT)", "value": "bf8ac1ff88b18b3a4caa241b21ecdd9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209424, "uuid": "08798366-bc49-4af3-8b2a-2745b0b25d15", "comment": "Malware payload (RemcosRAT)", "value": "b1b0fa6f46557e5804b683bc76db76dd71246753726ce7645ab3804ec1d68a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209424, "uuid": "7d7d8c5d-371a-4e55-8475-64588022553f", "comment": "Malware payload (RemcosRAT)", "value": "03477c1d43cdb293d33e1df2622e494361fb634a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209424, "uuid": "f4b9b185-2432-4db4-84f9-0d1bfe56b7b2", "comment": "Malware payload (RemcosRAT)", "value": "91bed433750e275f53c6af41fed7d5195ef12deb0d953c04f84cfaa4f1e3a4fac02a3d4dda8616d91d7c759efe00c3b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209424, "uuid": "1cd8a0c3-a14d-40d6-a269-23c76ed92645", "value": "T159054880AE8188A9D4629FF261F180B7C72D6FFC1F2959AE3644FE764B340AC5711E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209424, "uuid": "1219725a-89ac-430c-9310-e81ec0c00c25", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209424, "uuid": "4672b27d-9bfc-478d-b2c7-cf42817f83b5", "value": "12288:wkYrg4vUltD8ayIEtaTpVByayc1H6nEs/nO3FrdC1frePL+FbL4x:wkAfUbFJyaHHb3FZCszof4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209424, "uuid": "bc722f9c-103f-4372-9b0a-3e9131a872b3", "value": 806222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209424, "uuid": "74afc431-29e2-45ef-93f2-ea1d5823a272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209424, "uuid": "1cb74f6c-61b5-47a2-beb8-650a1e45a476", "value": "MS710543PS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd54223f-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209853, "uuid": "2f9d5ad2-c441-4658-ae4a-b9ff15dbe08d", "comment": "Malware payload (AgentTesla)", "value": "24de92095889ef49c35dcc6f687627e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209853, "uuid": "8c23330a-7743-4547-80f0-2aa60b6c4ac3", "comment": "Malware payload (AgentTesla)", "value": "b316ea7741b691f6eef9d0d6e7b226d2bd05218f90bbcb5ebdec6e89b562734a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209853, "uuid": "71c749f2-b669-4e1f-9121-18e18c7f9801", "comment": "Malware payload (AgentTesla)", "value": "10c7d3cc655cb3ab0096e55fb40306950c058361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209853, "uuid": "704400cf-c934-4c98-b4e7-429268deb256", "comment": "Malware payload (AgentTesla)", "value": "fa19a06b05524ed6b090bef830257a2de5caa0e47e1b585db1aaf7b1aa0b9a9baed4463d1c5ce51825d12ed1b162b1df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209853, "uuid": "f0973cfb-2d54-4c0f-8bac-707b3e8f596b", "value": "T1E4F47B0232A4AB58E07E8B358168061457FABD07E732C35EEEE474D69E33E814B5B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209853, "uuid": "83530331-c108-4051-a6ea-497083c90e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209853, "uuid": "99edfcdb-0a0d-4ed3-b44c-b4e306a465fd", "value": "12288:TRl7kj9smihpsFUp0Gh/S71ZLj1F1EGWQV9yrq:2smUJuD71ZLxFioyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209853, "uuid": "0f7b62ab-009a-455f-ab16-048719631791", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209853, "uuid": "c28d310f-248f-4f9e-ad2c-a970d5c2fad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209853, "uuid": "de7f1f70-8e87-434f-b57e-47d14b071fa4", "value": "24de92095889ef49c35dcc6f687627e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516d3c03-ff24-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629181701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181701, "uuid": "fccdf99d-b155-400f-b71a-15e64efba6f2", "comment": "Malware payload (Loki)", "value": "a5082cf7d178e6ecdff4b46002ab3347", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181701, "uuid": "3d1d6fd7-5388-4474-95da-63c4c273a228", "comment": "Malware payload (Loki)", "value": "b372ba907ad4c120ac6ddd86e8de1821d19dffef023bd32c18359bcf82326842", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181701, "uuid": "31590f07-50b1-4c15-acda-2d4f011d72af", "comment": "Malware payload (Loki)", "value": "a1d07e85332e8f034b9fec98965127e593ddbdea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181701, "uuid": "1fe4cf1a-28fe-405b-aec6-f954cbc0cffe", "comment": "Malware payload (Loki)", "value": "df5ce6c34bf52bc788937a527bc3348dd4b68fb6821ee19b5b0adc0ccc2f29fc25594b00d5ec2a1ab5b76117b55cd669", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181701, "uuid": "ce6f5cdb-40f4-42d6-a70f-02637bb400f5", "value": "T186A4BF11B881D1B2C2935873964EF7FB5C29B6309D14CE97E3541EA5FF329B0A224B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181701, "uuid": "fa55b416-ddfe-4b22-9dcd-341f32fc9133", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181701, "uuid": "b27c2671-8806-4071-b52a-182e63220308", "value": "12288:VTTSysup4LojOUOPJOq550XlxLISP5Qch7K5m:VTTSysrsjOUuOq5qVLQyK5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629181701, "uuid": "c5ad321e-fbd7-4aeb-bee8-9d9998abf914", "value": 460689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629181701, "uuid": "df906ec0-a7e4-41cd-a397-8e4b619f0336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181701, "uuid": "8dbe7f5f-2eee-40f1-917c-3f72367622fb", "value": "a5082cf7d178e6ecdff4b46002ab3347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a918e7-ff37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629189731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189731, "uuid": "ba8c0eac-091a-485d-a47d-661ef358f644", "comment": "Malware payload (NanoCore)", "value": "ab9ddac98a347f6d27e4745e899b2434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189731, "uuid": "9eae1517-7583-4c0f-8604-bb4a6cdd260e", "comment": "Malware payload (NanoCore)", "value": "b37ea2664fdcc4aa40e9c6bb52f3331feb1cee716f84994c861d8ecabb557eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189731, "uuid": "dc2c555a-81e2-4d71-9718-5966a4096222", "comment": "Malware payload (NanoCore)", "value": "08b8d2abe43f22fb367465f6e66eebf12779fd72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189731, "uuid": "2f0e84a2-1bd8-4dfa-9fc8-94c8690048dd", "comment": "Malware payload (NanoCore)", "value": "dc8d4fff01eeca7153fa032421c7ccbe1040cca846296382e2c027061d27c75c0f9485ee7e381c5521cb282a05a2b6c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189731, "uuid": "d4e3e536-b2ba-4a66-9ecf-e63814c67a31", "value": "T1B6F46BAC3550B56FD13BCD36C4580E55F660A8A7E3CBC613E0832559983D3ABAE402BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189731, "uuid": "8de76011-7852-4164-ab95-0f8836faf6d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189731, "uuid": "2f69befe-63aa-4645-b85c-2cf18ba81db4", "value": "12288:UJfN8QcTk1YVFB3A0Q9fS/+ayh//Sd6UWeNeDH0DOje9Xd929mWBKRiMxkTbBsHb:iV8QVCf3VQ9fnNh//lUWeNeQqe9typo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629189731, "uuid": "57bc300f-8f37-4199-9420-bab7820e4945", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629189731, "uuid": "12c272ed-29dd-4fdc-8241-b4206d46b663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189731, "uuid": "8f5c486c-d87c-442a-957d-39adcfed3e3b", "value": "Order No.1536-R - PS0305052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b14c19d-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629209178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209178, "uuid": "b4d87676-c12c-4a1c-a292-eefff1f3c9ea", "comment": "Malware payload (Loki)", "value": "1ce28e5b9356ca86f7dc3baa7339a6f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209178, "uuid": "270e4442-6280-488a-8e3b-94aed2d8f8fd", "comment": "Malware payload (Loki)", "value": "b4918824e1c626c9b8c87be6f1aa34d1672a747e7d0f01d57c232284b62c3061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209178, "uuid": "64c4c6e2-30fd-46c0-80b4-c71a2e94c52e", "comment": "Malware payload (Loki)", "value": "54a522a22a9ba309f69d473a11e1977d31adde68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209178, "uuid": "a6b8b6d1-1178-4b25-8d29-099328212d70", "comment": "Malware payload (Loki)", "value": "504931b23ebd2e12da05bfcf5b691b3ace914c40e193af53da2df0cb91cf72507e25eba4bf93b1f43e8d092c9f639ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209178, "uuid": "909d6a52-58dc-439b-ba5d-4947c6a120ad", "value": "T1FE84CF02F6819037D873183A94F595716A3C6B701B5F5AFB178859BA8F786C0AE30F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209178, "uuid": "d6d98424-9647-426f-bccc-149121100f62", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209178, "uuid": "abc29e5e-c682-439c-81e6-957092d70732", "value": "6144:BlbMmD4FFe6Buxxt/bmRc/aGK3yg9vlOI5Lqykp/8E7pAnl5//5Qztw:BNQe6Buxxt/Ajyg/ZqKEKnr/mz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209178, "uuid": "c862f62e-1a1e-4ce6-b513-77d64ae4f4be", "value": 397983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209178, "uuid": "4a771371-476b-4cc6-a7fa-6dfa35dcc2ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209178, "uuid": "6537604a-a6f8-4aee-836c-f4dedb1ea847", "value": "izuu file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d64dfce-ff87-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629224161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224161, "uuid": "f60e6a6f-6e45-4e9f-acb1-8625099e8200", "comment": "Malware payload (CoinMiner)", "value": "1eba35a18196f40b9b03aaf80cf84c3f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224161, "uuid": "609805df-35c8-4a9f-b272-8ef504b217c0", "comment": "Malware payload (CoinMiner)", "value": "b5262fd818e3e2394d5454b331db7fbe1a4309f402291d0dae9d017334934642", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224161, "uuid": "7a210ad3-cc11-4b20-bc2a-06c11176b88b", "comment": "Malware payload (CoinMiner)", "value": "f6e924d94432b2f052216f649e879610d6d14506", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629224161, "uuid": "187a4b0a-a437-4ad4-8aa1-aaf01f33d281", "comment": "Malware payload (CoinMiner)", "value": "62e3a31584d5cea4247413eeecaa2468013ae1098f3b01b7897a1054da01b264b372c2dc166982f6e1fa7d1e32297069", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224161, "uuid": "07d674d6-23be-43de-858e-8e5c23b478de", "value": "T1A13512513B919739E06F23FC6B1EF4B4452A8CFB0703868723F43AC6BA76E95A518153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224161, "uuid": "66f964c9-7c17-4ace-a8ea-3ef48d00295d", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224161, "uuid": "35dc1c8c-cc63-4e41-98f4-44e61019b85e", "value": "24576:oSLX8Ow/weFSA9FbVvzGA172hDrZ7D6kask0:v6zD9FhbTN2BrZ7D6kask0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629224161, "uuid": "33435d7f-91c0-4098-83a2-a58c4f0da8c0", "value": 1144742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629224161, "uuid": "d7994391-6c42-4aa6-9fef-5f9ea5bcffae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629224161, "uuid": "ed409193-4666-4545-99bb-40044836d2fd", "value": "1EBA35A18196F40B9B03AAF80CF84C3F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383ce1e5-ff97-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629231051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231051, "uuid": "850777a5-b7f0-4449-976e-2dfc345aa7d6", "comment": "Malware payload", "value": "a7bc4d1bfc4e55e9e3361cef22cf6a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231051, "uuid": "b9820908-cc0d-4841-94c3-7df0785bd259", "comment": "Malware payload", "value": "b52cce24eb2a18751f630ab01d4b547816431451f17be9fc539022b0c58c92cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231051, "uuid": "bda4c534-c07f-4331-95f8-7e0cae1a48ed", "comment": "Malware payload", "value": "b6dd5a58787677375bbf91b6d8a4d79f06f21f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231051, "uuid": "b54ee79b-2f1f-4ac1-b69d-4b361be1845d", "comment": "Malware payload", "value": "221b174e315f3a5a786cca3e779d6116279663b0709b3733e587ad27728bd6d61f221cd288577245082b675fc13802da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231051, "uuid": "77983ab4-b170-41aa-a6ca-a12c6c37ffc7", "value": "T170C46C84A4031F77D8945A39BADF421D31A896BDA19F44E637D78ADD1CCA8C31FF0682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231051, "uuid": "f81fea3c-70e6-4282-935a-35410cb00c97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231051, "uuid": "c497e6e9-fbb7-41bb-a8da-f65f09ebd406", "value": "12288:vORP36Wz8CCeAUJmX0dHxPMGPpJmeq79/wm:vOR/pzZTxJmX2HxkGPCe89Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231051, "uuid": "5ec25bc5-b633-45d0-b54c-7eb14fc53796", "value": 549232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231051, "uuid": "1bcb4727-9855-492a-b500-df24a44c5020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231051, "uuid": "61dff330-68ec-45b8-8dee-6f5dbcba7b36", "value": "swift-copy-TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42dfc53-fef6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629162190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162190, "uuid": "f553e73f-f64b-476f-9e50-a8585c52a848", "comment": "Malware payload (Dridex)", "value": "636609af03ac6ea04bc0583fe3f3290c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162190, "uuid": "775511ff-1f79-41e5-b96a-e84b70ecf9d9", "comment": "Malware payload (Dridex)", "value": "b567ce0b1007245200e2ea1b54be3a0a04676a4e64b1910632ad60572235bd94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162190, "uuid": "fbe8b764-fba8-46e8-8e18-08e84daa2dec", "comment": "Malware payload (Dridex)", "value": "cd91757a4d1aa75d890421c9b006b944b9a01d9a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162190, "uuid": "520f2b66-fced-4958-bef2-c35390461705", "comment": "Malware payload (Dridex)", "value": "2b330d977100dd524c8d78f6411c40acbea56eb228b60e3775196bf7270468ce39a514de74f79292819e99e3db8c0e03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162190, "uuid": "924b9f12-7365-427d-836b-926be1cf1171", "value": "T1A3240127DB4D5E03C218D3BEAD062AB123D34E068309F4DA68B97DAD6B107711BF994D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162190, "uuid": "b50e0c46-ea94-4480-86b6-c7bd16fe7250", "value": "3072:+J/ogkBdPxNLhdheQjNRd4C3RRQDdFmErqHF7eXQWg+EGf3OGV40pTW:QogkLjLhdhrXd73RRQDdBqHuQWnhpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629162190, "uuid": "37676607-258f-48f7-ad8c-486456b87fd4", "value": 213366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629162190, "uuid": "bbc6e794-c0b3-43f0-bcf1-8702b45a8961", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162190, "uuid": "5ffd06e8-ea76-4b68-956a-bbfbd7223ae6", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.45418293.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa694863-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629209338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209338, "uuid": "53df0a99-b2c7-4d43-96db-a3693fd633a7", "comment": "Malware payload (NanoCore)", "value": "26c45a38003a1cb0ac28b1d8f796688d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209338, "uuid": "bddda298-542a-4b0b-b9b5-1b92de45d665", "comment": "Malware payload (NanoCore)", "value": "b7813f8e046e0b4fd5ca85d1b5c8cac8cf5a4d3e55bc7794c419253011a37e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209338, "uuid": "c99f71e1-c666-4b5d-a116-2ce29b471282", "comment": "Malware payload (NanoCore)", "value": "7f0e18edbbf65219698f01e7e16199922bf61af1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209338, "uuid": "6ee9d8db-344a-434c-a764-56731afac2cc", "comment": "Malware payload (NanoCore)", "value": "a67d59a22867b7db2a9c128b196415d421d725bcfb2c0ee29ad73de3eb4d6b5ec449271dfc714f221af68927dcc1d840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209338, "uuid": "a7a12512-2cff-4880-9b56-d9d8e447f9ff", "value": "T17B2581381BB82667D165D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209338, "uuid": "f51c29b6-99a0-40fb-a951-e8dece70e17b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209338, "uuid": "022ea747-86a9-40fd-8dcb-44cd4317d679", "value": "12288:E9u8gssbfDc9F3nC0Py3gAh1EJbjJEKeS7gEgIBGASkVDyqj7gALPOe01tgp8iDS:rcOIBG9I/ggOe01Gp1Au8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209338, "uuid": "7951b941-13ba-4d48-9911-15a046fe2a62", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209338, "uuid": "2437970b-1455-470d-b0b0-217c1a9a75e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209338, "uuid": "7347b066-2146-4393-aac4-2971f2c7bed3", "value": "Telex copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedbb548-ff17-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629176301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629176301, "uuid": "93871de2-cd30-4685-a29c-06a80381b949", "comment": "Malware payload", "value": "b34f8a1a83ae21238145b12edd3d6283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629176301, "uuid": "398e71eb-aa24-4f37-abcf-911b024cd59b", "comment": "Malware payload", "value": "b823b1842cd686874bf4c142d97c104dddc2b7670c54341437f5fffc3f3b4530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629176301, "uuid": "973eaccb-e913-46ab-a9e4-f7f340017022", "comment": "Malware payload", "value": "b3d8521b7a5a03f40cbcb7c96de41a629bc6827e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629176301, "uuid": "bfd0ed3b-f813-4182-97e8-eba29ccc02f9", "comment": "Malware payload", "value": "bcd90a042e8ffb500875da2a8e99e5a306c981e09732d6dc104c8a41eff033cef940e6ba7d98be319e2afa331746e1cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629176301, "uuid": "2942c67a-9959-4839-991c-370d5de1a545", "value": "T1EAE4E1507784DAF3C7B74A71F133A5F16FAAA8A039C1E36F511109F909093BAF22945B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629176301, "uuid": "49d45213-a497-4f87-a702-79703dbd60d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629176301, "uuid": "7dd5ccbb-47b1-492d-b410-911a76cc7a18", "value": "12288:XxTIYrzBOxA4wJbddXqRUTpzpgto0DxQG1zTVP/Gf8axW:BIgzBO1wbQmpzpgu0DqS20a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629176301, "uuid": "38d375d6-f4e1-4481-9e8b-b01482019400", "value": 692864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629176301, "uuid": "ea574a3c-1e1d-4c29-99bd-72850159d36c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629176301, "uuid": "c65e7b00-f1e5-4ae3-9d9a-8fda0ecee4be", "value": "cert.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663d7df9-fef9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629163268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163268, "uuid": "b557c5d3-d6e3-4b53-a9a4-3516d9e015e0", "comment": "Malware payload", "value": "bfa3677a1d68a0b2bec0f0cba4c34416", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163268, "uuid": "2c66124b-e1ef-462c-896b-0e915f6e13af", "comment": "Malware payload", "value": "b8ac779bad0064cb5e6371e1b1e745bbf9a7751f95d77729c2f461c5a2fc185e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163268, "uuid": "3d1d2e87-98eb-4c16-b6d4-e49871309e01", "comment": "Malware payload", "value": "f6e8569636e5bc595f17323d142e581db3d82b7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163268, "uuid": "78bc2de2-1d0a-4a6c-af80-0a2dce2fa4c5", "comment": "Malware payload", "value": "04f3dbc808c5ffd59f0d5b9e33d8566834940048a697d277127752ee454aa74601c32a60884e99924fba04a6fe51e4f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163268, "uuid": "b2706863-6e1c-4eca-b67f-017a0b398aa6", "value": "T1B3953337ABE0DCEBC6D5B031807E37430AF45758C1A06F29534AA56EF9D72604EAB607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163268, "uuid": "318bafe0-54e5-4580-a6ba-1344523107c6", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163268, "uuid": "d709f996-2979-4964-abb0-3d9cabf6ca05", "value": "49152:enzwtiBW+oUcWH9b7eD3cQFP2QlQoZ/6kRgJiRSwH:wztW0dZlQlQoZ/6UgJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629163268, "uuid": "792c8956-0d39-4438-beb8-4aabd50beea5", "value": 2043616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629163268, "uuid": "2acaaedd-8da3-4a3c-a70d-c9654e59a9c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163268, "uuid": "c2ea1486-fde5-4a3d-93a7-1783d4214ef6", "value": "bfa3677a1d68a0b2bec0f0cba4c34416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667fc8dd-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629190326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190326, "uuid": "72c55ef4-7a72-4c7e-b30d-90cf096928b6", "comment": "Malware payload (RemcosRAT)", "value": "8e199f584a4181060174f2be93d9aedd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190326, "uuid": "d050c3c8-4d74-4893-ba91-3b42e5e04a88", "comment": "Malware payload (RemcosRAT)", "value": "b8d34b3c639a5ac13c53961eb920ca3e25ca0b038552802984bb41a98a02c08f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190326, "uuid": "6d50d119-6d1a-4bb4-a987-4dbaa574126b", "comment": "Malware payload (RemcosRAT)", "value": "cbe76952530ae32250209e8b0532759bf06743bc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190326, "uuid": "5fec640d-3c30-4411-8473-85f66c4d2910", "comment": "Malware payload (RemcosRAT)", "value": "0fdace89448e0c0af7a7704e0b571e13620b4de5091f60652768ec964c3a5f5596f03bcc278003bf05b31e15c28813dc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190326, "uuid": "206ede23-3d7a-4df9-8f2a-2ad59488d33d", "value": "T14955227C3EE08776D0639A35763D60643C386D415E5588A81A9A3220ABF877DE74CCFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190326, "uuid": "7e730a7f-d046-43b2-b7bf-cbacd75ae33e", "value": "24576:CRCNxR7EPGgqVCiqC1OhSFraDkOZxXgML8lLd1fQqvpYKlCd93/k/2pBFUF:/7Evqh3ragOZtJLOdeq38d9M2SF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190326, "uuid": "ccf69618-b65b-45ae-a991-1484290625b4", "value": 1333160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190326, "uuid": "88af32b3-9d12-4614-a3b7-8d39c63ced14", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190326, "uuid": "1394c247-1890-49e6-96f2-facdf0136a3b", "value": "Bank Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b906e820-ff43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629195189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195189, "uuid": "ec1b8105-6cda-4b71-890b-780b106f8fa6", "comment": "Malware payload (AgentTesla)", "value": "c0fc593778f04e09b617854121aaca04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195189, "uuid": "b0266ca3-f887-4e63-97b9-ab3b0981e869", "comment": "Malware payload (AgentTesla)", "value": "b906d1113d99d978dc6cc0f949d546e06098b8eefbb917daa1bc923ea1109284", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195189, "uuid": "19782247-9f6b-4123-a1b5-5a5300917e8d", "comment": "Malware payload (AgentTesla)", "value": "5c44195f35b59888b878cc95cb9b9f6dbda8f8ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195189, "uuid": "40877635-81e4-4f0b-b296-c2a07e816e37", "comment": "Malware payload (AgentTesla)", "value": "de9aee4a25ff16e650f7a5fcb8901fe854d80001a64df0f881ca39ea6db6a9e332b24c8c5d225282d3b88335cab5c069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195189, "uuid": "8a386976-d369-400b-aa06-521026776fcd", "value": "T18F15603C1BB82667D165D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195189, "uuid": "a487989f-a990-4ac7-888e-a8c0edfdfedc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195189, "uuid": "8fb04bf5-53b8-48e8-939b-3ddba1519831", "value": "12288:uCDc9F3nC0Py3gAh+EJbjJEKrrnndgCzNdi2FKTTXqHX+izr5gTdCfw16jdgpp4:ZiCzNdivKVBu0fw16Rgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629195189, "uuid": "81ca91f2-ff75-4714-8016-32312f09558a", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629195189, "uuid": "b4444c47-7dfa-4725-8f05-10e73d3c18ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195189, "uuid": "43565709-1f58-418a-a782-71a21ccb7119", "value": "c0fc593778f04e09b617854121aaca04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a218668-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209257, "uuid": "2ad5da89-2431-45a2-b73c-f2b6fccd3fe3", "comment": "Malware payload (Formbook)", "value": "a9c17b30c3c8d1ab73368929ce6a9ccd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209257, "uuid": "f7d3e143-5be2-4b42-846b-dc1410af2df8", "comment": "Malware payload (Formbook)", "value": "b9c410e6c86baf7f355d2045a0fd5e3080f3a2ca9afbd319bd1c42485c22b9a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209257, "uuid": "e6f63004-c10c-4e76-9542-ae9bb7f657c6", "comment": "Malware payload (Formbook)", "value": "81cb26783bbebc09245bd38546724ffd4845a264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209257, "uuid": "62b7f7d1-e019-4522-b1d2-204b76d19cf4", "comment": "Malware payload (Formbook)", "value": "519e7e92a0071e3ab4ddfbd95579cd93bb843fe6f79f8a2a6a0786f4c716756ea16df72b8ecb3ecc8b545978c2ab695c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209257, "uuid": "d237efa5-535b-40ba-9b47-dfc150da2d45", "value": "T168458D0F6F928E33C8260A378F5AA8999419BE613D21724F63D9FF9F16378D1391540B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209257, "uuid": "ffaf145b-bf10-4dcd-8729-05f1b2773acc", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209257, "uuid": "62380e8b-7cf9-41c7-9342-912607d68043", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0F:8ej+XQUeET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209257, "uuid": "7b95d0ab-c77d-431e-bcf9-bf36706abcdb", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209257, "uuid": "103902fe-3d19-4077-8158-9ef637c29982", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209257, "uuid": "f51bc06f-fdf2-4469-a1cd-2edd058ce769", "value": "a9c17b30c3c8d1ab73368929ce6a9ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430e6c59-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629208735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208735, "uuid": "8a1d2990-e935-485d-aa4d-b4f8cab473d0", "comment": "Malware payload (Formbook)", "value": "5e72b2ec0435b706c338c3f9499229bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208735, "uuid": "a371f575-6a52-487c-88d6-768236d20bfd", "comment": "Malware payload (Formbook)", "value": "b9dec4dfefb21117d526b9cf6efdc6ff072db73e4a684f31d85b1b1ca811851e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208735, "uuid": "6b0b7cd2-794b-4827-9b62-82dc966de48c", "comment": "Malware payload (Formbook)", "value": "74dbf5f223ccbf74a75cdf8718f4430a31af3419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208735, "uuid": "dae290d2-06a9-437b-933b-1a6ae10a1acd", "comment": "Malware payload (Formbook)", "value": "9097d5660918d7b4ccff82100f5952de039975782dd59c3b98dd5db5dbb2ed12082f8299e794719d28a978d083107ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208735, "uuid": "0f7c290f-0fd5-4bfb-a5ce-4211ad68db1a", "value": "T19FA4BF11B981C076C26718B3555FA7FB9D247B305D26CD8BE3541EA1FF329B1A224B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208735, "uuid": "7c3363b8-1c18-42b3-9493-9947d77263c9", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208735, "uuid": "8affe45d-5222-4d46-9870-c552b04ef5be", "value": "12288:1PT0W4G5I7wjmMNZYqZzCzzsQfmITJbqNzpp:1PT0W4DkjmMwsyIQfB1gzpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208735, "uuid": "5e7c21d0-cbb1-4886-97e6-1a127e124ecb", "value": 461202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208735, "uuid": "c216771a-91e7-4747-b87b-50ff7f0fefd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208735, "uuid": "32070c31-d969-4fe6-826a-125d0a91685b", "value": "New order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8984e38-fef0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629159648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159648, "uuid": "15d6ea9e-f6d6-48df-87ac-9870ad3203b3", "comment": "Malware payload (Dridex)", "value": "91615a636477965189d10d4cfa1d5916", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159648, "uuid": "5873018a-d24e-4ba4-ba4a-e3a4b4200502", "comment": "Malware payload (Dridex)", "value": "ba6de3a75b3163fedc7fa5292f97558c53dbddb6b055363af7bb82a170367563", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159648, "uuid": "74def842-afee-4cd5-bd50-3901de65c689", "comment": "Malware payload (Dridex)", "value": "41c2f16c919d59ecc7d60b5d87ce599bc6aa1c99", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629159648, "uuid": "312f6298-9e22-4d17-bffe-a0d16804e832", "comment": "Malware payload (Dridex)", "value": "105ff3dbcb80dc02cbcc90e1c95e3b28e6c80e7dda2b22086766591e4c94a1ad1e967a2653b49b2f6030290a787b75f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159648, "uuid": "40e96a4b-7641-49e9-a2a7-f246bdbf9848", "value": "T1C5240113D6106D43C12DD3BEAF472EC0078E4A42921AF0D99A34ADAD2E4CEB747D765E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159648, "uuid": "75f9f14e-3a26-4bd5-b990-19496bf91065", "value": "6144:HogkLjLhbBK8b5kswzFTafiY6LhFNJfwcMzqYL0Y:IDLZIq5k5zlaaY8NJ0tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629159648, "uuid": "b106162a-a601-4e01-a99d-8474ba88b1d2", "value": 228311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629159648, "uuid": "690aab79-60de-494a-a438-f708e0bc1b6a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629159648, "uuid": "f088d0bc-f033-49e0-a4ed-7953646b0325", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.4616804438.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c42ed71-fefc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164647, "uuid": "b594a540-e0da-4b3d-b271-83f1d925891b", "comment": "Malware payload (Mirai)", "value": "a3051445fdd68611905b7d2a156f4242", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164647, "uuid": "ae3f71d5-801d-4fb3-8db8-794df57d3e5f", "comment": "Malware payload (Mirai)", "value": "bbd9bff584fe4e83488f67a8ed2ede4a420ba594c5db28c19d137c1ba78c173a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164647, "uuid": "cc30b643-0c1b-43e6-b094-5fefd98aa4e4", "comment": "Malware payload (Mirai)", "value": "5e1a8146291daf0fc816ce55a656f49b831027ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164647, "uuid": "4c6b33de-f848-4656-9209-0e5e87f87f90", "comment": "Malware payload (Mirai)", "value": "25501935521cff51aed949750b85c133d4e93ef23225566434f533718bad4f9dc8f09b700a58dd48b1327f0147830336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164647, "uuid": "8e6d6a98-e10c-4f23-aeac-8343f33a6ad5", "value": "T13B430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164647, "uuid": "8249cb42-e0bc-49ba-aeb4-7343caa0ffd4", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsQBXuL27PthFBw:FH09gQ3jJBg27FhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164647, "uuid": "d2a5e338-b9b0-440a-b02d-d9f0eda1ddfc", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164647, "uuid": "bfaf7d93-d75f-4318-be2d-c3f6bc615a55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164647, "uuid": "d732a985-08aa-4efe-996c-35822b9ffe7c", "value": "a3051445fdd68611905b7d2a156f4242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea77ff62-ff62-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208587, "uuid": "876ec2f6-aa45-4ee0-93b0-c6066d8956ec", "comment": "Malware payload", "value": "ea2cd4f297bc4f48c4de44defac93583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208587, "uuid": "de996d36-3fe9-4c0d-82c1-8dde8d3a178a", "comment": "Malware payload", "value": "bc784155abae0b5ea25e7492b53dcf546311f5beb854b9eb71c22832b5ed2c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208587, "uuid": "d256e99e-5181-4c85-9501-80149b25c5a4", "comment": "Malware payload", "value": "b7ee10b5b64d1f7d0036d717c7d91ad036fb413a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208587, "uuid": "f53c08a5-b67f-41b8-a304-5ee74e99cb73", "comment": "Malware payload", "value": "e89cb7a3eaf6f20a835f907460ed5f9737bfa56fca5de6e1f44ccc1b54744fbe45f4bee1bb69ebbde3bba3b9cc2820cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208587, "uuid": "f3d78aba-1d7c-4308-88f5-a7424eb186e4", "value": "T1EF55E93815B4393BE17AC339DEE4581BF6E4B55BB211AA1670DE13671342A02F8D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208587, "uuid": "8b254c8b-4736-4b21-8dcb-4d7bc00551bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208587, "uuid": "2f0858a8-3c1f-45ea-a9a3-3dc3f1e969e1", "value": "24576:dGmgxc6c3zz111MLnBFnhPWPztQKfjsjo3Fh28/5GbsIA:nEBBJW7tQKrsjo3Fh27bsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208587, "uuid": "1455082d-fe26-4dfc-a8e5-8ae76d2f20fa", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208587, "uuid": "ad741c0a-7f39-42bd-84a1-f460a5f12917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208587, "uuid": "9066fe7f-cf77-4e3e-98eb-077500cece7f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3575adf3-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208712, "uuid": "5f2bf21a-10ab-4175-96cc-11b1428c724f", "comment": "Malware payload", "value": "ab0475a401800c62225db10e18fd2cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208712, "uuid": "ae5e350b-07ed-4571-ad42-0efbe231a3d1", "comment": "Malware payload", "value": "bce7b7f9acb243c88b4413ba7d4dbf8d711d3ab6cd33ebd9f10f5b5e4fd87dee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208712, "uuid": "ec65456d-3ff4-40f3-969a-001ff8c3bae5", "comment": "Malware payload", "value": "bae48459304f18e0a56e16b70a39c71285d5da98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208712, "uuid": "4c01d005-1698-4c40-af61-0b6836ec9db9", "comment": "Malware payload", "value": "9cdb5623d80a76a124d8d23a7618a9e33dc2117c8c656f569959431128850bbe9c6a76a270b837c67ae3c20feaf3bb5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208712, "uuid": "e8782c07-7931-4ec6-b26a-36248a34d293", "value": "T18B55003C15F83A2BD0AAC319FBE5881BA554A49F3124BAA6A0DD03B30307B5775C767D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208712, "uuid": "586419e4-9127-4b49-a232-e88ec7e49eb9", "value": "12288:Uuy4HK+oNucccOzCM/hhZ/ilUYb8JP6Fnv:u4q+oNucccOzCM/j6Fnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208712, "uuid": "1301bbc4-6465-4ee3-8771-8b3cf73730b3", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208712, "uuid": "4fa99884-f3df-49a8-8406-0e4749773c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208712, "uuid": "6d7fd9a4-521a-4a6b-bdad-5d04ce33f294", "value": "ShippingbDocuments_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff63f9f2-ff6d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213346, "uuid": "4b4368b5-fe64-4855-86de-7abbe983bf8c", "comment": "Malware payload (Mirai)", "value": "56b703b3e17cfbf35d693851de266099", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213346, "uuid": "cd0c122c-3ce6-45e3-947c-e4e2e371b28f", "comment": "Malware payload (Mirai)", "value": "bdf959a084509b6f42ea0cb657b4c25cbdc0e69de1f0c61de8c6b9d1d0f95271", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213346, "uuid": "bc104408-2c80-4b90-855f-dc3addaa1e83", "comment": "Malware payload (Mirai)", "value": "02b6d4432c880e4ade7b58269e24cec3b3f8d136", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213346, "uuid": "176e4be4-0383-44fb-9f67-ed378ff91ca7", "comment": "Malware payload (Mirai)", "value": "c820d3fe740a872213d6540a6ae0fbe6194358d7d6dcfe058b255940b6f1c50782fe1aba5fbdc6ee0efcd3f32eafcbc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213346, "uuid": "ef4565ba-204a-4243-88e3-abb3bf27ca43", "value": "T1CBB33A57671C0B43C58B5AF52C7737F187ADEA7112E221C5E40EBF801B72A701A26FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213346, "uuid": "18eb8165-8921-4e96-91f5-25bda81afb3f", "value": "3072:FHXfEEPOH0UHNzONBbsQr5h7z7ku62QnI0PDG4gQNcR:F3LRUHNzOwQr5h7zQ2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213346, "uuid": "1e258dcc-7c15-484d-b403-948be36f0f29", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213346, "uuid": "84620232-3acc-4ed6-8e85-4051963f1c3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213346, "uuid": "d68be729-d7fc-4988-8b02-d83a01f58b83", "value": "56b703b3e17cfbf35d693851de266099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c63631-ff7b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629219068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219068, "uuid": "d4dc194b-9ef4-4904-a0fd-62f7daf44afc", "comment": "Malware payload (njrat)", "value": "23d9044046f74cdad2d7a3e192fed7f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219068, "uuid": "d71102a2-701c-44f9-ae9a-4838998f162f", "comment": "Malware payload (njrat)", "value": "bedceb6fcbd83a80d95fb370f0655fc65ff2a476a97f48e8c646555e01505e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219068, "uuid": "0afc5151-8012-4e8b-b3e5-a0fdb99cfde8", "comment": "Malware payload (njrat)", "value": "a5f23c4bc98e66d5256a961a1673f844bc7077c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219068, "uuid": "8d9a4ae0-be3b-4dd0-b495-c7d29354fb3e", "comment": "Malware payload (njrat)", "value": "c1d87e00c8df4d5c1de5ab30a06cb3a49b50095e5cd73e6f4dc2ed5ca56e3e93212d9eafde28335fe86fc20c48def86c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219068, "uuid": "8b689875-8f3c-43dc-b024-7ba3c45ca7db", "value": "T17B84383915F89727E17BD2748458030AE3F1ADD2FCC8D927F8D3648699726E2298472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219068, "uuid": "2bf71acc-4b8c-4659-b022-d264cd856f9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219068, "uuid": "45f50cb7-e143-467b-a43f-803b98186b32", "value": "6144:hzQJjUdA5BgHu0A01eqKTdVqsedaMAHzutx9vJF7NPPrgEBsY6TbwKat:hI1gHF1efXq7daMAuvzZlsYOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629219068, "uuid": "46df8e3f-21ee-4d53-93a6-d951992ae21b", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629219068, "uuid": "36230825-5301-4e34-b612-684a1e3b3506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219068, "uuid": "20b37f86-3b58-4c2f-baca-ab3186557269", "value": "536789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a6d21-ff23-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629181261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181261, "uuid": "27cc2ba1-70d3-48e0-bb60-22fc9d375226", "comment": "Malware payload", "value": "170fbf601ce47d8fc4c044bc4e1015e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181261, "uuid": "7e1c3709-9d03-4653-b9ca-bd70a7a4a922", "comment": "Malware payload", "value": "bf4479c28b6db66bcdec380291965deba2a6119a1e61f7a2ff9f3ed43e0f8bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181261, "uuid": "fe5193c3-e99c-43b8-b744-ca8e346d730b", "comment": "Malware payload", "value": "24195ee758cf913769e020b8ae5fb962df2adbff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181261, "uuid": "708bf146-c88b-413b-a64a-b1402d682ac1", "comment": "Malware payload", "value": "3f86eab444c1c7ea0c82bd8edcef1e79763bcd1e6c271c9f63d3fe65777fcb774646b9f869961fb44f70e3e4b56ed284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181261, "uuid": "9fee5827-6c05-4175-9c51-acf0cdb71857", "value": "T1E455DA3817F8393BE179C339DEE5881BE6D4B45B72116A1670D613670A83702B9932BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181261, "uuid": "ae0428c4-c9b6-488a-b329-5f37449c3e9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181261, "uuid": "ec6c9b6d-b52b-46b2-bc35-a6195702189d", "value": "24576:mz5aoVcOcWz7jnpJVEPFFng10qdK1zbBtWn9UQ91ILZP9y:UuBVqdK1zbCuyAZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629181261, "uuid": "8686cc33-bb92-4b07-bcf6-c3dc127b10ab", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629181261, "uuid": "71461d3a-ca24-4474-9933-b1620184557a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181261, "uuid": "4c6c3767-7f70-4452-a0bb-a44d2990998b", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264c850a-ff6a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629211693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211693, "uuid": "08b384b0-d744-47f9-8b80-cb9d3a3619eb", "comment": "Malware payload", "value": "74849cd83ed05fb7b764c77068a1c4b8", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211693, "uuid": "2c5d7a94-5182-4acd-92ea-91f360f002fd", "comment": "Malware payload", "value": "bf568d4a3e94de557a52566f70a891edd3d2fd096466b6434111303aae92cffe", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211693, "uuid": "ab780acc-03cd-44b8-8823-e3e660213a41", "comment": "Malware payload", "value": "a6063e84706df4bc5824481e2549b7ef38437554", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629211693, "uuid": "66a0f423-cb55-46b9-a369-dfdec8ef46e4", "comment": "Malware payload", "value": "685aea4d78add1ea44b6606d89dcd7c8195d13c3201ce362e2979b7ae4aac68c6b204aec6b87538c5ed28a9acfe8c810", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211693, "uuid": "eadee02b-6d5d-4cc3-9e40-80da656aec54", "value": "T18F05332E650EC5EDE788161252AB20717E49F1C6033914F75276E231BEEDBC3CE58A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211693, "uuid": "d61d22f0-9b8c-46b3-bc72-a1e6628cb81c", "value": "24576:bluUHQQI86I++qXy1Dth3g9nc0j1Ql5PBp9:BuUwQIRIbqXy1DtaCS+5Zp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629211693, "uuid": "a5fa4527-526b-4a3b-b868-6aa835f098b7", "value": 810405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629211693, "uuid": "58650d94-284b-448c-bc30-1a2b82ed1f21", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629211693, "uuid": "a9e34832-839f-47d2-a771-c49231598f8c", "value": "Bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23b8762-ff57-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629203741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203741, "uuid": "10a8239b-8c19-4917-925a-0526a944a122", "comment": "Malware payload (Gozi)", "value": "4bd3b41d373e85a5478838040fc56f50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203741, "uuid": "47996e65-e3b9-44ee-836c-a0570bd56deb", "comment": "Malware payload (Gozi)", "value": "c0d7e8fdc01774859e64b3bf827cefa7800391db0b8fe52028ea738182f18ad4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203741, "uuid": "52423466-4960-4c36-80e0-82e349adeb4e", "comment": "Malware payload (Gozi)", "value": "d11b606daf2f2909320afc672797372683c1362e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203741, "uuid": "b0639abd-eaca-4ad1-b9d8-97eb3c3c4fe4", "comment": "Malware payload (Gozi)", "value": "8d6cb44486391931b0fe4e870879c1bc0304c4f6d072f64a1a75144949aebf76c4721ce27dd19a899a16740560ab1800", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203741, "uuid": "2662016a-8884-4a2d-95cc-899bc62c6eef", "value": "T174437F8171E008F1D6935A3125A5A7F7FAFD47306174E041D3630AD6AA928A3EE7D70B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203741, "uuid": "f4407bd3-b37c-476b-8d86-5e9ccdc846be", "value": "1536:81EAiXqlalXCloEQc1g6m6W6xVKV4OQrnP:81EAiXqlalGoEnqCPs4OQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629203741, "uuid": "cffe3a3d-0028-45e3-a7a7-c6609717f80f", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629203741, "uuid": "1a797415-c024-4b86-bac5-3baa78e1d907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203741, "uuid": "26c30d07-f444-4eba-a503-038e2c6085df", "value": "1170000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69380244-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208799, "uuid": "59363496-b072-4456-9b84-f50d461fa76f", "comment": "Malware payload (AgentTesla)", "value": "768bd0288d564b29adca8e76edf2ef06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208799, "uuid": "e11a2b7f-70f8-42f1-8fb9-3de9a000baf0", "comment": "Malware payload (AgentTesla)", "value": "c1c3e5108c23c1b63bb15327561a944a21fb591dd6424011023719683ee0c9a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208799, "uuid": "ab1fa6fa-0935-41a1-85f9-4b5045f856e7", "comment": "Malware payload (AgentTesla)", "value": "740ec864dda80ea1854c01de963e2f692fa887e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208799, "uuid": "99dc3589-8a43-4945-8dc0-31dffa4d4cec", "comment": "Malware payload (AgentTesla)", "value": "3c5f5e59da1d9af2f51fadac4b1911fd008be6639199c1f98988aaf095e3a4a06280bfb51fa577ab8903f61705cf672d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208799, "uuid": "7db422a8-31aa-477c-894f-f68588932653", "value": "T1B9256F381BB926A7D165D63EABD18617F04086DF3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208799, "uuid": "9a0f9dd3-e6c1-4399-8154-b11deaaeeed6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208799, "uuid": "b4bee5c6-3920-482b-b7f1-b5e745046ecb", "value": "12288:SwDc9F3nC0Py3gAhqEJbjJEKzqyEh/e+iNCHBqQ9GtTluMqzcjpUXFdT:f8d7mCHBFG5luMq+mV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208799, "uuid": "f355f5b8-5ca1-4ada-aa27-1773954bf761", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208799, "uuid": "17fa0e8f-726c-4b69-a1c4-c4f38aa406bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208799, "uuid": "0e4c9315-d243-4479-842d-e247d898c723", "value": "Our New Order AUG 17 2021 at 2.90_PVV440_TXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a1a170-feef-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629158804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158804, "uuid": "842f1a19-4f48-474e-85d6-1718d1198173", "comment": "Malware payload (Dridex)", "value": "5468eb349612f65779422e8afac8b0ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158804, "uuid": "2b3d6c3b-72d1-4469-9942-b42c67b3dd19", "comment": "Malware payload (Dridex)", "value": "c21028d0d3817f164666f6a5503a8eb17a66a22ca28af05cf2cb2f577cccb962", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158804, "uuid": "085d3469-6433-4184-8421-0fb9483d7489", "comment": "Malware payload (Dridex)", "value": "27e72c0a701d7a5995b11c9a57457834028a1169", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629158804, "uuid": "44d99a70-54e9-4108-a0b7-5ddca52b05f6", "comment": "Malware payload (Dridex)", "value": "c8e1684a8f1b1eee02ffd91c016a36f24ea575ac71b2d04bf13266ebd3beccb0ffc2af652124ee4b3c861b884af91277", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158804, "uuid": "1575ed1a-ebaf-445a-bdff-8f4e89a5d206", "value": "T17E44122BDAB92463DA4CE3BD7D4228B453894612D700F4CC19F23F6D3A099B616DA19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158804, "uuid": "e2924383-d46f-43bd-9658-ec595daefa2a", "value": "6144:jogkLjLh6ysFo2iWEWNh8VKxtIu4MqNiTlEq4JZkS:8DLZ+iW/NVtyMqa+qUZkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629158804, "uuid": "4c4b3508-81cf-4111-9dbb-e844a78eb96b", "value": 276982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629158804, "uuid": "d174b3ed-206e-4d6b-a183-45cab85f54ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629158804, "uuid": "e61ea8ab-ba9b-4a32-acd7-bd876356a759", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.252567112.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de78c3f-fef8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629162824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162824, "uuid": "ae4096ea-cde2-4075-8cda-1ce6d0edd30c", "comment": "Malware payload (Dridex)", "value": "84ba9cb123adb7fbacc0f751563fde14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162824, "uuid": "307fa4e8-a55e-4d5f-8463-9b0d9960c75e", "comment": "Malware payload (Dridex)", "value": "c25535f9584705c07dd2e20295fa38ee9513ba4fb8768d2c44faf1e1ace294ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162824, "uuid": "29201efa-52be-4ef4-9966-ab81e2f0ec6f", "comment": "Malware payload (Dridex)", "value": "6a138f5a76ebce3ecb286f3fe24411e3bd8b6c80", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162824, "uuid": "faee766c-560d-45c7-943a-6a8dbaf6dfb0", "comment": "Malware payload (Dridex)", "value": "f8cc61003e90a8df11c96284d990840cd9ba6f75073224b3d6d1248d2dd8d738fd0a3f9a9abf810d110a8515939806cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162824, "uuid": "b254e3ee-baa6-43c9-98e5-fb188e9d0494", "value": "T17A340217ED9429C3E29CE3BE7F0669B01306170DC32A779C24622F291B286355FD9D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162824, "uuid": "0576dada-28d2-4159-abf2-398b36c137a7", "value": "6144:EogkLjLh/1f94Qj98puZFGDMju4mBO5RdwdySMC:hDLZ/N94QjSuZFna4mBO5Rdw7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629162824, "uuid": "e03a27f7-b2b8-4b7b-bb58-60c93121024b", "value": 238123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629162824, "uuid": "7629daf7-f187-4b41-a791-b84b9e5237c8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162824, "uuid": "558b4083-6c6b-4d1d-ade6-b0bb5f4fbe63", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.509817.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6450216f-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1629209220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209220, "uuid": "4aa89ffe-6461-4285-9bbf-5f3f549f49d2", "comment": "Malware payload (NetWire)", "value": "4386582291d6000aa1a7c6ab7797498c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209220, "uuid": "4dba704b-5bb2-4ae1-ab92-38ab2b7b1ded", "comment": "Malware payload (NetWire)", "value": "c35053330958597ab2a432c5fe70afe5e1a4d675eb2a4b94dcec7c972fc0a62e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209220, "uuid": "64072810-6f1e-4cc9-854f-e13162cd0a7d", "comment": "Malware payload (NetWire)", "value": "6cdad0ab0910b288f49404f523a740b50bcb04d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209220, "uuid": "019606d0-6ba4-4434-9c1a-e91ebfc26f50", "comment": "Malware payload (NetWire)", "value": "1923264709f04aed2748cb70d996e879cac47ffc5980aa484d8bcd24afd9b81638bacc22722d70154cd0c29e5f15550b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209220, "uuid": "c76b8561-585a-4e1c-9239-000d23963474", "value": "T1E6D4CF017981D476C6630972814FE3BB5928BE305D118D9BF3A43EE6FF72A61B224B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209220, "uuid": "90aede02-d68b-4fa7-ad3a-6349f986031a", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209220, "uuid": "e8481034-98a6-46d3-9b5c-8508f0661d90", "value": "12288:szT6Cpe5I7wjmB6tpC5mdJ0W6GPAoEJhR8v0SQG/VdTgEf:szT6CpLkjmBqCYdCMPArhR8vbQ6dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209220, "uuid": "2913e3d1-54e1-43e2-8427-e0d9f6a75a3f", "value": 617729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209220, "uuid": "57674797-32ea-49aa-a972-d0006cae7dfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209220, "uuid": "3e1b35c9-5a78-41fb-8d0f-5a6d37a6c90e", "value": "Transaction Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55de12b-ff97-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629231288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231288, "uuid": "e3618fbb-e564-4932-9f8a-da80f4a8e256", "comment": "Malware payload", "value": "129bec6ae7932fe529c7f25ac23d6c81", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231288, "uuid": "3ae76233-cf66-48ec-9200-69e2e4398c0a", "comment": "Malware payload", "value": "c3b759035585dd4ebd6e6a084ca997f5f8751be6f0354e7dc59f3f74162aa445", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231288, "uuid": "b14f7c97-066e-4c0b-b0e9-18f27e67e79d", "comment": "Malware payload", "value": "e43a8e02bd6de90f1a21bd70237b66f3caac3581", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629231288, "uuid": "e9bb2206-69c0-4ef7-858c-bf41a1bbce51", "comment": "Malware payload", "value": "b25edc6a7a7317971dcbf0617fb325ed06fa68df5ec2fc3fc900269bdf2b7025c54186a4ad5be9210b2c89c00ca90cf6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231288, "uuid": "ff4d51ee-2271-4aa9-9be5-0dcfaac88cd9", "value": "T1154331ADB9058AC6591AB1C3589E709EC7B0CDB64834E5A0BB30D9CF2B1077766C439F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231288, "uuid": "5d694601-4e2c-4c5f-a155-833b54fdca90", "value": "768:k8ykH8yq3A83ZDRq75+MfIzYqGb3TK7wXHgLDMoCXXA:u3A83ZDg7k+VqGje7K4DQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629231288, "uuid": "ba940cd4-db31-4b7c-9dc3-c313e0a82bb6", "value": 56099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629231288, "uuid": "23332f1b-771d-40e2-ba0a-5e3d36078e3d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629231288, "uuid": "eb2d62e9-baa5-4b71-8351-1c3b90521b96", "value": "Factura__Electr\u00f3nica__Pdf__2021__EMHYJNIYRIPFVHFVTJSIWOHNTQKNKBFFLC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce254a41-fef8-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629163012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163012, "uuid": "8144b9fe-f247-43be-9f5f-cf764d00167a", "comment": "Malware payload", "value": "445dfcd1f7f35099093f7320d467c76d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163012, "uuid": "82436e9f-3123-4be0-9f98-4d04c22f8d78", "comment": "Malware payload", "value": "c4238705bebeb7b5a347ddb5d858a2f9748166cf633b949619dbd69802839db0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163012, "uuid": "5b80557b-d48d-442a-9161-eac158b4ce63", "comment": "Malware payload", "value": "256dc893d48626c0771cff96c4820796ecf0da87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629163012, "uuid": "c182a6d8-5116-4592-994a-ca067ea8c166", "comment": "Malware payload", "value": "7219cfebbab5a2eae9cc67155b4eea7c9015caee999ef006f932ead80b4260492eea47aa9279f5a4badeaaa5b29f73f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163012, "uuid": "753d84f3-7c21-47a4-9a43-deb34e084093", "value": "T1A5936C10B5C2C432E572193558B1CAB15A2DFA714F269EEB379C07AE0F740D09A36EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163012, "uuid": "23c10bf4-71f6-4dd5-8c9d-484f006f762c", "value": "c7d3661f79d58d30854a3af50a6f4c2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163012, "uuid": "41fe8a56-9d53-46aa-8351-4b3f0a47fcd6", "value": "1536:8WvNrof2xIZ2ToPCt6VkPRYLUbrjhd3d7t20WYwuIJLO+s8jcdi1vzGHY:8WufhgTeCt0uREWrdhdY0W5uIVO7AvKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629163012, "uuid": "1ce013aa-ceb4-4f29-a048-85f8093f709d", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629163012, "uuid": "90489d07-2e67-462d-804a-7ba40edfd4e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629163012, "uuid": "5ca03b58-f6d0-41e9-9126-27f9bd87addd", "value": "445dfcd1f7f35099093f7320d467c76d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efee131-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209158, "uuid": "8185891a-d924-48bb-94c6-148266cc6814", "comment": "Malware payload (AgentTesla)", "value": "358b0ccc42f019cd2f11061773cecea9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209158, "uuid": "7640f6e7-29cc-48fd-b3c5-658b04a0f9ce", "comment": "Malware payload (AgentTesla)", "value": "c42a6cf17c9b683887f061b410a0f0ad7e9644f05560c5148fbc9cb608de31a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209158, "uuid": "4b983ccf-373f-48aa-858a-14812f1837d9", "comment": "Malware payload (AgentTesla)", "value": "6cca82e15b63c07308ebd5850f877bb3780f84dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209158, "uuid": "f5378cf1-d04b-40eb-b266-fcf3658dff0a", "comment": "Malware payload (AgentTesla)", "value": "0f9d97e78b5ed3c20e6ef073616aca795c164aea8b8dd91e4b93b817adf982f0ed5d8d68b8bfbb4f1905301e72d2326e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209158, "uuid": "214190b5-d0e6-4177-a34b-f1247992e46a", "value": "T1EC25603D1BB825A7D065D23EABD18617F04096DB3411AA5764CA0FA7B306AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209158, "uuid": "0e15522e-c278-4353-b868-9d8c45936b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209158, "uuid": "339ee2f8-c6c5-4dbd-8453-c9c46967fa72", "value": "12288:jpLDc9F3nC0Py3gAhGEJbjJEKK3aVohq8lTU/z/OWVWz7wLbpazDr+fLICHhYJ:Ua6qYMrWP+azDr+fLIKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209158, "uuid": "c3778948-cdf6-4b2c-898c-49ff1f0d8d31", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209158, "uuid": "bedfa68e-5248-4276-aa39-97a1b5078ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209158, "uuid": "05847208-94ce-4cdc-9bc5-97a183f54cad", "value": "QNB Finansbank \u00fcye i\u015fyeri ekstreniz 0182-6900-0517-00000001133622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8451433e-ff39-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629190806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190806, "uuid": "51a08d6b-e60e-4e3e-a67c-fb5953d331e1", "comment": "Malware payload (Mirai)", "value": "cd50fb65fdfd3127bcb9e7c6cb8c1e7f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190806, "uuid": "056649ed-35e9-4e12-831d-4a65c3705f78", "comment": "Malware payload (Mirai)", "value": "c4e2c59ba546b3e73e42af5560f801ab314f6ef330ffa7f205448c11aad2d937", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190806, "uuid": "4e2ae755-de16-49d3-8486-1687a575a590", "comment": "Malware payload (Mirai)", "value": "8ba3c080291b79ccb66f5bf794013164cf50d537", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190806, "uuid": "5c7ee307-2ee8-4deb-a8f6-1d8c9610becf", "comment": "Malware payload (Mirai)", "value": "e264e5242229551e01ec4df7d5adfe0788ca250f85e9a9a11b21816896e0f59815187d7bb5cc94f9b589e043d7d37675", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190806, "uuid": "4e8ecd13-82f4-4cc1-b9d4-9c38c6205bb9", "value": "T103D34C46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190806, "uuid": "34dcdb35-5f3d-4cc6-bffd-13dacccb9b7d", "value": "3072:f0DvinprSHrDqtVOTB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeOTJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190806, "uuid": "68043d62-106c-4058-abe0-3d108dfd0da1", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190806, "uuid": "5d73e138-5123-48bf-84f8-82d46fefb7eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190806, "uuid": "7f223293-4f10-4a6d-a977-97451427de25", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fb7329-ff35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629189037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189037, "uuid": "e5d23d0b-754f-4540-9e35-1d136599b2fc", "comment": "Malware payload (Loki)", "value": "ed42831e07a3c0a9f2240b6475f4ba3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189037, "uuid": "3ecc8771-ed21-464b-b028-c85d67abfe21", "comment": "Malware payload (Loki)", "value": "c56bc83a9e77b9ee422f659aaebab96027d0e5c57dce023a0f5939a96964d620", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189037, "uuid": "09764681-7294-482c-9959-00ad019b55bf", "comment": "Malware payload (Loki)", "value": "3449be62b1fceddfc3a1265bc2395e8a7c4f8d6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629189037, "uuid": "69c3633a-db0d-4ce1-94f6-409d60cb6efb", "comment": "Malware payload (Loki)", "value": "79491f7ee986d49bc862dfe15595488d230bc1936d2c6da44ec3b98628a8e886e782d130733d93cdeb88ce59c04e5503", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189037, "uuid": "b5987c77-592e-467b-ba42-1283e249f91b", "value": "T15FA4BE12B981D076D25314B2569EF7FB5C28B6309D21CD8BE3945EA1FF329B1A220F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189037, "uuid": "de4297e0-952a-4bbc-9551-ebed104b8758", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189037, "uuid": "e7aeed37-d0c9-4a2a-b824-f9f263f9c8e7", "value": "6144:tdzkwTaTa6aOwZpJl3e5I7wjmzCcOeHPGOOwm1WhRpuexi6rqi7BCU2T05bXU/2C:TzT6Cpe5I7wjmxGKr/puGjhXwIGB9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629189037, "uuid": "9b40d693-dab8-4316-8720-30cc589b0bd7", "value": 458366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629189037, "uuid": "71a27db3-8357-4024-9e5a-3e12972c34a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629189037, "uuid": "64847d23-8f86-4dcc-b703-7be13f92b180", "value": "ed42831e07a3c0a9f2240b6475f4ba3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e4689e-ffb4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629243658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243658, "uuid": "bf4f746d-4fe0-49c3-a9ef-e784173cbf44", "comment": "Malware payload", "value": "e9feea09ac6e72a86ee096b88cbd35ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243658, "uuid": "6e61260f-e136-4f61-b0ab-46da3841f453", "comment": "Malware payload", "value": "c57fbe5d0712b881c1e13d232f39bda8bbdd17d2b91213fab204d94f1a56e4c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243658, "uuid": "4199331a-ea8c-4514-932d-f737e32d69e1", "comment": "Malware payload", "value": "4a188e5598478b4ba2e185e966c0513c901e45c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629243658, "uuid": "d9494e0c-456d-4183-a461-83e7fac4d744", "comment": "Malware payload", "value": "ea69e70cb5c5541faa1379924c924658ff9db1cd3f1a1f012622d2311a7591723f4ba742f9ead6770d32111ffe0b8718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243658, "uuid": "faffd8a6-f953-467d-8c41-4a70137c2aed", "value": "T1FF64E0117890DC72C0D605325866F7E4A9BAFD11E5A0058F37AC7FAF2E347D2662738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243658, "uuid": "e6f21859-e161-4762-a5af-0bf723160e7a", "value": "eb816bdcb34642ae497d2f004d3c6914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243658, "uuid": "5838a53d-582e-4f69-aa4c-41cb13418f4d", "value": "3072:54ZXw8cn5x4zp9vwJ340Im1bkGxDyjhcFR0pAgZbY+/guK8O+QllE7rMHIh17W/U:5EMn5mz1K7gpjfI8OvlHE17WlZCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629243658, "uuid": "15d6160f-2cd9-4c65-af1f-cc87d6a2c863", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629243658, "uuid": "3bfbf679-45d0-48fa-b6a7-c8a844485384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629243658, "uuid": "4d9e1fbb-8511-4256-84cb-08fe735317cf", "value": "e9feea09ac6e72a86ee096b88cbd35ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e5242b-ff95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629230180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230180, "uuid": "8b3059b6-6d14-4ad5-ae2d-8b99c8c0195d", "comment": "Malware payload (njrat)", "value": "426f94c2250dfc1e6e796bfbe81bef0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230180, "uuid": "f4932620-fae2-47b3-b405-68b2b0415a28", "comment": "Malware payload (njrat)", "value": "c582b5864a67c2d63f8d3a8faf08b47e94646a96cd81abe507d8d08df13e40c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230180, "uuid": "f13a7b5a-76b6-4ff9-a6d5-de4885861549", "comment": "Malware payload (njrat)", "value": "802296f4944a765d71c2b969df549b2fe561819a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230180, "uuid": "0d03dcde-647c-4451-970a-7dd6c711c2ce", "comment": "Malware payload (njrat)", "value": "0a35c7e76c74156b9b94f59b39f60a658b55eff0e0b8faa719b31b0552f33ffe650f8210db9ac1744eecea7d301b67cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230180, "uuid": "d52a30ed-710f-462f-9074-5560e58ebead", "value": "T101B58C03739D8065FEAA917F5B59B20156BD7C2500E3872F12983D6DA9F03A11E3EE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230180, "uuid": "29b5be21-d1d5-4ab7-b7ea-e3ae271f274a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230180, "uuid": "905d7bfc-006b-4f49-9b48-5be12747c6c6", "value": "49152:Mh+ZkldoPK1Xav4aWGh+ZkldoPK1XadtV+XcM:d2cPK1daWf2cPK1RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230180, "uuid": "5e465e01-ba00-4ba8-b285-23fa2924e6c0", "value": 2436336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230180, "uuid": "8163338e-fba5-4b8e-96b6-df10aafe27eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230180, "uuid": "b719ec9f-51d9-4701-9173-77f59e0bc570", "value": "C582B5864A67C2D63F8D3A8FAF08B47E94646A96CD81A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b7d4f7-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629208720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208720, "uuid": "6991002e-8c3a-4a80-8fab-6ec6f66da8d1", "comment": "Malware payload (GuLoader)", "value": "ca63d5942554404297b7d5225200a362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208720, "uuid": "8f6e531c-edf8-4e83-8eb6-2d2f678f5f3d", "comment": "Malware payload (GuLoader)", "value": "c72fc9ac2cab16efb7d7541ec863718f4824bac484bc09c7bbd84ae5b2c92e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208720, "uuid": "4f7674a9-cba7-484e-84ac-8935bb24ca3f", "comment": "Malware payload (GuLoader)", "value": "045cfa44dd26a02f7a401f1f2e125b16b5ab1bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208720, "uuid": "f0ef3c7e-4bbb-4aff-b3d7-c2a7f76b7715", "comment": "Malware payload (GuLoader)", "value": "505a36345fd7f5180dea676010809ef873a758fa9db90cf96c81be2704d4b01969b520c3b47b4a5872416b7705980c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208720, "uuid": "fa9fe0f1-de32-4d9c-9b16-307d74663860", "value": "T10B74DAF5E2EAA114E2D1B8362701D1710E9FDE5CE4D89F636AC63235277FD60398248B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208720, "uuid": "fa6916d0-18f6-4b24-96f5-156a9e8e0280", "value": "c542b5a459196bfdffd7cecda3871db6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208720, "uuid": "05afb3b3-5bf0-450a-a647-c7acc1d76587", "value": "3072:m4R8u5dc5dRY22+3i7YKHZ/WU4ShwJvDOu5U04:wu6p23fNNpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208720, "uuid": "e6918168-e8aa-4071-86cb-c054fe773e02", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208720, "uuid": "1d51d90f-9af9-4c1f-9d8a-aae43b5f8a16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208720, "uuid": "570f23a4-20f7-4d51-a4d0-6aabb4372ace", "value": "PO747484992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a107c49d-fefc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164655, "uuid": "4cd7983a-ead6-413e-8ee6-d0c13576e76a", "comment": "Malware payload (Mirai)", "value": "ebc278726d50e81f5c08db4ca3ff8192", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164655, "uuid": "7b292136-7862-4460-91eb-88910ed94c18", "comment": "Malware payload (Mirai)", "value": "c76b5b43d6f65afa3c5d584316526ebfcb760c75888244543a929ad47eead7b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164655, "uuid": "3520c882-b5d7-439b-8d31-bcb387841df0", "comment": "Malware payload (Mirai)", "value": "6417d83e0a8dec2b0bc8d7f57d2c4a6bc5840450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164655, "uuid": "33a9823b-75d9-4e66-b61f-18e29ba6cc2d", "comment": "Malware payload (Mirai)", "value": "5f979fe2ca1a1d0ca056abec5748b356be78f8d463ea3303e9608944e572c2d20ca7e31712c0929281e9ab805e487d4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164655, "uuid": "9172160b-02ad-4208-a166-b70b8f4f9000", "value": "T15AD34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164655, "uuid": "8f18a56e-269f-4f3b-ab50-78c86733e758", "value": "3072:f0DvinprSHrDqtVAS+3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeAhJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164655, "uuid": "a260b318-31c5-46ac-b044-91567632391e", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164655, "uuid": "72f15b13-6577-4096-adec-7bd7ace2959d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164655, "uuid": "0f257e8a-3df6-4e21-b9e4-52a587670305", "value": "ebc278726d50e81f5c08db4ca3ff8192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f192c2bb-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209887, "uuid": "19c51d6f-e44e-42ad-a3fe-eb72827fe619", "comment": "Malware payload (Formbook)", "value": "168d0c902497a9cbf6281aca78482cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209887, "uuid": "d0c1fb62-d4bd-4200-90c4-2f57c1c9f09b", "comment": "Malware payload (Formbook)", "value": "c7779ddf9204c4f2ee97e301cfa35ed4c22222bd09299fd95f1eb999384009e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209887, "uuid": "9232ed9b-8659-49e9-a5a3-b5e8bc51a7d3", "comment": "Malware payload (Formbook)", "value": "ac82b19f5e73656fee74f938066a2ba8002b1c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209887, "uuid": "6f480445-8d9b-44cf-87f7-1fda6e7d2bfe", "comment": "Malware payload (Formbook)", "value": "e789bf3cc43326901c590ce254d9a38b9f3385249110f2b4258fd60cd13e6a353eb8d04bf7fea463f70a537f18d82534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209887, "uuid": "ed6b97b7-6058-41df-9ea6-11f9e508d2ab", "value": "T1E62560381BB92667D065D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209887, "uuid": "c759f5aa-6177-4915-a843-eaa4898f2998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209887, "uuid": "118b8199-6104-4115-95e4-65f68373379e", "value": "12288:K8Dc9F3nC0Py3gAhgEJbjJEKwfj3E+P53MV7KG8V7VBDwj8wJ1Oe6+dE/La2HTH6:Uv53M5KGQ7VBDwj8W1Oed2//HQya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209887, "uuid": "805a1a59-6dfe-40db-a5f4-d9751d0329ef", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209887, "uuid": "bfcbfa8a-a9a5-4247-9580-c06462b562ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209887, "uuid": "bd6f441b-defa-4143-a486-f82945ccd371", "value": "168d0c902497a9cbf6281aca78482cb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f0a0ef-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208718, "uuid": "d7e4afd2-1fb6-4324-b4ec-125dbddf8970", "comment": "Malware payload", "value": "70e93b3dc4b9f1acfa950b7493b014dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208718, "uuid": "3a7ce240-142c-4fa4-9dec-f01240f3e52e", "comment": "Malware payload", "value": "c7fbab68666977c981ac4203ba0ef6ab83f47964ae14949c60555244c0d39403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208718, "uuid": "5a1d99ce-0425-4e06-8bb1-81e8eed68da2", "comment": "Malware payload", "value": "8bf09fdfcbd62d180f9ccacd8b1e8db0acfdd540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208718, "uuid": "dd5b7e5a-9a66-4694-ab33-812a17364c0d", "comment": "Malware payload", "value": "045d87d82341943347b59e8f7e38f159a9639b58578aabfa416ad490b0c4a3c5901fcfc96ff06afa4627acecece5eb21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208718, "uuid": "808a5ec6-709a-4f2b-a528-24d828bb8632", "value": "T17755E93C25B43B27E179D339DEE4480BE694B45BB219BE1670DE13670247A12F89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208718, "uuid": "5f918be6-224d-4a79-abb0-eaa63689a868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208718, "uuid": "2a582695-9611-4441-8bdd-fe7fd8168322", "value": "24576:QgWw92ckc+zAIGMDUPFnpIk4FvYF9GwiZ8xOssXP0kkjD+vu5:QNG3Bqk598Z8xOssXMku+vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208718, "uuid": "fb9a9432-55eb-49e2-9968-27e471be131d", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208718, "uuid": "0cf7cd2f-49fc-4ab8-a457-d59beb62263d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208718, "uuid": "932ea1ad-94e1-4639-987f-597f56f76711", "value": "ExxonMobil Augusta Refinery Expansion Project PKG RFQ documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ad8a99-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209198, "uuid": "f8652113-9d3f-4b9c-85c9-a08323f1c685", "comment": "Malware payload (AgentTesla)", "value": "678f20c8d3c13ca6ccec2587b7993a9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209198, "uuid": "fe55cb65-488c-4388-9084-fa9fab8abf51", "comment": "Malware payload (AgentTesla)", "value": "c8c67b9895ec2b463cc43a5c9c1e32363ff1a7a061c99d01dd3de5691e9d1d47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209198, "uuid": "eaa0755d-f447-4ca0-94ca-9d696818c7d3", "comment": "Malware payload (AgentTesla)", "value": "9c059bce31dd9da7070e041966d532f3d3fe9416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209198, "uuid": "f1036b1d-acf3-4cbc-bee0-7260c097b3cc", "comment": "Malware payload (AgentTesla)", "value": "37d96f205e6e5967d7b18f73146429bd08e42362ba73bf9ac6b071f4bb9051a5455191d5584468402eb8cae223e63ac9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209198, "uuid": "a44a2eac-771c-4687-923a-079157ce0c9f", "value": "T1C3451202F6C688B3D8731A31596977107F397E201E29CA2FF7E44D68EE311916925BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209198, "uuid": "045c9aa4-c8d3-4915-a592-89db0a59d85a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209198, "uuid": "961510b7-fe0c-463b-8367-0d20673374e7", "value": "24576:uAOcZ2FsknOXEoi/ycmflANRJuQ+xQZ/+hP9Thz9I6AS:UUWEEoYNm6AQNZmZ91J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209198, "uuid": "735df99b-e484-4faf-8207-132df089ba75", "value": 1219564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209198, "uuid": "d056700f-6915-49eb-b565-7897a242c546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209198, "uuid": "069ca29c-895b-479e-adc5-cbd1b9b46341", "value": "PaymentAdvice_1660754_20210805183337_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04690d79-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629206912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206912, "uuid": "3e526d33-3df9-47d9-8b34-5b1b45c61b86", "comment": "Malware payload (SnakeKeylogger)", "value": "ea2dd111f597984383ee909bd2b6755c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206912, "uuid": "20e2f772-230e-4aad-a655-d7cfff9bfe19", "comment": "Malware payload (SnakeKeylogger)", "value": "c8e811b23640f122bd7682e81f33fa3ae94e554f1becb5610516acfadb574856", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206912, "uuid": "9769a2c0-383d-4eff-a7af-4eaa263fb78b", "comment": "Malware payload (SnakeKeylogger)", "value": "1c0aadb034ec1aba0e6218b83d1169a726247ae7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206912, "uuid": "d0a7db4c-ee23-4fbb-a186-699817d53871", "comment": "Malware payload (SnakeKeylogger)", "value": "4340da92545f777cbcaf16ef4b1e30c654cca8387e2d229be9bdc50fd1989caac4d6a824eddcf232f7825dde84b116a4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206912, "uuid": "10cd0d7d-f83c-4360-b366-c0eacaf50a06", "value": "T14C83A4ACD48706E48F85E7B8272BAF85118DB92DF7859533362C673427E2D3A911383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206912, "uuid": "091c68e7-d884-4979-ab5b-6ca68db2c8aa", "value": "384:Zc0BjonSQI3weWkoHFIjCz3oYFSMhfckrbNWbQdcacFqXEeZB8znm22DLl4:ZFlonSQwwWWKjO3o6SMhnnNjLl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206912, "uuid": "1443a5fa-c2fc-4427-bfa6-34d29513cf21", "value": 88044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206912, "uuid": "a8a52b5a-cd60-4160-9f40-5d7372900480", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206912, "uuid": "fff1a8e1-f3be-4d83-ab45-89dd59f3860c", "value": "PO-08172021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcabb02-ff09-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169988, "uuid": "59757489-20c8-4670-8488-a2e66f786d50", "comment": "Malware payload (Mirai)", "value": "e470824ca3fc7c3695acc39096f65303", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169988, "uuid": "0260d61f-6db5-4909-8a3c-dd112c5e08fe", "comment": "Malware payload (Mirai)", "value": "c9a49a99c29f4375ebb893a29b43abae4d6195c911b67afecf53c15695e85a9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169988, "uuid": "2b257a5b-f872-4416-ada0-0832307c62aa", "comment": "Malware payload (Mirai)", "value": "936877bc04ea50bbd34f1953875ac490bfe75ad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169988, "uuid": "4f41d270-069f-4414-9dde-ff2748d0ae1d", "comment": "Malware payload (Mirai)", "value": "9acb15a960791b1104b972963b22ec75757493e8f232bfff676443a12f33951c3e56164612902358c276e5b1cb552ea7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169988, "uuid": "5bb05acf-1bc1-4640-a060-1a2ef3fbf6e3", "value": "T19B43289BB8019D3DF40BA6BA94264D0DFD3063C112830B2B67B7FDE3AD721695D12D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169988, "uuid": "4f51988d-70f7-4e1d-a9de-7338f806b56b", "value": "768:ujepLLJ3QjJu11JfeGCS5M5ySzbz2XA8SloW3U8N6AW4AZ2oHlKkbJoQLDs7:et8aIMUSzbz+A8SqWJN6AEZ2Id3Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169988, "uuid": "e7b7f44b-fe57-4cad-a651-22ae8daad282", "value": 56500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169988, "uuid": "433815f7-b9f4-4329-878a-38636df00784", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169988, "uuid": "9f9cdca2-8ab7-456e-8384-9af6478d876a", "value": "e470824ca3fc7c3695acc39096f65303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c77c84-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209005, "uuid": "961ae0f8-03be-47ef-8918-cbf243b877da", "comment": "Malware payload", "value": "570a289223a7e02df1ce464689fbb894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209005, "uuid": "fb91084f-1b7d-4704-b3bb-71622a89b30b", "comment": "Malware payload", "value": "ca0dfbe77f7be0e4d24d2ccf2e6f3a8a7211555d1c12bab647c64a7ad9c478d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209005, "uuid": "ca927650-3f26-4f15-92d3-c8c9f26c1398", "comment": "Malware payload", "value": "e30a8d120a767ff2919288481507b3b0a4a2f92e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209005, "uuid": "afa06950-916a-4fc8-abe3-7c93d4245d8e", "comment": "Malware payload", "value": "70bff7add3182bdbc7252b69368d7eb3d6e1645edb8cc0ae74660257d7365d2cdc47899265f4020d28dbbbac9c0b9db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209005, "uuid": "2f5abefc-0aee-40a7-b175-10a95b0a6980", "value": "T13E55093815B4393BE179D379DEE44A1BF2D4B49B7211AA1670DF23670243A02B9D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209005, "uuid": "47b289f2-719c-492d-96db-27bfcee7e507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209005, "uuid": "902e6eb7-4eb7-4548-b12d-f18f115081e7", "value": "24576:PWjUYcic2zzybMrGRSFn9srOEP5Lz+xvTRUPLjrn2qMFqDH:NJUB6KEP5Lz+xv4jbcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209005, "uuid": "d6e889d9-e531-4e60-bad6-5febf39b8cfd", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209005, "uuid": "2fbfc157-4826-4dcc-a43b-2018e3e13ff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209005, "uuid": "cd877315-6e68-4542-acd9-50f9af9d8253", "value": "PO Order_E20210058_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ff6bb4-ff30-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629186832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186832, "uuid": "2442b3ff-8da1-4e5e-8542-3feaac0cf2de", "comment": "Malware payload", "value": "3dd3f78e93e3ffcd99b502c99acb4747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186832, "uuid": "b205346a-9c33-493b-b183-12364d6dc35a", "comment": "Malware payload", "value": "ca1ce981b9afa2825ef0b0d089336b044e064427e83cf669a662f708bee19f6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186832, "uuid": "868de473-cb7e-4169-84ac-809db0c85315", "comment": "Malware payload", "value": "abd1caddb6f524e3d28838435e657e5b8bb9b6f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186832, "uuid": "58799a25-d3fc-4fdf-a9c6-1c3bb114654a", "comment": "Malware payload", "value": "d8eac76efd20f0e8239b5f26f0d6e670a432932abd51488ee92abc859ba2a2fe69b44e706fe2c3fc36038beb70202bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186832, "uuid": "542db405-4b5b-40d5-b95a-e4655f76c271", "value": "T1B8A4E112B7C580B2D1B356384EF8E731A93CBC605F294A5FA7D81B6E4E705806526FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186832, "uuid": "2e2a6771-1ab1-44ea-a7f1-55298477f4f3", "value": "49091c5c46d1ed156931ed11f43d3afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186832, "uuid": "d28ae647-5a8b-4afc-983c-b813491dccf5", "value": "12288:ZgIdCFdSZHZWbHE+QsB7J1Y11Vnhv6rQNBeB3u:SYYSZ5WbHTxJ1oVhCrQN0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186832, "uuid": "0f30e7bf-34fb-4be4-ae4a-eb78d9dcd675", "value": 469997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186832, "uuid": "91f280ba-0dfa-464b-b4ad-1fae8ce2e88f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186832, "uuid": "5f690135-db52-43aa-856d-70d483125b1f", "value": "3dd3f78e93e3ffcd99b502c99acb4747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38305659-fefd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629164908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164908, "uuid": "45e1e06c-770b-4dc2-a631-b6cd6fc036ef", "comment": "Malware payload", "value": "ff2d2b1250ae2706f6550893e12a25f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164908, "uuid": "116ffb93-9c42-4967-8944-be207c526ad0", "comment": "Malware payload", "value": "ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164908, "uuid": "be704f63-9725-426f-93d9-a8e4c72f0f2b", "comment": "Malware payload", "value": "5819d925377d38d921f6952add575a6ca19f213b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164908, "uuid": "4f7d7a34-4b9d-430e-922b-629f6859e7d0", "comment": "Malware payload", "value": "cedcdc37093941863cad788fd30a369e109e5bb82b3937c82f80ff12c755ceaf5d696e8c28dc9fb0cf11be5a7da7878f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164908, "uuid": "a4425507-a034-4c46-b37e-75e111abbc17", "value": "T14D936C10B5C2C432E572193558B1CAB15A2DFA714F269EEB379C076E0F740D09A36EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164908, "uuid": "8b4989c9-fdae-4d7c-b19b-0754d2a407d3", "value": "c7d3661f79d58d30854a3af50a6f4c2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164908, "uuid": "80ca80ef-075d-41c1-ae27-28b19fb086ce", "value": "1536:lWvNrof2xIZ2ToPCt6VkPRYLUbrjhd3d7t20WYwuIJLO+s8jcdd1vzGHY:lWufhgTeCt0uREWrdhdY0W5uIVO77vKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164908, "uuid": "2ccae433-d526-4a93-826b-38ddb2bea094", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164908, "uuid": "0a33dd09-d779-49f6-8e2c-8a21293792fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164908, "uuid": "c39cea37-4ed1-4b59-be7e-dffb94cf666e", "value": "ff2d2b1250ae2706f6550893e12a25f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23506706-ff30-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629186778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186778, "uuid": "56065c0e-5801-4493-9b1f-d3ff91395b98", "comment": "Malware payload", "value": "5d34b41c3cd47a6f533d78fee208142b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186778, "uuid": "7a4f740d-b0ad-41e0-b261-b5f13d4e32cd", "comment": "Malware payload", "value": "cbdcd9ba60a22007041037f7f28165bfbdb76b25e639b19b8c34d70392350143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186778, "uuid": "067c1c85-aee0-4e24-9a17-7f505892ba85", "comment": "Malware payload", "value": "51495b834d9b6ac0968d56d0c3ba3d562bcbd5e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186778, "uuid": "1b0bb8f0-4c8e-4a57-987e-5e925ed4c211", "comment": "Malware payload", "value": "17c01d5f57669bf3ddf449f92a7ba8fc4add6282f942b5a55885097aa372066e4da2b6e6677f90585baf94c8164a1ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186778, "uuid": "84d3f845-4626-4a24-a7ff-ad9870da6c33", "value": "T1C345C93C2678393BF179C339FEE9481BE6D4B45B7611AA1670D613670602702B9A337E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186778, "uuid": "adfb8b8f-197c-4b2f-910a-1d32d4e94519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186778, "uuid": "f95b802a-beda-423a-87ec-515c192bb595", "value": "24576:cZpYfcPcPzKdrkz4Ej9Fn/VF/QwtfaSKzjqzQ:wCJBXQwtfaSKvq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186778, "uuid": "b55412a9-bfd8-4104-9b3b-83973a7e7a44", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186778, "uuid": "b4686949-774b-4962-8da1-cfceba587907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186778, "uuid": "9c672f6d-a3c2-42c4-8339-8e454a5cbff8", "value": "5d34b41c3cd47a6f533d78fee208142b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d50c755-ff44-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629195438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195438, "uuid": "022834dd-6191-4a75-b510-836507e54230", "comment": "Malware payload", "value": "157b23151314101628aa26911d019799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195438, "uuid": "0abad568-3b36-4166-a072-452bc7f910c9", "comment": "Malware payload", "value": "cc515e0bfefb7ec12fffbccb27cfcceef759fceb412644d86552867f4d960cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195438, "uuid": "89438fe7-9622-445d-ad74-94d6b96dd6cc", "comment": "Malware payload", "value": "8c32960d37bdbabb5f108598c51bf80be7d317dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195438, "uuid": "858f9f8b-cac3-418b-9226-733d1c875001", "comment": "Malware payload", "value": "72ccb1d4559d232518f68e34b64d458794ce40ccaa3d40f45b30005c7074b1240bb869e6ec05dbe82e09dbe4bb9ff90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195438, "uuid": "029fa9dc-bedc-4cc4-ab79-f98708397e2f", "value": "T1B355F93815B83A3BF179C339DEE4482BE6D4F45B7211AA1670DA57670302E42B99327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195438, "uuid": "894a810b-7aed-4e6a-87ca-e224f9d84c3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195438, "uuid": "c205b43e-e167-4a50-b0e7-d898a71c5bf3", "value": "24576:lJjoFcec2zNHrY0QFnfdu5SFmNM2dZrscjEDc2fJ/TUM:qPQBlmS4NjdSmEAe/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629195438, "uuid": "47762607-29f8-4318-b57e-e4fc1b019109", "value": 1351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629195438, "uuid": "97da3048-b6c8-442c-a553-bbb0b4447b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195438, "uuid": "8643dd82-bc3f-48d2-83b9-f67cd9f35f45", "value": "BL-INVOICE SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6b23aa-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208697, "uuid": "03486e3a-705c-4b0f-a38e-63a5586fac06", "comment": "Malware payload", "value": "c0d2700c84a73a63fd45865c9c80cbb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208697, "uuid": "ef77ff86-c8d4-4bc0-9217-292743ff96e0", "comment": "Malware payload", "value": "cc6fde28e680ebbfe1f7f916da2e338dd7e9603228374e5bd54659dd8740d468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208697, "uuid": "f9ca2e9a-517c-4abf-87b0-0f096bbe4a54", "comment": "Malware payload", "value": "0c6fd42dba8d25a3adfe3c6580a5783f6b2eee63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208697, "uuid": "80e14063-3639-46ea-801d-2b67eb277fd9", "comment": "Malware payload", "value": "46e7e04cf808628ac62802356f000dca4270004db2aa881a80372b3437b97c000c8a13b38a69595b7abe878a52ef3a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208697, "uuid": "af228487-3758-4e2d-b5c0-fd1e11d63cb0", "value": "T16955EA381D743927E1F9C339DED65C1BFAF4B45B7221AA5A70D613670202A11B8D32BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208697, "uuid": "04a70659-547c-4c07-84f3-5cd1ee55497f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208697, "uuid": "000c6783-0134-4f6d-a426-04d6d7eb1c43", "value": "24576:tSoEVKcgcezgmcnK6FnkRNSRy2Ez5AyeN2kAwDFGt:EBkRNSJtxxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208697, "uuid": "08a4abf5-88b0-47f6-ac42-5e94ef5c137d", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208697, "uuid": "aae89893-287d-445d-8953-660de6d5bb2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208697, "uuid": "ad2df24e-ddc6-45b3-9c16-d6b5deb68bf7", "value": "QUOTE REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f0d590-ff30-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629186910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186910, "uuid": "7ccdfcb4-7e24-4e45-a740-24ab40c9afe4", "comment": "Malware payload (Formbook)", "value": "606611606dea5733fe0b4c55d0de55b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186910, "uuid": "5aa4300f-592a-464c-8ab2-13dde9dc904e", "comment": "Malware payload (Formbook)", "value": "cc9460866fbf6ae7430f759bc11a90a3536a0032319f20757421a2e08f60faba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186910, "uuid": "b52fcdce-6220-4a95-a9a1-10480e83fc2f", "comment": "Malware payload (Formbook)", "value": "b85d1d5c95a88e00e0dc18b7aefce1df855030b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629186910, "uuid": "7cb11e19-423c-4d29-8488-b4ceae75ce6f", "comment": "Malware payload (Formbook)", "value": "1cbe7717b666dffcfe2d40cf1c4e03546eaf13d2d71579ffc22a39e34536fe32311927df965af28c90375bad4590ef6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186910, "uuid": "e608e659-9268-4522-a181-a1ef2c10a76c", "value": "T19245D63915B82B27E079E369E6E44417B3E0A55FB225ED59BCDE03E70206F4265C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186910, "uuid": "59781edb-7dac-42d9-9386-0fd33428717e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186910, "uuid": "4153586d-79f9-49ee-8a9c-470f6e757bfa", "value": "24576:UM5L3geVFYpblhBre/hlt1gT48dn5psHCOR:x5L37yB1K/hlt1gTlHsH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629186910, "uuid": "daa5fe44-e3dc-48e6-b297-26bcc576560e", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629186910, "uuid": "b7bb66e8-efbc-4f98-ba84-ad88d3de745a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629186910, "uuid": "a52d719d-501d-4992-98ab-768c61e746d8", "value": "606611606dea5733fe0b4c55d0de55b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05292551-ff2e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629185868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185868, "uuid": "7c057332-3737-42a2-a6f6-74a9dd716f3b", "comment": "Malware payload (RedLineStealer)", "value": "bf7733075b871230f397db64e086783a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185868, "uuid": "f15b7f41-99c6-4b7a-b386-955dfb2ed6cc", "comment": "Malware payload (RedLineStealer)", "value": "ccd68168bf8ff2be38ec3886689b8c64aba0b89e3d99dc7f030db21fb0e7afcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185868, "uuid": "883323aa-5493-4537-b17a-5013250653b6", "comment": "Malware payload (RedLineStealer)", "value": "4b1bd6c1d37a7da2fe08d8df30e610b6ebdbc93c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185868, "uuid": "ab5ba501-8152-42b1-a5c2-e80efeac2e09", "comment": "Malware payload (RedLineStealer)", "value": "8ed767e97f9e04a9a4306960c5f4843bfe4a922ac00ad21e63dcdf564d3b5502b110346c97b1f5b9a3dadf93297c218e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185868, "uuid": "bf4177c5-3a70-4e3f-9050-71acd939e11e", "value": "T1E8A33A2263DCC629F7BE0A3664B0011587F0E08F6441E75E5EC5B4EA1FB6B826944BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185868, "uuid": "3e159ef0-b1a8-41c9-b5c8-e8bcaec38ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185868, "uuid": "fb345254-63f6-47bb-bc8c-10edb368ae1d", "value": "1536:Fo6aG7RC1g2xbbqW/toJHoSMNauNwDgbue7vxuvNyAsdc6etx5REXG6WAaoigs:FdxtCnbf+aL3xulyddSNWt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185868, "uuid": "e1b96fcd-c68e-4135-8433-49d57036394e", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185868, "uuid": "310eb27a-e5f2-4794-8428-2ffc807bc92b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185868, "uuid": "ef4cb182-f587-4182-a255-817013be472b", "value": "bf7733075b871230f397db64e086783a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c194e137-ff5d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629206370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206370, "uuid": "098b95c8-c04e-4565-b078-b1c4fb18b808", "comment": "Malware payload", "value": "f3d648c4f3a0f9cfbead90e546efe8f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206370, "uuid": "da35328d-1be7-415f-95b4-ab89a9e7b65f", "comment": "Malware payload", "value": "cd80318bc4c724934435231e72cbf7cbf5942df8b36e480603237e2ed08d4a93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206370, "uuid": "c38437d2-8ccb-4afa-9270-957c194bd32d", "comment": "Malware payload", "value": "cba4d6e13b5f1e766914ef65ff50c19bb295c17f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206370, "uuid": "0def26f3-f62e-4f20-bf3b-dbb6e29dcafb", "comment": "Malware payload", "value": "5710e1c687d1573a1f881ec2c07a0dc7f50c43a2aa3ea7a56f6170bc33509203f71759cee40f46155f611c831b7ec436", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206370, "uuid": "c6961369-f96f-4c3e-80fa-ca5f41d5791a", "value": "T1E9545B0027EC8A55F2FF8BFDE0B1526187B1B466F97EDB4E5D4420EE1922380D945BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206370, "uuid": "7c8a57c7-9bfe-4544-a125-55b0fed09203", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206370, "uuid": "03ea5bce-36a7-43df-a0b5-3155928f7147", "value": "6144:Rf+BLtABPD9NF/DVGK7zeNL+dN41V6GIeyXiRA1D0bBi:HNKK7zeNL2Y69eyXH1Dai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206370, "uuid": "91942ee3-ca1f-4596-803b-9b50898f438e", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206370, "uuid": "6c0df0e1-7ee1-4783-aa65-74a33a14245d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206370, "uuid": "defa76e3-38a7-47d8-8a10-314c85140b62", "value": "f3d648c4f3a0f9cfbead90e546efe8f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7561dbdb-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629210108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210108, "uuid": "1380a7ec-5178-43ad-bef0-afaeaa1bb5aa", "comment": "Malware payload (RedLineStealer)", "value": "d2d0a869b987d505331f0ff8898fb44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210108, "uuid": "96b81616-bc1b-4f1d-9b62-09ca1f33ec06", "comment": "Malware payload (RedLineStealer)", "value": "cde87145152af1afa8cebfe625536b32686ad4a280e27271c1eb3d985d410747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210108, "uuid": "e18bab20-2c03-4921-84ad-7785675ab8a1", "comment": "Malware payload (RedLineStealer)", "value": "d16bb10c9e60d9b60db1deb306e5886a26fdd19c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210108, "uuid": "5b213abe-d114-4813-930f-13c842acf8dc", "comment": "Malware payload (RedLineStealer)", "value": "f24fd7119488ddf3758641109aa64e2d69cd3e2975cf242e792afb60020a3a6e0eab5c554da64d42af1fcb908a738611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210108, "uuid": "7f2910f4-c330-45e8-957b-b60854ad009e", "value": "T1BC749D30A7D0C030E5A701F495BA83BD65397DF1DB2C50CBA2D936EA6A342E4AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210108, "uuid": "ed49cc1e-0a7b-43c8-bffa-5e0eb449007d", "value": "35155166d938a506dc8c83222d11c045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210108, "uuid": "6a584d0f-c9a7-4b5d-86cf-ef8fc404066a", "value": "6144:wN8RjNgxgHmHAHhWt9YwdI2NRd3UecI+I/EyC48Vu97kxCE:JjixgHmHAHhWt02rhcPIsyCRVQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210108, "uuid": "0f55276f-2347-467b-b03f-acd3d1672ace", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210108, "uuid": "9028a126-cbd3-401b-a6bc-1917098c6f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210108, "uuid": "55defb36-7f7f-4043-86d8-24da1282e792", "value": "d2d0a869b987d505331f0ff8898fb44d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc15ddb-ff5d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629206314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206314, "uuid": "cef560e4-2291-4074-be8d-cf85b917c598", "comment": "Malware payload (Gozi)", "value": "a17278301c0bf3525ad25c88335440dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206314, "uuid": "b1c3d7ff-ad2f-42fd-aba6-ae9d888f4801", "comment": "Malware payload (Gozi)", "value": "ce6fd95f85fe4fa57f678974c3690cf829887fb7723de85d3a51e64199b780c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206314, "uuid": "ba3c5d08-22e1-4025-9db7-252ab2c8aad3", "comment": "Malware payload (Gozi)", "value": "7a0e4877dde054d545f4efe000181e047e9e8204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206314, "uuid": "3968fc46-d9d7-4c36-9655-5ed8733fcf28", "comment": "Malware payload (Gozi)", "value": "e4214d57f67adf3bf29cd065a5b950a84d1bb2a5573b4287e0b9bfc447bdd47d77b82b9b332b6e69e3b3697519583368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206314, "uuid": "f23ccafa-7254-41c0-9bbe-64038e6bd405", "value": "T14B245B6AA3E40595EDABC6B5CE63D61BE7F274092714D30F4374CAA66F07722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206314, "uuid": "81188b2a-045a-4133-8d1d-15b60faeb952", "value": "6144:dHExb7VwvtKNbnvSxYNiyf+D3LuDXy5eHQ:Kxb5wvtKRvSxY0G+D7urnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206314, "uuid": "1bdd8051-ae60-4099-83d6-85c91184be6f", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206314, "uuid": "792b7392-8cab-40e3-9115-1b9b8486a760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206314, "uuid": "c12efebc-12c3-46f4-aaaa-06c00681da23", "value": "24bb5660000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a807396-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629208721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208721, "uuid": "7e4091ea-8abe-4a1c-b9c4-06c5efef993a", "comment": "Malware payload (Formbook)", "value": "d29b1390cfc58370486702bb8a24bdfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208721, "uuid": "3490f7d0-e2c8-4622-8856-f8fd15fb2ee8", "comment": "Malware payload (Formbook)", "value": "cf63b3171706b81798fce776753cb1f7b4f8ae736e56f232a505f8dde09e8a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208721, "uuid": "b74aa45f-91a6-4c96-a409-0fce61c12af8", "comment": "Malware payload (Formbook)", "value": "4c3b463c6411125d41858acafe46d80fbc4125bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208721, "uuid": "d1ec2b25-b245-486a-9764-6fc6a2b7cf72", "comment": "Malware payload (Formbook)", "value": "82d5a7e4b146ab5c12cbf51d255b30dab6fb93c5e2c8b9602b406ab8ca4bac6dae990db2b874fbe8db99bc66d4e11fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208721, "uuid": "b02adb79-6ef2-4459-bbf9-2873bfa589df", "value": "T14BA4CF11BD81C0B2C7921873955FE6FB9D287B304D218D8BE7946EA1FF719B0A221B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208721, "uuid": "c92cfcdc-645e-4bdd-89b2-de1b16baa093", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208721, "uuid": "db8872ec-2d4c-4f07-99be-04aec813f358", "value": "12288:iOTnOS+pII5jmdbh7BFe6yzNuUnTwJU+cfe:iOTnOS7IjmHBoNzaAfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208721, "uuid": "c0215970-29f9-4caf-8992-2937ad77d026", "value": 457157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208721, "uuid": "3ad4b223-9536-4084-a998-cf8ee418f8b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208721, "uuid": "e9f577e0-d8d6-4984-a5f4-9259704846a2", "value": "TT COPY_11010089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f531225b-ff11-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629173815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173815, "uuid": "4b75e8a3-732a-4141-b7b9-a91edbc674a8", "comment": "Malware payload", "value": "c29cbee61280432d433abac0b08c6641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173815, "uuid": "8dc7fd4b-4835-4051-a0e1-359d7029e43f", "comment": "Malware payload", "value": "d0793065451ae93e07e34af2d96929631fb3021595fdb6b68f5407d657918538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173815, "uuid": "635cbef1-4bf3-4d97-8782-39340eb1d57e", "comment": "Malware payload", "value": "f9734ae2a34d8c1dc4cb1c41b4b882ba9a0d0116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629173815, "uuid": "54685ca3-ccce-442b-abf6-320a7ed04f62", "comment": "Malware payload", "value": "ea6192d5759af64bec83c6c7510c84f568a68f66945d70a1787fa5cabddcd3e03f860e02fe44a13a6d0c100efd229470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173815, "uuid": "27a2b295-ccdf-44db-a2cf-0c2cec67ebcc", "value": "T14445D73815782A3BE17AC339DFE4481BE7D8B45B7311AA1674D603675303A06B9A337E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173815, "uuid": "b95831bd-1649-4203-8f57-a33e08e255ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173815, "uuid": "f1cd5929-9392-4c07-8974-0520617108bb", "value": "24576:O4q+oNucccOzCkvmSJpmLFniHaBptFAJ4UJLzNEzNTfW:d8BAaBptFA9LzCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629173815, "uuid": "cb4086db-ee18-412c-8d66-a6f2525c567e", "value": 1267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629173815, "uuid": "eb777dbc-3a1f-4846-bc48-48fa1e7c9d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629173815, "uuid": "19281c3b-ba54-41e5-aae3-d0a927fd183f", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feccc09-ff6d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213079, "uuid": "f02ce656-5d79-4cdd-9b07-9266914d8a85", "comment": "Malware payload (Mirai)", "value": "30dff699d370944fe55667b9cfc96286", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213079, "uuid": "fe8ef7af-a22d-4074-a966-d75b3dfd1e42", "comment": "Malware payload (Mirai)", "value": "d0cd7b1865de8adfc8eb6e01115569eaa7e34f135aa7eac32785cc54a429d599", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213079, "uuid": "e73424ce-16d0-4696-91d8-e9af54b7802f", "comment": "Malware payload (Mirai)", "value": "98d182150a6e25490c9bf5141fcecadf91f9e15b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213079, "uuid": "42b1216e-ae1a-40c4-ac1d-0d7efb408bb2", "comment": "Malware payload (Mirai)", "value": "fe10753c9e3657ad3dc2b64f669bcb8c4a0c6b9b89b412d9651343b548900ff48df581af4e691f8a0f23fd913a41cc8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213079, "uuid": "5584d7ba-ccff-4577-a42f-8740f915f4f5", "value": "T1FF044A05DA809B17C6E23BBAF79B428E3323975467D733058928ABF43FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213079, "uuid": "0816e9de-c04e-494e-9603-8b6bf7c13b82", "value": "3072:0V/Yb/dnp+eQPGp+37T/a+Brz/5TPibksbfh7Z45hLaq3zVbYM/9cFommw3Bq/1A:d+v/a+BrzBTPAbfhm5hLaq3z+M/9cFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213079, "uuid": "b044aa9e-09a4-45f0-b173-36bc2d5f6252", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213079, "uuid": "79c4b6f9-18f3-45ef-9c69-8edb4b9e9f00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213079, "uuid": "0fda2e0f-73a8-4979-96ff-78143730e2fc", "value": "30dff699d370944fe55667b9cfc96286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8bb429-ff5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629207010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207010, "uuid": "42ca4bf3-2655-4d88-b05d-e354105bb5eb", "comment": "Malware payload", "value": "753970d28a0ba64a78db820c635e90a2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207010, "uuid": "163284db-130f-479f-a9a4-0daf7d81b4c8", "comment": "Malware payload", "value": "d13ba2c888290d7b6641d26f3bcd3c029e6d2708850c898f39ae8afc9ca4fddd", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207010, "uuid": "f2776346-a51f-44ec-bf6b-5f1ab41fd0d5", "comment": "Malware payload", "value": "e40f5301ecbab5b23e6299a2e6b0cffcf542f4ac", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207010, "uuid": "e88e76f3-ba84-4a46-8b05-6659490141e2", "comment": "Malware payload", "value": "baf2d6b300f5bd798d8388e039de6d0134ed48c40e27869382767105d8a1c6e59e1fd48e3585dca2dbd60789fbfe7fd5", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207010, "uuid": "a2095906-2932-4646-892a-c8f48c49e313", "value": "T122D401E43080F795CC67F8B2653FB121E15D3E531A26D4C2BAE6392FD13E718AA44761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207010, "uuid": "e63407f8-0a31-4bbd-b3d2-a3731794798f", "value": "12288:E/t8Y2dv/A2OPBm10iP7ipM+KFpkqJXVDfcnjl+k/PJJISLKxt2mRbvI4usSpNa:W8rdv/A2em13Z+KnkqJlD0nhbPASLKTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207010, "uuid": "7fd0819d-5ea1-40d1-a519-e87b387361e1", "value": 604008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207010, "uuid": "b76f7b35-8ae1-4c25-8155-19c9aa9bba1a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207010, "uuid": "cc390c39-2c27-4811-94ca-7c574b608d1a", "value": "New Order Faruechoc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bd0b7c-ff5c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629205993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205993, "uuid": "89c1dafe-9b3a-4e9a-aff1-926a89713cf8", "comment": "Malware payload", "value": "5c978476aaf6e02c5cd840da6b550bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205993, "uuid": "c47eeb89-40f7-49c9-bcaf-459a7c3ff4d8", "comment": "Malware payload", "value": "d1b0e98b09f928bda1a8db7d074a5dfc2c4eb37ba1f6cb060ffbb04e0a4034be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205993, "uuid": "82597b33-6023-4226-b67d-51380d0efe52", "comment": "Malware payload", "value": "94b8eb46889e10d0fb92deb9bcced47c441966ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629205993, "uuid": "431b447c-3804-4781-abb0-b71ea3a19191", "comment": "Malware payload", "value": "10b878a076c86fdc82b8938370a6b1c64b6a5f37bddd31caa5e01c8d888fea9841a6720f5181ed1d53fbaf25934f5131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205993, "uuid": "58fb456c-4eb4-41cb-ad37-5107d0401fc4", "value": "T145153D381BB82667D165D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205993, "uuid": "faffbd4d-8213-463b-9d02-7b99e168187f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205993, "uuid": "2acb24d1-be9b-48fc-a99b-d596af23da76", "value": "12288:jBYKDc9F3nC0Py3gAhVEJbjJEK4Fjnx7Ad9nB+Cc6sdWOpi3TQ/FEbUiWSv:t8BwsEm0/elW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629205993, "uuid": "96c4ffd8-d18b-41bf-9985-5fc23de3a99e", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629205993, "uuid": "57154ae6-6ea4-4b2e-9305-8d87ab517040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629205993, "uuid": "b214c72a-7788-4cef-b43f-a2ba03df2747", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b7a5b1-ff2b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629184795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184795, "uuid": "d5d66ba8-a684-40e9-8f86-a9fa05f599e9", "comment": "Malware payload (RedLineStealer)", "value": "78ce66dca7949aa8182c81b20ae321a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184795, "uuid": "a67fa7d0-cf2f-4b28-833c-b6920e0b0b9d", "comment": "Malware payload (RedLineStealer)", "value": "d20c74ab1bf100241bfe677fbe33dd68ab3b2a85627d1ba3eba2b634717e2cb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184795, "uuid": "03a7abb0-76d3-4871-b07c-4536862ed945", "comment": "Malware payload (RedLineStealer)", "value": "5e678f491e6ed50f512692f0781f19057b45e6a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184795, "uuid": "38f3be1f-8b9e-49dd-8e24-43d73f6154b0", "comment": "Malware payload (RedLineStealer)", "value": "b29e17b65925c89389c5a160b36c7cd27cdd8f9fe127c09c76f598ac20d28c3355c6f6accf01aefa987961c07670a13a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184795, "uuid": "ad3b8c1f-cdf0-4eab-9261-dbc9bb59a13f", "value": "T15BF5124227BACD36E6BA053F96E605210D7B684956F2B2083D73E7CC09B0781793776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184795, "uuid": "6992e1f8-ac92-44e8-9ded-6ceb1da491bb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184795, "uuid": "7455a35f-9b34-40ac-900a-a0910ef548eb", "value": "49152:UzfvzOovcHxkpZBJYNQcc08E7QbtKM1iF3COcL7NUCrtLwOcUro2RP38+/gff:iKaZBCNZzPF3COCeSZpif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184795, "uuid": "3777361b-5e6a-4dd0-8512-c114b5ed4ebf", "value": 3625896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184795, "uuid": "5e09ebdf-49a7-4ce8-9a64-f4902b8ffea8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184795, "uuid": "2ee2fd08-d85e-4fae-8578-7c9feca60dd8", "value": "78ce66dca7949aa8182c81b20ae321a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbb85fe-ff2c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629185317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185317, "uuid": "b73760e5-fc60-4185-bc74-7753385ec79f", "comment": "Malware payload", "value": "daf08c4681ca63fb7fcc29783237db62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185317, "uuid": "91c2025a-b290-4880-9d3b-76cfd5d52c84", "comment": "Malware payload", "value": "d2330df06094349f53773a89ff96e2f009e744b249fb1960e536bbbfaf7b5321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185317, "uuid": "01164b72-214c-4fb1-a3fc-d893ccaa33c2", "comment": "Malware payload", "value": "d60dd9b8aa2f48cf270dd5ee092b24079dfc546e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185317, "uuid": "6e1fa7a3-151d-486e-aebf-376dca323186", "comment": "Malware payload", "value": "e6b64a5f263559d24bc065d1fb0184a61bef20c62cb1d2c978c24c840895c0f10797c41fa797fbf21bc4a607797a0c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185317, "uuid": "9d7107fa-9c5b-4914-b3d8-20bf6626ee83", "value": "T155063303B99A5472EA319C324B696F212178BD603F154DA797896A3AD6320C0F731FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185317, "uuid": "e4adf5d3-f9a9-4c42-a961-866f80044bc7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185317, "uuid": "4c842d35-6420-4a1a-9b4d-407f9dbd2a6e", "value": "49152:J84pdkNVyhO3MKDDYRHjef1WD5R1Skrf6cO4EkkXqbSYBn6kXLXi:JTdEbYRifc5R1SkrycOgsKXLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185317, "uuid": "2557fe09-9a1c-4d8e-a605-88e440a36937", "value": 3671160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185317, "uuid": "36b51897-9859-46e5-8db5-4f4620756c8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185317, "uuid": "52483aff-c8f6-4033-9cfe-3f0c5c6dfa7b", "value": "daf08c4681ca63fb7fcc29783237db62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094213f3-ff94-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629229684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229684, "uuid": "9ed2d55b-a782-4f0d-848f-728138c8ffb3", "comment": "Malware payload (njrat)", "value": "53dcdc201d264222d881d794843641e1", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229684, "uuid": "ffb8b7c3-6458-45af-a16a-b9b884171481", "comment": "Malware payload (njrat)", "value": "d47a3f1550aeb17d011141cb9c8c7b87b07837b75795d186841d02574e1073bc", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229684, "uuid": "6272a147-e6d5-48c2-9142-1685114bbfb9", "comment": "Malware payload (njrat)", "value": "eb0c1e54fc523bae08cfd20186477b08538aa66c", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229684, "uuid": "7602b195-a8e5-4815-b177-650ac301875a", "comment": "Malware payload (njrat)", "value": "61e313a5a38a9a4f156b53246c4113344161dcf6b3e83c9d68d25ce194481e8bef7794d872a4321a1297ebb979534e42", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229684, "uuid": "efd863ed-8e32-47d1-bf7c-5806abdc8c08", "value": "T12045781177310493F245A23212EA36E8BF70BD4577B24B72364D93145F589FB0D689BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229684, "uuid": "7d083a5b-9dd2-4835-a9ba-cb2c0230d241", "value": "96:55NOOy++0tZD+UtUwJav3Iyfl0pFx2Al1wErhg3N:/NOOyx0LKUBawyupFx2Al1wErhg3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229684, "uuid": "a73cb0f6-db5f-4238-bc9f-f3544272f3f7", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229684, "uuid": "01ab8792-8696-4842-8a0c-f6ab7f311fd4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229684, "uuid": "17fce559-e912-42e3-bd5b-a47cc7f51574", "value": "Pending_invoice#YT.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d9e28-ff09-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629170014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170014, "uuid": "428a7740-de28-40e0-9ab6-c1786b66b40b", "comment": "Malware payload (Mirai)", "value": "927677f5df53ba4d2b8369ecb4af1f87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170014, "uuid": "b02fd515-626b-4ad6-81db-2af2bb263520", "comment": "Malware payload (Mirai)", "value": "d4d79de7a02b26f5daec3cf6355472a2198b4ddefe5f621b0a4d3250dcb89629", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170014, "uuid": "82f6be18-0e3e-44b5-8d7c-6eea4803fb64", "comment": "Malware payload (Mirai)", "value": "28b11537975e9f6d420aebe0c71dfb9d4960f778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170014, "uuid": "afbfec41-bd9c-4ee0-a6e7-af0bbd453bae", "comment": "Malware payload (Mirai)", "value": "ad008dc20abd51934e1c784877d31a9fe60d7c5fb35d1a02690fa4d9df28830f665c9b698ca70890b234c6135ec95c48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170014, "uuid": "aaba2ebf-5ed6-43a4-afde-82d13125c8a1", "value": "T1E0C34B46F7404F13C4D61776BAEF42453322EB91A3DB730699285FB43F8666B4E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170014, "uuid": "68685481-5467-425b-b4bf-2da70850dc83", "value": "3072:Km7w4PYRm9eWGb1QgSljPCO096LfCM/9j02mWXpAsV:Km7w4PEBWGb1QTle6LKM/9o2mWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629170014, "uuid": "1125abbc-09dc-4671-ba20-8f269f1f0c40", "value": 129396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629170014, "uuid": "5c876403-d199-43b6-92f5-448089e5cc6e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170014, "uuid": "70a27f9d-fa3a-4bb7-80e4-a3d13d1093ca", "value": "927677f5df53ba4d2b8369ecb4af1f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05593127-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629208632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208632, "uuid": "1924337d-cc73-4db3-9d83-eb5a80510c8d", "comment": "Malware payload (Loki)", "value": "dbf2c0a180adae5af0249819d21368cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208632, "uuid": "e6db4121-ef20-4d93-b3a8-f1d273164486", "comment": "Malware payload (Loki)", "value": "d4de821098d687d2705eeab129a0199f36be76878c0093f9de0299a79ae957ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208632, "uuid": "0bacbf6f-db74-46ff-9ad7-2217ce7d5c5a", "comment": "Malware payload (Loki)", "value": "c1aa53f5c989539d73f3b1f6583750e7c3159fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208632, "uuid": "40468dba-b08f-4253-b3f3-07692215e511", "comment": "Malware payload (Loki)", "value": "a48af05504ec0f4f70c92a07607e51bebd3908786143fdcd413ea673fb93944915c14adeacde18b8cd3896270d06b1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208632, "uuid": "73e11d7b-942d-49f6-92c2-9ff3f176f5bf", "value": "T14CA4C012B981D0B6C25618B3529FE7FB5D2876309E218D4BF7541EA1FF32A70A224F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208632, "uuid": "dea9a267-5219-4126-a67d-24c7493a229c", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208632, "uuid": "63803707-4448-487b-ad5f-8533f561e052", "value": "12288:UiT1mNupII5jm9bmWW7wVzndJtpxphDPhHlK:UiT1mNrIjmAT7wVjTtDphPjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208632, "uuid": "629ed70f-397e-4d97-ac82-7268e6de405f", "value": 461726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208632, "uuid": "108d0056-ee48-44f1-984d-15e93b5a4af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208632, "uuid": "308615b3-89e0-4e25-a471-e4b2acf71f9d", "value": "STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50718c21-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629208758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208758, "uuid": "c453258c-ccdd-439d-b64a-558cb05b03d9", "comment": "Malware payload (Formbook)", "value": "0bb660af76cd316fd2dae5a66506a1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208758, "uuid": "68d3626e-2c85-41df-84d6-79fcd85d9c43", "comment": "Malware payload (Formbook)", "value": "d53bae4b5ce931f64224d180b42eda418516d524ae0623571069c6bc30845fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208758, "uuid": "1c275a28-6685-49a1-b8b9-1e137c4c1956", "comment": "Malware payload (Formbook)", "value": "1765a7f9b76bc22b89a5d74997a54c5c5be28450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208758, "uuid": "91da995f-7483-4e5d-9675-cdaf8de0dfa3", "comment": "Malware payload (Formbook)", "value": "1faa92a0e981ba04a6b9f5400f1f8e410d184941ca6085038cad6b9600cb42b0f7effcc11f86820ad60018756a821c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208758, "uuid": "a705edb2-0a8b-4677-985a-9271d013fcfc", "value": "T1C8B45C0391524023F432F83C01A993759E24BE6E1F5EFEDB07DA9D5DF6B44E0691BA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208758, "uuid": "240ff28a-a2e1-40e9-b08f-f049351c6ffb", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208758, "uuid": "c4e2dcbb-2b6f-4ac0-9f1c-4925d0f29263", "value": "12288:S7ixuBYYUltDe9syZLZQ5+SDW1afioyS3+lpq4e7:S7ixufUbCsKLZQ5+SDW1di1/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208758, "uuid": "e742fcd6-db91-4228-86b6-da18456dbcba", "value": 518161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208758, "uuid": "e4c0e274-f739-4d28-a96b-34616ecdf761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208758, "uuid": "ccb6f6b0-f364-4eff-a474-a0b80a871b8f", "value": "Order_30554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4764fd84-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629210031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210031, "uuid": "5976fed8-d977-4737-8f93-43b502bc0ec9", "comment": "Malware payload (njrat)", "value": "2192cfe9de1e5450629e508ec785055d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210031, "uuid": "09d473f6-d19a-4b7a-92d4-feb1e1b66925", "comment": "Malware payload (njrat)", "value": "d56742d377a636a7ced6a503d0ff26e429bde79bb431a26c0ec63f51cf418fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210031, "uuid": "850202b4-cc2f-4830-a609-b15a0d26ff9c", "comment": "Malware payload (njrat)", "value": "881be66666b9a3c302a56c364c8d9e230ae3854d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210031, "uuid": "c85dfd5b-86f6-4f5a-bcf1-dd28fa6377b2", "comment": "Malware payload (njrat)", "value": "6063b53457a8637befbaf318e8d4a16301bdc3718af8dd9cfb1e5a29b9ceff02dd82d14c5fdb92732a6122e90a6cedd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210031, "uuid": "7c983f98-13a3-43a8-adf4-68df762be2b1", "value": "T1CDE25F0762DE7DE1C5BC0A71373753D1D36DEE024813DA2E18D0796AAABE1437A823D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210031, "uuid": "99d561f2-f17a-445d-8ec5-572117dd4e70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210031, "uuid": "ff5f921c-9261-432f-b69d-d3bb22d70b4d", "value": "384:u3Xi3yZrydtJL6L/nrIyExDylZ44dLRkJ5IEiQZuYFrEhd0oJ:AMwr2TyPEy4+wHlua4hdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210031, "uuid": "98f95266-06e8-4a85-84c3-91bc2c7e3cc4", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210031, "uuid": "9d9ec012-8a0c-4c04-a03e-3f42a1633af3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210031, "uuid": "235418e1-ef3a-46e5-ba68-8d2190d2a19a", "value": "2192cfe9de1e5450629e508ec785055d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd42b45-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629213451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213451, "uuid": "d44d56a6-a860-4127-968b-968e2328c04f", "comment": "Malware payload (SnakeKeylogger)", "value": "92ce39373f576961746e579ec247c6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213451, "uuid": "bec28612-963f-42b8-bdbb-1a0964ef1f01", "comment": "Malware payload (SnakeKeylogger)", "value": "d57a5e8835ba746d89d2c4ecc9f904793b485c6affc1b9901486c84eb88f4e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213451, "uuid": "49b6e831-ff60-4095-aadc-b25b5b2c7440", "comment": "Malware payload (SnakeKeylogger)", "value": "be7d0048e210d354e9d1ed37e31094dcb6d54604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213451, "uuid": "3a837b78-a746-4f19-9dad-3b561fb2822b", "comment": "Malware payload (SnakeKeylogger)", "value": "ad5908111f6c10e165fffb642492f44a811793b2782f080208729c6d611aa5b4fa5a0c19e925733d9d611f50f7d8f891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213451, "uuid": "31ca8567-0cde-4cf2-8739-98035dce4af9", "value": "T1BED45B203AFA501AF173EFA94BE475969AAFBA333B03E45D109113874723E41DE9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213451, "uuid": "306d79a4-7814-4281-812a-08d10647953e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213451, "uuid": "28808a49-6db2-46e8-820b-103bb6245f8c", "value": "12288:JJadd6CG7M5c6Wun/jUGhn2cV4hNj6gW4KaJIk8mBqBb5EykOE5OgB48V5MAmbMC:JJadk6e29kf+KaIfxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213451, "uuid": "ec94aa13-5f95-438d-9594-1194d13c5ead", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213451, "uuid": "2fb3a783-0ad1-4bf5-beac-3585140e74e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213451, "uuid": "596ea8b5-1483-4591-9d89-9b8b4711c2c1", "value": "New Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad39b2d-ffa0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629235082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235082, "uuid": "ddd4ed49-4186-4712-878b-34c8167984d5", "comment": "Malware payload (Mirai)", "value": "9b7d502d9934b0229cff10a759ef5e3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235082, "uuid": "20a77de0-7f7f-4989-a1e2-7eb90fd8a852", "comment": "Malware payload (Mirai)", "value": "d59dd0a7ccd770d8679f1e017600b31468796f4eab55a27b19991c400bcef06e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235082, "uuid": "bef6dbd8-0779-484b-bfa3-9b6fffed0bab", "comment": "Malware payload (Mirai)", "value": "46b9cae21810745e5b0cc33176e9ca883e768e78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629235082, "uuid": "68aafa1d-10fc-4d82-8be7-847e94a567e3", "comment": "Malware payload (Mirai)", "value": "c96130db9270ca16c8b46d3f8538e09330123358743f45d5353fcd5b11f4d722c0741de5af6986a7d42497b2a9636498", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629235082, "uuid": "dc70d771-fb5c-4ab2-9c23-c397784a2a62", "value": "T1FA639D6AC9692E18E24899B4B534CF3693239110A2572FFDD1A5C37DA443EECF6183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629235082, "uuid": "9903025d-17aa-4754-88b2-23cf3f02b5a3", "value": "1536:c6Y/qADjysZD/JwO6xMNP79ei5Nh0sZCWMWDKs8U5Xd73R:j8jDj7SO6xM75Nh0sZisB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629235082, "uuid": "2f304d50-e031-437a-a8be-87cf94e044f5", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629235082, "uuid": "e2b81b08-3daf-4284-a742-dd08a5981ae1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629235082, "uuid": "ac951920-8295-40be-a5ea-23c04ffad317", "value": "9b7d502d9934b0229cff10a759ef5e3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160feee9-ff09-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629170005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170005, "uuid": "e532b0f9-cd34-4f50-9df3-004e74967ab6", "comment": "Malware payload (Mirai)", "value": "01d2d9ee047bee3931b5255bd0cba2a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170005, "uuid": "9b47c508-28df-4a73-862d-5f38ad99fa46", "comment": "Malware payload (Mirai)", "value": "d5c8a853796866931627d3d3a48b95398c31b604cf32f318e9922c3de02d5598", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170005, "uuid": "1bc3033f-9370-4a4c-908d-365258e28434", "comment": "Malware payload (Mirai)", "value": "49fd6c0b3f9659d4c3657504a206a689ac9bde52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629170005, "uuid": "01e28044-4bb6-4a22-b51e-40648b396922", "comment": "Malware payload (Mirai)", "value": "9b2c8e3be57c86637f6ad5e51f200e557c33927bc467add88791af9dc2dea4522e2162108bf402f448dc78b2e21bb7ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170005, "uuid": "d699e18b-6095-473f-a284-9fe774c5c726", "value": "T103334BC4F143D7F9D84900717036EF369B33F1FA226DD997D3995A33AC92502A906A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170005, "uuid": "90662067-62cf-49c9-82f9-15d2d1dcd5c6", "value": "1536:vbxZ+QmM0P+IWFWidh8dsSK3Au6I0iIBIF0x5L:dZ+QmBto9ATB+Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629170005, "uuid": "88039713-6046-46a5-a0ad-5e84427d9ca5", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629170005, "uuid": "d7d6ecca-c67a-4dee-943f-4db9f5ad312d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629170005, "uuid": "e3ff21b3-331e-42e3-80ec-7ad1306b3eb0", "value": "01d2d9ee047bee3931b5255bd0cba2a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01d651b-fefb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164358, "uuid": "5c2b3e2c-6273-40e4-b6ea-9975b0b760ae", "comment": "Malware payload (Mirai)", "value": "4d58f2835de810c6fae1fdd0ffaebcb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164358, "uuid": "0d6e6c42-d67a-46df-adef-d5adfd8c9767", "comment": "Malware payload (Mirai)", "value": "d60a8a9a9d50e3429f976c36c95fde90bf0da956d12064aba73fe2e953678a3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164358, "uuid": "92ea986b-c989-4b32-ae0d-9b5f43c34ddf", "comment": "Malware payload (Mirai)", "value": "d8e473b4b1e91857bf4e70d6de01999f302b30f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164358, "uuid": "401c65ac-0d8d-4d0f-98f1-3f988eea875d", "comment": "Malware payload (Mirai)", "value": "39b1bc322377b81e50058fa9d47fd74da3eaef36e93ad208f7695633d001ef8e4821c34bdd7e6274cbdc7363e07c66d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164358, "uuid": "0b90fcf1-967a-4a4d-99bf-5faec83715c0", "value": "T10D336B65E8295D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC271544FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164358, "uuid": "93c9e8be-0830-4119-a06f-e5e7f542b568", "value": "1536:3a+BiFCYXjD2/FuhFJKbwBx/lURAYEYCF:3pioYXOt4HVyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164358, "uuid": "c0dcac04-7572-40de-b8e6-baaf9e1c2434", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164358, "uuid": "bd14ab77-b9a9-4f33-b1f2-e21f703836ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164358, "uuid": "c911ddcd-0af7-48cf-879b-60d771723341", "value": "4d58f2835de810c6fae1fdd0ffaebcb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90faeeca-ff4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ModiLoader)", "timestamp": 1629199417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199417, "uuid": "503c6849-63be-4f12-91bb-069c6b74d236", "comment": "Malware payload (ModiLoader)", "value": "e2c06a71d3e93dbad9029c875221aa9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199417, "uuid": "b5a30209-84a3-4d94-a594-5cd8926ffc08", "comment": "Malware payload (ModiLoader)", "value": "d660500c553676fcad1d6b2847022578ed20676190b5ed5687cd15d19e98e862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199417, "uuid": "b43aedb3-a9c8-4695-9a1c-00ba43d0a8a6", "comment": "Malware payload (ModiLoader)", "value": "213ce5c3cea5a223aeb9f19d7db7141f48f90de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199417, "uuid": "cda793fe-6f3d-4f56-8aae-c11203a35ceb", "comment": "Malware payload (ModiLoader)", "value": "90072142d851b8bddad4a7268975eb3d565c3d23ed6e9455ab17535c4542e0468f72356e443dec9b0375f0f4ae878535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199417, "uuid": "9c385618-b18d-4087-b31b-d8750a242430", "value": "T16625F02B7F4D8AC7C248B9BF4341D391C2A093D6BC2BA75769901E9BFBA52D4F705240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199417, "uuid": "5e5a3992-821c-4678-b84f-28987605bc65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199417, "uuid": "21694c44-d8bc-494d-b248-f1d0a21725f3", "value": "12288:xKHEJbjJEKIjtjgLw8WDQUEzwak0TMQfTODQfy7vitaArjZnqq2TS/PcoiJCq4ya:mj6s5DYUtQfTnfDsMTZat4yPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629199417, "uuid": "5e6d0bac-f2d1-4f12-9894-b49c0fac85e9", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629199417, "uuid": "6de0bd0b-35ce-430c-80f9-b14c5bce3dff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199417, "uuid": "8e43e700-ec2b-4e01-961c-a72e0eaf324d", "value": "e2c06a71d3e93dbad9029c875221aa9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ec4267-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629209173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209173, "uuid": "afa18f99-d355-4fa9-ab83-722fbbc2cbce", "comment": "Malware payload", "value": "c0c11bfd8e1f6385803b69815d70eb5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209173, "uuid": "de74968f-8bb3-4fde-aa95-780017d71732", "comment": "Malware payload", "value": "d694d9cbdcd2253844ad1f1e44226574420e58fd5fb14d35c32447b4780dd1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209173, "uuid": "5a279dfa-132d-4b69-ac42-88b090be4dc9", "comment": "Malware payload", "value": "86d0470d81a643bee95d033ab6da9cef861936cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209173, "uuid": "8c029232-c61b-47e4-bbbf-51931262e473", "comment": "Malware payload", "value": "6b757f525c12d6b9b566c62121735b89d6c6203a9c1925a4aca81aed63acb68c903af1663088193fd49115515f2abb75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209173, "uuid": "1841da84-9c76-4905-a378-18aebbeafa6f", "value": "T12B457C1F7F929D35C01205375F2A8EA4A51DBE202E21A10F27DAFA4F6B772E0390595F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209173, "uuid": "9042b1c0-9b8e-4162-b967-85cdf5c28f2a", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209173, "uuid": "ee3efd44-42ae-41e9-bc6d-db06788cbfd5", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0F:8ej+XQUeET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209173, "uuid": "04fd7f0c-8dad-4e68-b277-2a2c08e08747", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209173, "uuid": "d22d6dcc-ca1e-4d20-ae1f-9308e2478ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209173, "uuid": "5299d480-2956-4a90-a091-a3f74de93b54", "value": "Urgente RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef4260a-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629208675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208675, "uuid": "2067b729-0f85-4c56-98fc-37ba7e271e7a", "comment": "Malware payload (AgentTesla)", "value": "6f16e6804500d74488f74e64587cb6f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208675, "uuid": "d273ce3e-f1f8-4f52-baf3-37d78088c804", "comment": "Malware payload (AgentTesla)", "value": "d6bbb80e9b3eeb6f8460547ec1bba91b9a4641a264f85d7211dcd1649c23fc85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208675, "uuid": "2b72060d-864f-45a8-809f-cf5cf4e7316a", "comment": "Malware payload (AgentTesla)", "value": "c4a4fd13ec73adf1743c9df050463f2f92210d5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208675, "uuid": "9cb9ad7d-dda0-4ed2-90a5-d2c1764c643b", "comment": "Malware payload (AgentTesla)", "value": "1a44ccafc8f69d326d1bc420a293a6f6f7b692cc0193e9eb9ccb38c3e0d55c0498f6f3c663b082292b3db821139e56ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208675, "uuid": "aa64bdd5-b5ed-4073-854f-287d1b9698f5", "value": "T117940253394891A7DE289073D1DA82524B277E3646906E9376FC7F3B37332930646BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208675, "uuid": "255d02e0-e799-48dd-9a1b-e7d8d85fe0fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208675, "uuid": "e46d938b-2b8c-4afa-b124-e291d845809c", "value": "12288:XmoiHNWnSkdBrmEN5GgIGAgRYpdTGnohx:XekbjGl8YunE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208675, "uuid": "cda2954f-0a7e-4149-801d-cf7bdb19dd3b", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208675, "uuid": "00330598-58fc-4e40-8ca1-2938ad96cf35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208675, "uuid": "fba6644a-97a4-46ce-8729-3ae4bbce33d1", "value": "MV.BAOGANG GLORY.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c48e065-ff08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169613, "uuid": "844a04d1-91cd-40b4-b104-3ae42828ae98", "comment": "Malware payload (Mirai)", "value": "5adf45458a968301c80fe9d037627e2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169613, "uuid": "751b2180-b82e-409c-9c67-a0ae2fce31b4", "comment": "Malware payload (Mirai)", "value": "d7e9e179345bff8e729ed673e39d0aba1ef6884dd4d85e4c8f1215dbc9d6fb45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169613, "uuid": "1925ae3b-f562-415e-b87f-23f477a61695", "comment": "Malware payload (Mirai)", "value": "c8037e0fa189dd3c1b01884918b40800ed535ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169613, "uuid": "fa0769f9-fca1-4518-8f34-49a52578811e", "comment": "Malware payload (Mirai)", "value": "3aa479813343bc9f5705ce3af78075a234a390e8d70c6400e0e3505590407db5a602e268c79de1abe6f39196e3a6056c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169613, "uuid": "33414a35-5220-47f9-872d-493b6d6a50d6", "value": "T102232A96F8829B2AC5D0227AF57E995C3764A7E4D3CF3227CC601B207A8650F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169613, "uuid": "d560355f-ab75-4418-b604-a021ff4d1bbf", "value": "768:FGg7wgy62tyWWEUgpdYNlciq5HtfA/iEQwHpYPf+Qsk041JpXJxhoajXzZY10U85:326EUgdYNlGS/iE5Hpwj5RjDa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169613, "uuid": "fa6d16ad-e75d-42bb-a346-0d9f682ce715", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169613, "uuid": "9ac0ba8b-02bd-4751-821e-a9382a17e2b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169613, "uuid": "4e943ea0-c4af-4e95-8e11-8174f9d15a3c", "value": "5adf45458a968301c80fe9d037627e2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21758eed-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208679, "uuid": "f0269d31-8ed3-4cba-82fb-d6cea70eaa2c", "comment": "Malware payload", "value": "816f1afa7d8ae66103c2f00094d455e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208679, "uuid": "cc5420a2-455e-4c41-a27f-e0d67237c181", "comment": "Malware payload", "value": "d86fc9203ccc7755c5415b535f076447095a7feaae167d03ce671f23877aea25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208679, "uuid": "738fbe1d-5e0c-4f21-b501-812f37d71ae3", "comment": "Malware payload", "value": "412de4dd6539ef6e006966107d39f82a9eb486ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208679, "uuid": "404f8755-9dfc-4918-8563-ca93577637c5", "comment": "Malware payload", "value": "40e75839ff76e4d7177fd692dbae13fde277e40c6c3b7aa42866b847b0fd52ff2543295a7f7558797ffb93ecdc180083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208679, "uuid": "2baa9cad-5b15-4a3a-a2c2-07249c51d8d2", "value": "T1FB45BA3C26B43A27F179C339FEE9481BE6D4B45B7511AA1670DE13670242712B8A337E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208679, "uuid": "9848832b-ff51-4eeb-9b92-41132210ea50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208679, "uuid": "8d1cb8da-8688-4433-9dcc-3c3bb41a0ca4", "value": "24576:E1jAZcacDzrHMYgdNegFnWE/+Ln5aC76wfn32wHdfB:6zgBf2V96CFH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208679, "uuid": "3590dfa3-1240-49ab-8684-28584f29fb87", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208679, "uuid": "59a6e148-e1b8-4f0f-9825-3836eec0a28c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208679, "uuid": "379ba47e-96d1-40dc-b0a0-40985b694cb8", "value": "SCAN 170821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03603b28-ff6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629213353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213353, "uuid": "22fc6c68-d3ad-4716-b55c-4154aa7ed137", "comment": "Malware payload (Mirai)", "value": "88782eb3ed7f02c7b9fc7006eef90a6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213353, "uuid": "8f73db12-f77e-496d-b05e-aaa5441dab26", "comment": "Malware payload (Mirai)", "value": "d8df0234ec5f3efee2eeef89d596698dbabf8025fc53fe935e1defd27c3bf614", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213353, "uuid": "312065ce-7a70-4336-a0bf-60f5ef227eff", "comment": "Malware payload (Mirai)", "value": "751619569f0faf236cdd9bb367ad0d0586a7b514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629213353, "uuid": "52c31912-dcf9-4990-b0dc-fa400729911f", "comment": "Malware payload (Mirai)", "value": "ea09f421cf30fdc5495f097da52403a3c9c2768645b316ea48d5166ffc575067f1529534c920876d0dc11c47eb178117", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213353, "uuid": "954f51d7-0b93-450f-a5b4-7b95bd369ea3", "value": "T19AC30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213353, "uuid": "8c3a15db-3e1f-4f26-90df-5ef4c7f73614", "value": "3072:0JDZ+6lJQTnoo3AK5nnyXxfWw5hLFCuXUSP4eoC9DQlD6ObAF5R:7nyBuw5hLFCuVhoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629213353, "uuid": "5828703d-e8fa-4cdb-b23a-4ca16bd3fe73", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629213353, "uuid": "39624fb3-070c-4fd1-bbb3-729749505819", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629213353, "uuid": "46246c40-cc02-4ec8-ac63-d09bb533662d", "value": "88782eb3ed7f02c7b9fc7006eef90a6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570e0e72-ff44-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629195454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195454, "uuid": "df4830e6-e3f1-4002-ac3b-1cf19afbc7be", "comment": "Malware payload (RemcosRAT)", "value": "e39cccd2c1f0998f0e34fa525132868d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195454, "uuid": "42742f1c-dd75-48cf-b54b-4f8d7f2c5b47", "comment": "Malware payload (RemcosRAT)", "value": "d9040bf8ad755cd41dc6266c0e0049f4bac0eaa23f18a26931357fe21c719701", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195454, "uuid": "72fbdc58-9197-4bba-ad80-52929368559a", "comment": "Malware payload (RemcosRAT)", "value": "94b39b2dcf8682cb2b5b039428219ca4a6d6eb6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195454, "uuid": "71ab0e47-b34a-43bb-be1d-84137b08e35d", "comment": "Malware payload (RemcosRAT)", "value": "e3fd0ead433cba28224779f7ec9bb11cf84c1c9e945779e87212d758306a5ec189128b4726c28806f657886dee4a4f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195454, "uuid": "1b6907a5-181d-4130-adb8-7734d4621851", "value": "T1A8D3D0D0F98BFDA1E0820F710875505C53D6B92882940F277BBFDB7A1B7BA811E8522D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195454, "uuid": "2565f8be-db3f-4d75-b5f2-0e90b559e0d9", "value": "37e215a56c837657c68542780cbce344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195454, "uuid": "fce14bbd-4858-40c0-bd09-58d0c0780c0d", "value": "3072:Xu9+L1Dpafpq70qTfRSlO9ts42CvASp+2H8UeH:X6+L1DkfPqTJSAPs42CvzpFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629195454, "uuid": "cca52225-355e-4934-b959-58afeceb2d92", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629195454, "uuid": "8b395700-42c3-4ec5-a883-62b7e50be3f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195454, "uuid": "6ffd8c98-1779-425b-9f36-f132c8b0972b", "value": "e39cccd2c1f0998f0e34fa525132868d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825d33fc-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190373, "uuid": "96f12b8e-d5fa-4693-a8fb-dee9f5bdae11", "comment": "Malware payload", "value": "ffb61befec627680256af651a4099941", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190373, "uuid": "d8f90c73-02fb-442e-a766-bfe0a4d7de75", "comment": "Malware payload", "value": "d9db938afc624ebddbdeefadf0b7d7f2b266136ce67df765960337eed43d1ed9", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190373, "uuid": "9058f45d-6814-4ae5-bff3-2e7ff92697e7", "comment": "Malware payload", "value": "af5161f0bcaa61d4025e2c381d31517d59c50aa7", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190373, "uuid": "27e32f18-15e3-4885-9762-f2e06b3c1d8b", "comment": "Malware payload", "value": "558886b84c93a0e55b076ce90064d8252f6a85d1dd9dcf4a2cbce8b8f180e29936527148751028686a4f842bd665cddd", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190373, "uuid": "e0f55440-47ab-4f81-9e86-84b8ff94318a", "value": "T13B552390AEE6A55FC1C9E530492AD07342EF4E90B1CDCCF142D3F56EB53A6A143616BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190373, "uuid": "c3b9085b-8526-4885-ad39-dca6e267481b", "value": "24576:5xWmUlU6/pMf5LXKRA2iDhffCd3qnGR3hQpxSXGnHW96I20aSaudZHNb/an:71CU6/OfkkDhm6GphQ4G2960nakZtb/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190373, "uuid": "54c37dde-4e94-4fbd-a741-a98d420fd1a4", "value": 1361256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190373, "uuid": "dbaeb4f8-f9c6-4af4-9aaf-e3810c4197b8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190373, "uuid": "b54c96fe-31aa-44bc-9b27-7e1aaa7afa79", "value": "kung_Sub2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcdfe90-ffb1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629242358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242358, "uuid": "3b5c5275-ddc6-4db1-a55f-926ef2034983", "comment": "Malware payload", "value": "0a1c6d9cd67172995d22fa54946662f0", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242358, "uuid": "65092bd3-3a27-4fd2-a5a0-42cddeecfb9d", "comment": "Malware payload", "value": "dacf7868a71440a7d7d8797caca1aa29b7780801e6f3b3bc33123f16989354b2", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242358, "uuid": "b125109d-6373-4af0-afdb-9a01fdcedfe2", "comment": "Malware payload", "value": "f07c706e0a65b05eecf6d79841fa8d8d9ee9f9e7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242358, "uuid": "6e0cb6c7-9ac5-423b-a3b8-fa99167d2705", "comment": "Malware payload", "value": "e64cfc6462376d7981f76b25d027a70a4fe7cef58bad557191807584341347ee38f3ecde4417e583ae4da259601dcec2", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242358, "uuid": "207aedf9-99eb-464d-a4fe-9d772aefe0e0", "value": "T1E7F322A8BF73AA18EDF753BC443DD3A00688EF259C1822FE3B14B152E574D20C95A472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242358, "uuid": "2af99343-f701-4207-8c91-8da96d747e15", "value": "3072:9iOMqFYFi6Y9RTH89J8awbYaxCEXUvOQPdhOY5gEoRaJBFot5pTXdecFLBe:h6YHZjbbQEXUvPt5gEPJPE5pZecFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629242358, "uuid": "477fdf90-03dd-41f8-ad9d-90394d1bc94e", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629242358, "uuid": "247bb79f-22dc-4c5d-961a-ee3a8885de8e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242358, "uuid": "5358c27c-5f8e-4ea2-912f-b5a816d6e844", "value": "Pegasus_List.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0f35e7-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190312, "uuid": "e3d68a36-63d9-4ec3-a01f-9125f1f99013", "comment": "Malware payload", "value": "bf3a50651b57dedf4b8590990278f100", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190312, "uuid": "d69b32ed-03f0-4634-b958-a45ffa4e64dc", "comment": "Malware payload", "value": "daf9c4fb16137d18aa10adfd405826569d158d587c8b559f61bf4cbd92fbeed7", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190312, "uuid": "0030618a-2ae7-48fd-82d1-aed48ac7461e", "comment": "Malware payload", "value": "63ce109db6e427b012d48b1fc4345aa0d12ab828", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190312, "uuid": "25f92abb-c415-4be7-a945-305451182f59", "comment": "Malware payload", "value": "c119f0b7675b37cb96335cf7a8594d4069dcd44d0b7256fcba454b99f8ef56c05f1da6233b1758f66dc5228958570cbb", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190312, "uuid": "8e8668d7-fec8-450e-97d9-85535a5e15e1", "value": "T12C452358F3C77E05FD112AB424B55D6B03CBDF152306C2DA6A90B7DA9DF81BB69C8280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190312, "uuid": "9b06150d-ea2e-4426-9462-2444d8cbba99", "value": "24576:lWxqBbuSTo0SDl6Qa3mE9Bgrn2JnmS9y8y6xpeRxTF1wtihl1ZI/xdnA0HD9GOG0:lWxfS1W8BgSnmS9bxpe3eKlY/XTHLiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190312, "uuid": "a1d67687-944f-4982-b653-aa8578e1689b", "value": 1217832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190312, "uuid": "461b206f-4aea-49ff-a6e1-45cc89e3033d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190312, "uuid": "540c6689-0ade-4776-b4e2-ffb095e616c1", "value": "Order Faruechoc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ebb136-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208765, "uuid": "cd05bc0b-4861-49a2-892e-22daabfb5260", "comment": "Malware payload", "value": "526cd38c4f7842d83358ecfd24873f41", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208765, "uuid": "99429cbc-8fbe-4e0b-a9c6-c2e0339a32bc", "comment": "Malware payload", "value": "db210fca52ce8805306f36e12e230da6c754fc43f880c9fcb2f28c1e85e7799a", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208765, "uuid": "ba6a5634-c904-4f7c-8626-6ced1e4544cb", "comment": "Malware payload", "value": "f947d3405740a6d441163c965a82f41d4d9ff072", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208765, "uuid": "6f31d166-82a8-4e50-aa5f-e18238589a47", "comment": "Malware payload", "value": "31406ff931c12ec79ae64c335eecafbbb216c1567c06e4bb3c360643fb298c378b28381161c631d7ff703ca7d36c93d1", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208765, "uuid": "450b1fb9-9b9a-4825-8587-6864584d1c35", "value": "T1A1550B3815B8393FE17AC379DEED482BF6D4B45B7211AA1670D613670313A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208765, "uuid": "dbd94065-f97a-4608-9ac3-9dc34f3c083c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208765, "uuid": "b3f8592b-de55-45e1-8724-b0f8c1ba9cf9", "value": "24576:AgWw92ckc+zAD/NOplFnabxgX3MrOVoUbBYqcnEAlCEN3M:AseBA63M6KSGqcnhlCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208765, "uuid": "303ced8e-f6c9-479e-a29b-59c879ce3f3e", "value": 1377792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208765, "uuid": "994f34ca-bda1-43d3-ab1f-a46cf2abe71d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208765, "uuid": "e447a4c1-6587-4ecd-bbca-f5ed08737102", "value": "BBVA-Confirming Factura_REFERENCIA 0182-6900-0517-00000001133622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9336247a-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198991, "uuid": "bff2cb4a-2506-4438-858e-14c76b633dd7", "comment": "Malware payload (Gafgyt)", "value": "99460c02d9b5d37ed45d53e92f4d29d5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198991, "uuid": "6e3bddb8-0606-43b3-b110-d0c2747df23a", "comment": "Malware payload (Gafgyt)", "value": "db92597343858558b829a67b053bc70eaf0ac8c2d94db66115e36007a1c3b3ab", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198991, "uuid": "bcb654c4-d17e-4566-bb20-df68d6077069", "comment": "Malware payload (Gafgyt)", "value": "af9824bba9501f56b18e4361615d029fa9069b8b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198991, "uuid": "28ee7a50-c4ae-402f-91aa-af12c447b9b5", "comment": "Malware payload (Gafgyt)", "value": "f2d02f3b459637648a0613119dbad6dadf96a96fdaa76baeccba2b1d4716ea2c1bc52d8166739aa5d8061246a4481315", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198991, "uuid": "cf036830-5b1d-467e-9ea0-27a68b607e06", "value": "T1D7930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198991, "uuid": "39eca238-922b-4a79-95d8-520a946865ea", "value": "1536:LBkF9VQPAraHYyEfgcqpq1innPTxHOxyePczYrmREqQ4b/X7XSee:OQDHYBv1WTXePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198991, "uuid": "e44687e8-d3aa-45f0-b739-98b3d9e36320", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198991, "uuid": "8c197ae7-cbc1-4d25-844d-7f9f68d13a11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198991, "uuid": "474404c9-3e0b-4bd3-9492-b573ab609024", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a380ad-fefc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629164627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164627, "uuid": "48a8bc67-c273-47ff-aba1-ad033d6a6cee", "comment": "Malware payload (Mirai)", "value": "b0bc5f042e1c18411ddc7b7be2c3fb35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164627, "uuid": "617ffaa2-19ff-4309-a67a-99ae71b99b37", "comment": "Malware payload (Mirai)", "value": "dc4f9f8ecfaec55c73a9c7b19515d5124d1008bf6af300274c8f24ff9c876be4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164627, "uuid": "0585f338-7ea3-478c-8da9-88bdae5f9dcd", "comment": "Malware payload (Mirai)", "value": "7817ec9c7f3f4b7724135b1ab562e22a556b7c4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629164627, "uuid": "ca5f3384-06fc-4c2a-9390-69a9bd9ff036", "comment": "Malware payload (Mirai)", "value": "0372abf98905e0d0f718b39db35ffb038f9539a9967865f6fa8155cc3f8cda4bdd3c106eb18d51cd8aa4461528754500", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164627, "uuid": "e3aae7e6-db4c-4c8c-9d45-e0b96a773fae", "value": "T16D73A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164627, "uuid": "863fea57-35b4-4619-9478-a315a25dc200", "value": "1536:YZIJO4rSB6xRqzEIQCRIxuF9IJajZvGIyv:LPOBcqzElxxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629164627, "uuid": "d4eee491-108d-4214-aee8-a2189f4edef7", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629164627, "uuid": "f5e2a1ac-6cff-4e97-a46e-3e9e15735146", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629164627, "uuid": "c5842903-f434-408a-80a9-1399c3b65313", "value": "b0bc5f042e1c18411ddc7b7be2c3fb35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d414de-ff04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629168095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168095, "uuid": "7278127a-8f47-4d9a-80d1-18e64b83af63", "comment": "Malware payload (Mirai)", "value": "5351e5ca7a5af1402fd0926436504091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168095, "uuid": "a58546a2-58dc-4efc-bd8f-a2f4a7455292", "comment": "Malware payload (Mirai)", "value": "dc673b56aa16007042c40421240f37a8093be84c0513c5453a436663705b62f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168095, "uuid": "56561514-67c2-420b-ba2a-8d7810b24a2f", "comment": "Malware payload (Mirai)", "value": "509c850e42ffa3063cc39d503af551db7f32f9e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168095, "uuid": "c8b08485-ff19-4432-ba9a-c386f55b5ac8", "comment": "Malware payload (Mirai)", "value": "f5761697d736dd0712468a3f9b00dd568d759c59f1049de06a05fc42b0405900272db7c639cbb35253f24e5ce46910ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168095, "uuid": "f0d8f71b-887a-4f13-8f90-0ff9d2448940", "value": "T17A93B50A6E258F7CFB9D823587B78E21964C33D626E1C585D15CEA011E7074E342FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168095, "uuid": "6405d545-4785-4b46-b6d6-2f558a7056e7", "value": "1536:f0Y3jOPWsKiAl/Hr3YM3MTmEo0ReEdey8VEQt0bhnf3l2lPdVzvUfkZbte:f0AOPAdx33ifo4eA8v2f3l2llBva2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629168095, "uuid": "c0a3fdf3-d8ed-404d-b998-a9c5ebebf9d0", "value": 92372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629168095, "uuid": "87235198-77de-4fff-b03f-5c249b6db6d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168095, "uuid": "b7958323-efa2-4593-ba61-eb6d33a472f3", "value": "5351e5ca7a5af1402fd0926436504091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046878cd-ff25-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629182001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182001, "uuid": "163f9e80-3c70-48f0-953b-fea632b3276f", "comment": "Malware payload (Loki)", "value": "7523103a55465d71b5686bf960694027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182001, "uuid": "1bae1cd5-37ee-4930-a1c8-4b08d44df889", "comment": "Malware payload (Loki)", "value": "dc818bb2797249f1cc13daf873c34127b1b3c8a6bf1ceb1fc7392613114c5269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182001, "uuid": "eb1da3ba-4a6c-4004-8e2a-7b95c25a63ff", "comment": "Malware payload (Loki)", "value": "e69d656bb003eaf6f3966e9bb89f9e14b191c960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629182001, "uuid": "4bcaf856-7b9e-4063-9c2c-b3a25eb45106", "comment": "Malware payload (Loki)", "value": "8b0dd1e50d6172da99fcea108a0547d51efb9b4fb666041093101b5a611ef34064764f618bad48ee1dcbe8c58dfd78a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182001, "uuid": "2d730021-c9a3-4875-b12a-3f34f1af6aa4", "value": "T157E3083272C7C852ED00DE715258852ABD0F7C271A4A6F0BB562A70E29F69F7A4F450F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182001, "uuid": "8ae020e1-07d1-45ce-a625-6b700e1dc1c8", "value": "2b4f5fe80df3ed9a6d3159464b73e6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182001, "uuid": "30abc2df-ba16-4a5c-9ffe-3a6890c0beff", "value": "1536:JhUoHf+unUoBn+RF95VmHFJ4c+2/S5B/8qxqlKVt1g+9u:TN2M8nclJ4cJGpBqlAguu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629182001, "uuid": "c164487c-ff50-41f9-abdc-50371c1caae8", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629182001, "uuid": "1450a27d-4429-4953-a2df-63d934d3dae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629182001, "uuid": "0f4c7e3d-add2-481e-89d8-2a0b0ee14f67", "value": "listahan ng order UPD016082021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109e16f2-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208651, "uuid": "b94a967c-7008-484d-8644-d917abd18862", "comment": "Malware payload", "value": "db38af7a361fa9565edcfb086e12a245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208651, "uuid": "7c553e3e-a71f-4949-9ff7-a1fa542ec20e", "comment": "Malware payload", "value": "dce5a0add465419579be0fdfd03155af233f462840033ddbd5a5843d7984707d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208651, "uuid": "f1a70fef-067e-40cc-a673-e7a970680fbc", "comment": "Malware payload", "value": "cefc3a937d81adc85eef69e6d70b80a9efe16398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208651, "uuid": "6ef18be7-28a4-45e8-908a-e035a62bab2b", "comment": "Malware payload", "value": "0ae89f0d8eb1507bf6404d61d82c4b327764f6a4d9f1299b6181e3e8f61de3e7f9df812ab84be194a658b097c534be19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208651, "uuid": "b935036e-597d-4f39-82b3-52a5c064de7b", "value": "T1B8B412A2F28488DFF775057B48759EA0129AFDAEC074640DA09EB91507F32D321B9E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208651, "uuid": "047feefa-a026-4e31-87b9-4d14cfdab9e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208651, "uuid": "f851cb3d-2d31-4cf2-89b8-17eda2d00c2a", "value": "12288:fIpnnUL8XjRu0eL6HON92ux2spexF/YUaI3xilKTWi:AxzRD4192w2sppUac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208651, "uuid": "aad0f722-dc90-468b-869b-31d333a8a824", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208651, "uuid": "a6318d1b-c2cf-4443-a01a-2cba28b5db44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208651, "uuid": "026b392e-3052-42c4-a8db-94e86fc41b1c", "value": "Xebo Ord 308612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450e2fca-ff0c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629171372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629171372, "uuid": "f6284850-4ce0-402f-9541-c4888df684bc", "comment": "Malware payload (OskiStealer)", "value": "b146860b83e4b59ffb07dbbdff9b8e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629171372, "uuid": "fb4e0251-6994-443e-9577-c3c3af7ea9ba", "comment": "Malware payload (OskiStealer)", "value": "dd01ca4b5bfbe8ef00d23fd0c1227d58e7d6169a89e3f1ae9bbb4fbae46bfe21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629171372, "uuid": "0fefa41e-6f1b-4474-b657-c7e40815adc2", "comment": "Malware payload (OskiStealer)", "value": "06031a3261528c023af96b026e3f24589a46038c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629171372, "uuid": "f5970b12-a5a3-451d-b3b0-34e57b6691e1", "comment": "Malware payload (OskiStealer)", "value": "d57bd1e1d1fd5e8345d39ed0d1febd58df112674a7e58158bd24ed2bd39c45ef441d0a407ed40f6c1ffa4ea3603e07f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629171372, "uuid": "689d3b67-610f-430c-a860-007e73120ea0", "value": "T1E9E46CBC3150B9AFD137CD36C4580E15F66068A7A3CBC613E0932559D93D7AAAE402BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629171372, "uuid": "2af5c3ce-d7c0-48f5-8610-cd85558d8a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629171372, "uuid": "177cc228-1cea-46aa-b14b-8363adf3c054", "value": "12288:jVzd4RiawLwA2ligMb9pxEC5HsabLBd4bfTp6MQNSKUnqAUGobngxaRYP:jpqRiawLGiV9pxHGavbUfIxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629171372, "uuid": "48f5b40e-2e8a-4d8d-bb20-310b8090bbc6", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629171372, "uuid": "e1b554ed-e824-4ae3-9332-20bdc91d9e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629171372, "uuid": "6d1e7aea-bfe8-43fc-93a9-ed2de455288c", "value": "Inv60995fromMicroVet Diagnostics212576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f925443-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208756, "uuid": "6becd1f7-b388-4343-9ff3-f4896af8b56d", "comment": "Malware payload", "value": "0c763a63ab4993711c253d21b6ce3329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208756, "uuid": "80d4487e-8dc8-4a0f-8fa6-a238f5166040", "comment": "Malware payload", "value": "dd480b9ed83d6fcc4bb84affc49ed254b2abddec0c6332db8a2d93a7a4d37899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208756, "uuid": "bb20ce8c-8823-47e2-b07e-40636d1a789e", "comment": "Malware payload", "value": "051dfd5736fbfd9c52046835e18ae8e8a18ba187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208756, "uuid": "3047c9e9-90fa-4ccb-9a9f-ecbecece28c5", "comment": "Malware payload", "value": "5a530591d43f518fa8ff8eb3947377ad4842db453ff676f614654874118e887846cdfcb65f196006c16f4041d68d82ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208756, "uuid": "32f3056a-d22b-499f-84a4-f202ddb3c3f4", "value": "T17955D93C1D743927D279C339DEE64D1BF2E4B45BB2216A5AB0D613770206A12B89327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208756, "uuid": "0b19b304-da51-473d-a3cf-35b5763d65ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208756, "uuid": "d50d451c-3c08-4371-bd4d-9d44336e058f", "value": "24576:MOQ81ScYcOzWNNW5ULdFnqahhAyaPWYfYrOnGPT3DTAmPAv:XdBqU/a+YfYrOGPZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208756, "uuid": "095b406c-59b8-4f83-9595-2941143f513e", "value": 1383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208756, "uuid": "e72ede03-55bf-40e4-b330-0523a70072be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208756, "uuid": "4be14c49-e077-4449-85b5-8dfc310bd054", "value": "PO Order_E20210057_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7605834-ff7b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629219292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219292, "uuid": "46c7a81a-0013-49bf-8052-a24333477e87", "comment": "Malware payload (Mirai)", "value": "57e7e3b33d1a544fc023958d56aeb084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219292, "uuid": "660f7e7f-bf86-423f-a343-060a04df4fe0", "comment": "Malware payload (Mirai)", "value": "dd55330619c4fcf6c8801fffc6ea432ef99d91cf8bdc6e71ac54bb848484dd5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219292, "uuid": "ab9cc30d-bb44-4508-ae8f-6512caf1e62d", "comment": "Malware payload (Mirai)", "value": "aaf9b130bdda38a31c012332d262fc53fb803061", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219292, "uuid": "f20eb2d3-a5e8-4eb9-a5c3-81bfe92fa632", "comment": "Malware payload (Mirai)", "value": "ac4cba32ca34359467a330a5deafaa99eb443650715733090582af3d86cceb29ee73b4957c0737f22289469148f2b804", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219292, "uuid": "bb5a61b1-070c-4740-a3be-fa1d8c9f327b", "value": "T1BC636B25A93A2F17C0E0B0BE22F38765B2E1675E25A4CA1EBE330E4FFF15650554B1B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219292, "uuid": "cd2d0dbb-0c43-4212-bd84-b44923ef2a77", "value": "1536:6wniFMCtTV9WnO39KI17BSpsPJ6fE8xF/:vnhoR4pquf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629219292, "uuid": "7cda40fd-7387-40bd-b599-c8c4c41e09fa", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629219292, "uuid": "e048d337-94f3-4d15-bc58-851e03c92b61", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219292, "uuid": "a1a48c7d-1bfe-4d7e-b6d1-8ca7d45120a3", "value": "57e7e3b33d1a544fc023958d56aeb084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3064a162-ff2b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629184652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184652, "uuid": "d321a023-fe25-4ceb-9800-596dc7759c73", "comment": "Malware payload", "value": "1bc3c6adeec7ddc7ed693724c6da5054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184652, "uuid": "ccde0d7d-3fbe-4558-b1fe-9ade2937b0c4", "comment": "Malware payload", "value": "ded4f788c0aedb2627ac8e5f2c43d9951edf577e79deff87ab6a745b03293ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184652, "uuid": "09c50545-fd02-4b78-827b-0a5c29adf086", "comment": "Malware payload", "value": "5666787ac11e110ea7cdecc51cf19dde33b6bebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184652, "uuid": "de42277c-37ed-4d27-9615-872076f6f952", "comment": "Malware payload", "value": "5818ab107569e034de400f4e8ad824b4e1badc14232c764627acb60e1f03494e0856e712360f6729a9fa2d82c0936ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184652, "uuid": "230a5e56-de8e-4607-9b3c-373ca230974b", "value": "T1EEF30848ED53E9F2FC0705704E4BD2FF09E36D2086545E06E7853BEAAD729E2524A732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184652, "uuid": "0f751485-399b-448a-86a9-d6ff64598667", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184652, "uuid": "f33dc517-9836-4b93-be0f-958b40661880", "value": "3072:FEn2wel+Vx2XAW1x75L1A5mKmCIxKu9U:ceMMJdMHTUKu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184652, "uuid": "8024b4db-456a-4d35-8934-83acfe78c59a", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184652, "uuid": "1ac5d9aa-2b8b-4ddc-88bc-4a84075a7221", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184652, "uuid": "819195d1-049d-4a92-b9b8-b1ad99be7fba", "value": "1bc3c6adeec7ddc7ed693724c6da5054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea6da49-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629206902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206902, "uuid": "2219e7ad-14ce-40ad-8339-477a6d4f09fb", "comment": "Malware payload", "value": "a2515b87dda9d9b79d2244842e212641", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206902, "uuid": "6538c920-88cb-442b-aed5-37ea72575b64", "comment": "Malware payload", "value": "df57ae65e4de420e52a8fb61728e47e2a8ab3493f5a2de43073eda67b0eef6eb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206902, "uuid": "a3740d41-25a8-402a-861a-00967769ed9b", "comment": "Malware payload", "value": "2e13f79a8ca812745977cf0069aea9129882572c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206902, "uuid": "b8e91ee1-2823-457b-9ed3-efe625e75330", "comment": "Malware payload", "value": "b71b789168f8e38d97db1a32bf271237150d2269530f1edede7a50e0bc9d29cf8723ee63d0b2a9ddfca0d2a7898e9acc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206902, "uuid": "cace8611-0407-4e8f-b1b0-34d6a65553f1", "value": "T1B133A4ACC0A705D8CF8A6BF82B2BAF45158C766EF785A5333A34937126E1C7A411187C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206902, "uuid": "1fd0cbb4-4e7f-4e04-b4a9-cf3e3ae441bc", "value": "384:ijhOfGAI/DBd75jGrW5K3EixigqlyIVLkxEj5Kl3:UhOW9r+xigq8aQx0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206902, "uuid": "630eba7b-ef71-4809-a1c7-8dd72b952aab", "value": 52426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206902, "uuid": "a3979a4e-3799-4aad-9362-27f3e648db0e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206902, "uuid": "64580309-9f3f-4876-be57-9168a0d389a2", "value": "LV9-SAMPLEORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072c5f3b-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208635, "uuid": "08473723-c3dc-4632-a122-191ec71e342d", "comment": "Malware payload", "value": "5f0e39fe686fb50ee84561cfa9ef79bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208635, "uuid": "ec8b4b25-07e0-4e9b-9747-a0d34bd898da", "comment": "Malware payload", "value": "e03cd00c465dc4212e674ac7e6a3fb99bc51d7f20e2ad5dbfcbc30aaf0e932f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208635, "uuid": "719830f0-8177-4d83-9d4d-856436337849", "comment": "Malware payload", "value": "0e0b9e7a19fd3e8b3226b470da721f6ec8d27523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208635, "uuid": "899901be-5abb-439e-9be8-d0a0b08478ca", "comment": "Malware payload", "value": "6154f616bd9c5d763e4aebf148df72005027be4153119e5318276d7cf96347ee58c8be1118fd87e3f6db7a293ebeae0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208635, "uuid": "7a7b0809-7489-4274-a02d-76bcd0ffe80f", "value": "T1CA55FA3815F8393BE179C339DEE5880BF6D4B85F7211AA1A71D613670703A42B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208635, "uuid": "75176d5b-e676-4d89-97ae-92a7fb5ec894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208635, "uuid": "cdb18a53-8fa6-492e-879f-0b2f609e254f", "value": "24576:fXqNUcucWzbJrfFnY/dkCrPZtmbfWZUvnWBMaoCSVI:/BYyC+y+WwCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208635, "uuid": "dc07d089-1749-4550-a306-14fd4230d4db", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208635, "uuid": "fc32e3f3-67b0-44da-b122-6348ef221890", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208635, "uuid": "f48a833d-166d-4a3f-ac37-daa58a2138cc", "value": "Enquiry Order KV170821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc169e6-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629209451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209451, "uuid": "7b13a827-85ce-43e9-9baf-0cd544a0bd93", "comment": "Malware payload (AZORult)", "value": "295b2d76161197eff3e0802239576ff5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209451, "uuid": "262d9dc1-db90-4c4d-90cd-bf07eb9bc872", "comment": "Malware payload (AZORult)", "value": "e062aea7aa7f1e6d4f5ad5a5029cf7cc2ef0724852ad03d76f2d07b8f5558615", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209451, "uuid": "98901fc6-edb9-4e95-aa38-0943720d2318", "comment": "Malware payload (AZORult)", "value": "e50e1150b7b35a089932fe4a58df1ef51c8219c6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209451, "uuid": "5e7bc104-9540-4f00-b42e-3c659b825742", "comment": "Malware payload (AZORult)", "value": "0d92e97d8681bcb3d989198153fb7a125f8f89b0acf36c777f9195682c2d40d4849cf32c70f6182744b6d7af94f92d63", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209451, "uuid": "dc30a9db-ad96-48e3-a358-2528e86fc536", "value": "T105C4CF01A6DDC237D5E22432C1E9B1F928387E61DB5F4AEB27D43E29BB741D16D20A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209451, "uuid": "8a36a35d-f902-4c58-88e8-5bec05753f47", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209451, "uuid": "6b235d2f-a3e2-425e-a27e-b286986eefe2", "value": "12288:Xkuzg4vUltD8VSNxKAdyDqn9LDd+gZ65UDNku:XkSfUbDxKAda89ghu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209451, "uuid": "7fbaeb05-352c-487d-ac20-18592709b843", "value": 550948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209451, "uuid": "aeda4cbf-2d55-49e0-b00c-3e8cfdfdca64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209451, "uuid": "0ac87b78-20c3-46a5-80fe-5d0893834f94", "value": "T. HALK BANKASI A.S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe137d47-ff3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629192728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192728, "uuid": "38c22e33-b2ec-4b42-9f53-eee21b70e8a8", "comment": "Malware payload (RedLineStealer)", "value": "c94fcdb866e1e3a9af205bd27664d492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192728, "uuid": "59130ebb-880b-4364-8ccf-1f09a04b14b3", "comment": "Malware payload (RedLineStealer)", "value": "e0c5e5c7e3b414cf11f2b0423e399bba10eeed0069b21b399a3caf886ac2cd3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192728, "uuid": "b3e9181e-2374-4bb4-8af1-c9e8e941426c", "comment": "Malware payload (RedLineStealer)", "value": "8537e869ad1624b632b9ff3eb1da22ad0f6f14fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629192728, "uuid": "352fc58b-051b-45a2-89ba-9359cb2d8140", "comment": "Malware payload (RedLineStealer)", "value": "9929a739d37452d93389eb6f54b7133e80fc27dcc360110c9e9d1eba0bec6b19a9cb1ecde5c37621377b18165750a06e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192728, "uuid": "99434c75-6bf3-4d3c-b240-7a6baad84de4", "value": "T12EA32A3263ACC629F7BE0A3668700211C7F1E0CB6402E75E5EC574EB1E767826558AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192728, "uuid": "5a99d1a8-ba10-4a90-bad5-2f60021f6778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192728, "uuid": "d67688f6-e30b-47fc-8973-791e43f3896f", "value": "1536:Ao6aG7rCt6kcvW0OSohzyauwwvgbue7vCu0NyAsd23etx5REbG6WAaoigJ:Adx3C6t2XD3CuSyddlNWB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629192728, "uuid": "98ce3572-540e-4c70-884f-e2f08b4e5d72", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629192728, "uuid": "29472909-feb2-4659-804f-6c60455eee82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629192728, "uuid": "7cfaa74d-031a-4bd6-9aa0-b85dd565ef7d", "value": "c94fcdb866e1e3a9af205bd27664d492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762e39f9-feff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629165871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165871, "uuid": "961957f5-92cb-4c09-b134-9300d99718b7", "comment": "Malware payload (Dridex)", "value": "dad06884d3073cddd3cc2e8f26d51e46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165871, "uuid": "77426c3e-8112-4a6a-809c-81fdbb49a9e5", "comment": "Malware payload (Dridex)", "value": "e155a7a839f1aeaa7f28cb737adf20fddf9adf5cdc441894417afad94940995b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165871, "uuid": "bbc330ec-e9a3-46cd-a3b6-c2781bf1e6af", "comment": "Malware payload (Dridex)", "value": "3be4d7c897558fa8c6d13583b98095220481a482", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629165871, "uuid": "2f3c574a-0505-4668-b9e3-b79484acc098", "comment": "Malware payload (Dridex)", "value": "41d3fdb1ac9b16419accf0668dd203eb4699aa263fa32e4eb280b0243358ac68f57bce5f2f92363a7b3e6071f7c6b067", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165871, "uuid": "28cd01a3-0160-4c8d-948f-1b3f9910b8b9", "value": "T178341217EA6C2D57C2ECE3B9AF131DB0035547419A05B8CD6AB13BBA6F5CAB203E054D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165871, "uuid": "470bf148-e000-4cf5-a301-5e733d6c8f21", "value": "6144:1ogkLjLh6yxp9HoQj5M3nxz7t9MBhvSOz9w4bwf4jJe/a/8CC:KDLZlxLoQj5M3xz7t+SC84jJe/zCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629165871, "uuid": "e3a160e4-7965-4330-847d-3f166050181a", "value": 249866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629165871, "uuid": "4b2d911e-38d3-431f-b98b-1ae194969839", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629165871, "uuid": "e8162391-6410-46ce-9770-1b42c02bfbda", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.1563197.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735a4c91-ff48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629197220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197220, "uuid": "f712b5a4-bdaf-4ddd-ad23-16becff604b4", "comment": "Malware payload (SnakeKeylogger)", "value": "ae736a921698e72c2912f01ba4cef729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197220, "uuid": "79e4ff21-1676-45c3-87bc-1a1da6eb12ce", "comment": "Malware payload (SnakeKeylogger)", "value": "e1a6743aaece9820ad3e93ebd97438ddc09d01d044862b1a7e4fc2ed6a119a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197220, "uuid": "8da8fc39-52d8-42d4-97e5-a67db5666690", "comment": "Malware payload (SnakeKeylogger)", "value": "2fbbafea9feff7692c4aad7cd94222dee2be4082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197220, "uuid": "40e39f49-6bc0-4490-8f20-9f6fa5e831f8", "comment": "Malware payload (SnakeKeylogger)", "value": "e329edd2766d795cc18e3bd7b6aa72f225de85f3b80fb13f47221b5adc85a16e21fe50b55d49cfdb088cc8afb1a069ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197220, "uuid": "92526b9b-38f9-47b2-a247-1e49023ecd5a", "value": "T144C44B243AFA501AF173EFA95FE475969AAFB6333B07E45D109103860723E41DEC163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197220, "uuid": "99d8ad7a-e97b-4707-a7fe-158bda844dc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197220, "uuid": "9d29c575-b45a-4aa5-9a1f-d8c8580a8bfc", "value": "12288:jPJXdAnyHjum4pjtj41AoQMdUrsrcPhrxqhq9f0BnrwoGPW/0GirGtT:jPJX29ATBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629197220, "uuid": "722bd9b4-4955-4746-a10b-6c77ad3ddb10", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629197220, "uuid": "d3cda450-a880-4f4f-9163-a7c3d37c988b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197220, "uuid": "510d62a4-9bb6-46f9-b0b1-c0cb3215e79a", "value": "SecuriteInfo.com.Trojan.Inject4.6572.7182.31665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f8991e-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198989, "uuid": "01fb91ed-69f3-40f7-91bf-bb09bb09719d", "comment": "Malware payload (Gafgyt)", "value": "0a103f93c6aa8706e01aeacd6d8128f6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198989, "uuid": "89cbd610-d744-4495-bb5b-1a79ba961d2e", "comment": "Malware payload (Gafgyt)", "value": "e1b93a0833555089497236b8eeff3aea4642c4ab00841b235a28f1ca38a3b1ed", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198989, "uuid": "c5aca736-5cae-4ae0-ba2f-85a4e8fdf19d", "comment": "Malware payload (Gafgyt)", "value": "04e849f1e1c4f7e29fb7b0bf32c74325d1c7b43e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198989, "uuid": "cc9e9e43-5859-4fa1-943c-c822d8bc5216", "comment": "Malware payload (Gafgyt)", "value": "32f725735f349f755e1c184c03d14162f8ae439e822043a0e7b6a291df6ce992b605fedafe44341af8a531f604fc1bfd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198989, "uuid": "ba7024fb-8b8a-4e6f-86c4-1c69a49defdf", "value": "T1D8E32A09EA408B57C1E2277AF7CB424933339B64B7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198989, "uuid": "49711e16-e610-4c5e-91a7-d3841fb72cee", "value": "3072:YuNaNpF4uVN++dkhnx8QennF4M/9OD4bNWkE1kmpwfvRQfZn:lNaNpF4+NChneQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198989, "uuid": "2b2a78b2-ff16-42bf-94a0-0e2125d6b638", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198989, "uuid": "1664090a-d060-42cd-bb28-2fbcffec68ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198989, "uuid": "cdb2e9e7-3bb0-4450-a804-6da2f168fbf9", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24741129-ff2e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629185921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185921, "uuid": "78ff060d-41c3-4c78-ab20-0cf5115be6ee", "comment": "Malware payload (Smoke Loader)", "value": "5a3f48ef51357ccf6352746a427405c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185921, "uuid": "e5ee6923-f1ab-47c8-8dae-8da7137967f6", "comment": "Malware payload (Smoke Loader)", "value": "e2d43fc86f7618129c5080262624122c8f391bccac80d1fcf5169794380855c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185921, "uuid": "c43fb897-c496-4a91-a818-94e323d65080", "comment": "Malware payload (Smoke Loader)", "value": "4bde92910d83a7115835d78d24ccfb521a5dc98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629185921, "uuid": "559bc553-17d2-45a3-b0fe-95e6c4464f19", "comment": "Malware payload (Smoke Loader)", "value": "da430c52b140c3a21e307b221566a299c4f8f59cac7a44dc77f564a0fe21c7c001705c5365b091830f3fc30ec4f402e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185921, "uuid": "25ac7a4c-d0fe-4a33-b97a-27a2fd305983", "value": "T1BC547C31B790C035E4B701F499B683BC643D7EB15B2460CBB2D52AEE26346E89D317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185921, "uuid": "37a9dc62-bb67-470e-b802-b6b1df0996a7", "value": "ef24e2f166ae9439e57f7d9921c9b1aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185921, "uuid": "32a066cf-d8e3-4481-a35f-00381314c2cb", "value": "6144:Ue0JYNqWEp71I+LamDbJN4knIGK69DcQTyFc+:+YcWEpxI+L70knIWDc1FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629185921, "uuid": "a9b46d69-b19d-4893-a875-afc94dc0f250", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629185921, "uuid": "9a65d79d-db1b-40bf-8035-e999052c3f13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629185921, "uuid": "f668c539-e841-4196-9753-6b723a346da2", "value": "5a3f48ef51357ccf6352746a427405c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f852ea-ff74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BlackMatter)", "timestamp": 1629215956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629215956, "uuid": "043e0c43-eff1-4ead-abe9-61790155d9e6", "comment": "Malware payload (BlackMatter)", "value": "3317daace715dc332622d883091cf68b", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629215956, "uuid": "55e72e09-afb9-4481-9c7b-2c3d51641de3", "comment": "Malware payload (BlackMatter)", "value": "e4fd947a781611c85ea2e5afa51b186de7f351026c28eb067ad70028acd72cda", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629215956, "uuid": "317da634-e224-4af1-8e91-fcea57b9e3ff", "comment": "Malware payload (BlackMatter)", "value": "02fa74523198ebc1db490bdc6f10a78a44c4e28b", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629215956, "uuid": "040bc94e-dae5-4a43-bcc5-a21822dcc675", "comment": "Malware payload (BlackMatter)", "value": "4a45fbd9e65d2df95041231f5b701dc618626c8b0cd5207fe512021502186deac636a0710f8cc0eb4c91e85f24471b22", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629215956, "uuid": "555bd732-57c3-4e2d-85fc-f62363ac9587", "value": "T16373491179A5D073E0765AB2BB0E79713BCD9D3D1C36644394D80F48EBA08631F2AE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629215956, "uuid": "c03be96d-2b92-4fcf-a1b7-168abe3799be", "value": "96c0c982709316e2c58b11a3c2b057ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629215956, "uuid": "c8d595f6-3d88-471e-ad53-789c1c90ca50", "value": "1536:BICS4AgxwhjEO3r825exqkHYnKeGsXqsMt:q2SN3mxYnKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629215956, "uuid": "c52c0779-1d1d-4cb1-9acf-295934da4e53", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629215956, "uuid": "2d8222d2-7243-426d-a9cd-6344785a4378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629215956, "uuid": "0d208604-f644-47de-98fa-d91ee95cc2bb", "value": "e4fd947a781611c85ea2e5afa51b186de7f351026c28eb067ad70028acd72cda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edd4527-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208701, "uuid": "9b72b319-1eed-4301-9ff4-86666e38177e", "comment": "Malware payload", "value": "07dedb8eee432a53b182ea8b2372ebce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208701, "uuid": "7ddc05a1-fe89-4411-b392-e8f472ef60f7", "comment": "Malware payload", "value": "e55d0fbfa96d9d2d0c90f7b09f26b2269cbc10b5955ebf923e9a4af501168f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208701, "uuid": "4241ceeb-be88-4cbf-8b4a-da5f7bdba4d4", "comment": "Malware payload", "value": "9a83fbe8eb988b14de77d1a34c259defddb3857f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208701, "uuid": "faf8e375-03b9-49bc-a673-d0839c49bfe5", "comment": "Malware payload", "value": "11bbb6103380a04adfbac5bc78f038200e6325cc037486079d2150aefe00f2fd43ad3c4f95dba773c3319fa9ecdcd7d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208701, "uuid": "24e6333d-502f-47a5-b620-41136cca2aa6", "value": "T1E3659D0F6E465D35C02121374F27ED75A52D7EA17C18A08F2BE1FB5F2A36BE6202191B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208701, "uuid": "128fa9c3-dc3a-4627-a777-82d0d8c765c8", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208701, "uuid": "d9484782-f54e-4a6e-8843-4efea6a07e19", "value": "24576:Wh4WI1DOj6P0hFORupCAzGbafRJVPledKPIddHlen0FIt:Cej+XGbafRJFleET0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208701, "uuid": "95b4d0a4-9496-466e-a7de-5624d1df56ef", "value": 1528034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208701, "uuid": "d04f8db5-cfe1-4246-8495-53b8a3050b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208701, "uuid": "517db079-ab07-4d80-bba0-80edc3b59ec2", "value": "Fwd PURCHASE REQUISITION 300321,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4c219d-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629206900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206900, "uuid": "3bc6553d-218c-456f-a157-10aee9f7cf4f", "comment": "Malware payload (AgentTesla)", "value": "6da38ab7fc60b8fb8a239275b344c7ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206900, "uuid": "3c60bd6c-32d9-4c40-92f8-2390849721ef", "comment": "Malware payload (AgentTesla)", "value": "e5774d5806b980a39e1a32ceaeacd606a7be35956709292cf4aa152988322f29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206900, "uuid": "4795c5df-d676-4b90-983d-c04cdee11964", "comment": "Malware payload (AgentTesla)", "value": "eb8ebaa21d9be474aa75b7cf0803a336a076629d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206900, "uuid": "7dd6524b-5e3b-46eb-aa3d-39f70dc9fe57", "comment": "Malware payload (AgentTesla)", "value": "41f93252c9e5bdac023a5e6fc1033eba7496241d924651f7b0fc40879b70270ac460d71a2841469945cba2a6ceb111ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206900, "uuid": "6fec73d0-d688-4836-aca6-38388ab2a504", "value": "T1B753B8BCC45706A88F86A7B82B1B6F45118C7A6EF3889672327C977467D5D3E901383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206900, "uuid": "9f0a23f1-d003-4eb0-9fda-0d5cfe297984", "value": "384:nxoXaaSJtU89oQQEU8mmN5EWRew+t5YmOCv9N0tjJjtZaWPrf:nxIC1D8i+zYmOY9N8ZEqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206900, "uuid": "a17d3fe9-bea4-4d3b-bee3-e8b0693f10c5", "value": 61087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206900, "uuid": "200ee644-3058-48e1-9841-239c6ea5877e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206900, "uuid": "c5aecb6a-f69f-4508-a21c-f041261f0cf7", "value": "PRO-INCREASE 17.08.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c84114-ff08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629169627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169627, "uuid": "98c62a4e-36a9-455e-83cd-bea5f331d88c", "comment": "Malware payload (Mirai)", "value": "1e3d65304b9916970a428ed9d4a050b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169627, "uuid": "d41dbcd0-0104-467b-b49e-dbbeab5cf767", "comment": "Malware payload (Mirai)", "value": "e5ae97b05a26773ba5972ce8b440e62b7cc24a22c364d92cac282b9a13af445e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169627, "uuid": "d25bad38-c633-4bf5-9cab-b702162dfef2", "comment": "Malware payload (Mirai)", "value": "bf92931eb3124c7c997335a5ad9ef116eec8be30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629169627, "uuid": "bf0753c3-c448-46b9-9995-cfeea33ba4f4", "comment": "Malware payload (Mirai)", "value": "16a3ddc5fea563fe2ab78c57b9669e3f78046164b1c63d447aadb2afa847a6de519905c47fbe6ae215fc72f1f37456fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169627, "uuid": "356185c0-1581-422d-bd97-db4ea57c7807", "value": "T14873D815FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169627, "uuid": "ba95901d-3dd0-40bd-9c06-5d8bb0a3fa0d", "value": "768:lqwATxpQ5e+y4rWC5YOZDSfqGcOee2etJeG67t/kWDrXilvo2KXZY10URn:lCTxq55OEDSfqX/74JVyt/HJ26a10e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629169627, "uuid": "f06dfddb-e549-45ca-b3e1-55f6690af213", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629169627, "uuid": "253127e5-9e5e-4ccb-9a58-4b3f3f6a0d3b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629169627, "uuid": "7bcaefcf-16fe-4b5b-9672-bb804f042856", "value": "1e3d65304b9916970a428ed9d4a050b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1b346a-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208670, "uuid": "3af028fe-3e2c-41c9-b7a8-3e0d90162573", "comment": "Malware payload", "value": "f79ca766e552be7c64a38634880d4083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208670, "uuid": "a411b8b4-61ab-4c66-828f-2fe3e943afba", "comment": "Malware payload", "value": "e6000c9255fd086dbb888a4b905915318140bfe6dd9dea9798c917b48b5c5c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208670, "uuid": "728b48d5-765c-4b44-b963-ab34be45c79e", "comment": "Malware payload", "value": "4e1482e33af06ee1d0e6363922f69ce1c0ecfa99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208670, "uuid": "5f9c90ac-c89b-433d-8cc8-ea30e7c408ac", "comment": "Malware payload", "value": "aa3385bf2bc112c084a2a32dc5c0c5fd6b2b7af3f5f5a996cb0c5e794290e1ed188f42f645d565fe33d2f2a324136922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208670, "uuid": "7b9bbb44-0b43-4b9a-8f3c-11f040e89221", "value": "T1C955FA3915B43A37E17EC379DEE44D0BE6D4B45B7A11AA16B0DE13670343A02B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208670, "uuid": "09ed1bb7-080d-4c8a-8bbb-7a219b940a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208670, "uuid": "d1fadf44-351f-4329-b8e1-1a770d2ac8d7", "value": "24576:RxMVqcIcOz/mMrQTNFnHY1i3VmNQCz2+UwxNMu9i0C2eAo:6SyByDpqgxyu9C2eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208670, "uuid": "21fb1b05-7c3d-48ef-9c38-70d99cdb43b5", "value": 1393152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208670, "uuid": "872612e7-1324-4b9f-a89d-8b789bc5675a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208670, "uuid": "97f6612d-bf09-49c0-b005-8a3bc1fbc4a2", "value": "PO-21-071101 \uacc4\uc57d\uc11c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d9707c-ff45-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629195808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195808, "uuid": "a303034f-2c88-47a4-b1dc-5034d1974a3d", "comment": "Malware payload (RemcosRAT)", "value": "c130f6f03ee5412ab19fa0e2e2c026d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195808, "uuid": "6a1131a0-af0a-4c3a-b97f-9fbba4427f5b", "comment": "Malware payload (RemcosRAT)", "value": "e683a2a2e01d79188c800e4b811c280e614a5d09fdca7c992fa45870eb95ddf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195808, "uuid": "01e99811-81ce-4fdf-bd64-9bda0c0bc19e", "comment": "Malware payload (RemcosRAT)", "value": "9a8420d2b639b2461acf631697754a1d2b6c1baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629195808, "uuid": "1c65078c-2422-4f14-8d7e-acf1430bef25", "comment": "Malware payload (RemcosRAT)", "value": "7e0fd43b6e4e33a0142262fa01feb0df0cb1fb8e21328904d734af0ea2787f1a76495f7c97760374361eb1f66d88ce2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195808, "uuid": "8a1a422c-978a-47f5-bd49-afa003a93c6d", "value": "T1F497D43D1BB825A7D165C23EABD18613F04096DB3511AA5764CA0FA7B306AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195808, "uuid": "f43725b7-7460-40a7-9165-fb0dba6e315a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195808, "uuid": "ec74c8df-da02-4885-b037-7a8078d662ac", "value": "12288:m2VsDc9F3nC0Py3gAhIEJbjJEKqvAZ07cRj7HftpYEuWZGCb7m2N551ZAfeNgaIP:XO27cx7HffYEfbvNTDi/awcTMGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629195808, "uuid": "8b6802e5-ad44-440b-881c-7440add5dd17", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629195808, "uuid": "471e68fa-ea70-4093-a2c9-0e15074e4d90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629195808, "uuid": "023a1597-78be-45f6-ac26-57d6e5323eae", "value": "IMG-20210406-DOC0302738YJ5452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f658d2-ff41-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629194137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194137, "uuid": "b7e54fee-e5a7-4547-8166-ef96eecacfa1", "comment": "Malware payload (Formbook)", "value": "33d6b64658d6d65330aa45e745a07378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194137, "uuid": "71171dbf-afed-40b4-830e-194d3f8bb4db", "comment": "Malware payload (Formbook)", "value": "e6d6ba31c6a493196ef6147ee975e41970f069ce9abd2b114c115891be4d37e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194137, "uuid": "2127757f-d671-40ac-a146-544845912bc5", "comment": "Malware payload (Formbook)", "value": "4aac1e207c9bbcd0959901557ed3da64b950a091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629194137, "uuid": "fbb4c05f-502f-49c9-9378-4752ca696d2a", "comment": "Malware payload (Formbook)", "value": "c004e5b332f0f9ce5fc22ca2b056a4863db8fd0fe76acc406b5164df364aa051852a83a88f64c338ff33d7f4ec4a823a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194137, "uuid": "a58e2000-7222-44da-87c0-695a2d137f39", "value": "T19525703C1BB825A7D165D63EABD18617F04096DB3411AA57A4CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194137, "uuid": "951034a5-2c50-45aa-8521-56600147a037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194137, "uuid": "c92c28aa-aed4-470b-b056-7e123dc81c0d", "value": "12288:mFODc9F3nC0Py3gAhqEJbjJEKQs+T7U/7y6cE3j2v4PhCmsKEHIMqQ+DoSnA6FnR:Is9zg4iv4P8msKEosshFnqYzZGv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629194137, "uuid": "242f3b2d-e9f8-4efd-8b46-703e384e33c7", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629194137, "uuid": "46fad452-3ae7-4a2d-a12e-02abb00bd7f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629194137, "uuid": "7b4bf612-65a5-44e9-a6a8-95adbf14e806", "value": "Invoice-309-Ref-284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85949eb7-ff39-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629190808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190808, "uuid": "f74214af-e71c-4a2b-bb46-dc1e14ba4089", "comment": "Malware payload (Mirai)", "value": "b359b5d61bee921df40436fd8d9e3b05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190808, "uuid": "fe8519cb-8135-410c-8d44-84a917d1f728", "comment": "Malware payload (Mirai)", "value": "e79c72ffb782ad67db24701a1c355aa0e631c2dc9671326f060183df86af4468", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190808, "uuid": "6cbd69b2-63e7-436b-8bdb-056e09284c80", "comment": "Malware payload (Mirai)", "value": "32238b2ecadb8d02292bab07abf3c2b6fda4f2df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190808, "uuid": "22fab27a-a6f4-4d3c-8346-6c7e3b9dbf21", "comment": "Malware payload (Mirai)", "value": "3302764ddc71c8364b1c7897ca1973b25dcc7a2e40f6fdfd84084ccde22f90157914a441a3b5ac308034e3d19ba0e2b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190808, "uuid": "b69233c3-4a01-4c30-9d81-c9d10857f07c", "value": "T122530747B44180FDC149D03447ABAA76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190808, "uuid": "b8f7fb8b-4586-492d-b3cb-4be633c29eb1", "value": "1536:anF9U0FferGtOW4/RWo4Qz8kkRqwghJOlQ5M7WR:0FK0UrUO3JWv9RqwgOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190808, "uuid": "7f891b0d-2821-4ccb-9965-3403f715ad3a", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190808, "uuid": "37e98fe5-4282-4eb0-91bd-a2150c5cf723", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190808, "uuid": "072e5b67-6a95-4300-b1c9-321d6bcce7fd", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557d365e-ff05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629168393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168393, "uuid": "4ca5c12f-da6f-4560-a172-3fcdfcf20e19", "comment": "Malware payload (Mirai)", "value": "3f357906c2b37a0d20205652da2d0b14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168393, "uuid": "bff57be0-591c-4d96-a535-7a32ea62d79e", "comment": "Malware payload (Mirai)", "value": "ea48b48b48395c7d3f71578e172191727b246c0c3fb1fd955cb66c29ed18890d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168393, "uuid": "b2f147c3-274a-4089-a0cf-6bcae13b3f50", "comment": "Malware payload (Mirai)", "value": "9c38d7253ac569c818f7d257048a56912f50131f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168393, "uuid": "351ce30b-0208-435e-8d3e-bdfbf0237eee", "comment": "Malware payload (Mirai)", "value": "cf6c5d4d4027aea0d20740b5d7a305ce6cf19960e47d09515afaa0d36e8d611d0fe32bab7b7fef601fe37a86f7fa9034", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168393, "uuid": "2a8686b2-6e62-418e-b82c-38232b859dc2", "value": "T155830946BC818E15C5D823BBF92E018D331667A8E2DFB223DD105F1077CA96F0EA7956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168393, "uuid": "8f876dd4-d0dc-4ba3-ba5b-6d9c9590345c", "value": "1536:ONnkZ3DFCqG2XYhMf9N14zs92URiHKwD7Nv6uV5cSGoz4IGipWgH/Cv:13DdGQYhMz2zsb4h7NbcMWgH/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629168393, "uuid": "9d008bc2-6d88-401f-b92d-5ec128ae473b", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629168393, "uuid": "459e30e8-3e2f-46a1-b9ff-1c4977410e4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168393, "uuid": "ce1bbda1-55a1-445a-a574-eddd05ad78c6", "value": "3f357906c2b37a0d20205652da2d0b14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8217f7-fef8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629162773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162773, "uuid": "56833963-564e-48af-b636-8de18810b49a", "comment": "Malware payload (Mirai)", "value": "b68c2d9a694f0a594a1433928cd44776", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162773, "uuid": "2611800b-d4b8-4ccb-83f4-9e399be92b76", "comment": "Malware payload (Mirai)", "value": "eacd3b62b45f51e14e24b62908783159bc04cd7cd81b27c83a0587bbf128e894", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162773, "uuid": "0e0f3a92-99d3-4e96-ab1b-c78655aac1b9", "comment": "Malware payload (Mirai)", "value": "f360347606bc13cb255b5e40e0768e5f00427f63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629162773, "uuid": "cb538591-6217-4be8-bbd6-f5eb9e70683c", "comment": "Malware payload (Mirai)", "value": "51c05fe1d8c9d61243dd2cad1fed49f6a3203c0868cbf8654ff97c3a38c6db42f31135d3782406afb1a379e9ac7d7723", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162773, "uuid": "3facaab1-a46f-47bb-9ad7-78e150702b71", "value": "T1D1E35C46EA808A03C4D5177ABAAF41493322E765D3DB73079D186FB43FC6B5E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162773, "uuid": "acbb6896-0ae0-413b-a7df-4768c2ea6e59", "value": "3072:ffWhzMmMCrpueHTnr/uScavdjKAU6XbuPmyLqlHVW+M/93gj:fuhzMLCrpueTr/uSFoAU6Xb7yeHVbM/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629162773, "uuid": "9dbc7c01-3e52-48cd-b9c0-32aa7a108ea7", "value": 146277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629162773, "uuid": "0dda96b3-a8a8-4357-a6d2-111eabcaffcd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629162773, "uuid": "c85c5702-6ee5-4697-a114-fd45407d4771", "value": "arm7-20210817-0112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bcb96e-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629209434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209434, "uuid": "cf998f40-0ca1-41d5-97f2-ad3cc5de47f4", "comment": "Malware payload (OskiStealer)", "value": "e11c3b1cc868bcac2b10f1e7739b2501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209434, "uuid": "a7069a01-e9f6-4267-bef1-f9884fe44175", "comment": "Malware payload (OskiStealer)", "value": "ead4fbb41f9237091a53a9c5be2b50c222f3a7fce542bc6bab7acd302405c508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209434, "uuid": "e94e20b4-c29b-4f25-b858-697e8e849d82", "comment": "Malware payload (OskiStealer)", "value": "9ac339112cc6fd56efa6026953004bb75bd76cc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209434, "uuid": "510d58a6-fa96-48b0-bc0b-6a1bf759d6fa", "comment": "Malware payload (OskiStealer)", "value": "3c3428540e54c8b4152322f6be5c3219c3dc6f54979cc689409947c9e59598c73ca49c016703557a56ac9aa82e8f617b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209434, "uuid": "fd055927-9583-4c44-bbdf-c25d29f226f1", "value": "T1D784BE30BA90C034F1F612F845BAA3B8692D7EB0973450CBA2E517EE5734AE5AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209434, "uuid": "51e53ed7-74cc-4904-a6ca-0d3745755913", "value": "6231284df767c21df684fd42b7674adb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209434, "uuid": "d645d9b5-74f7-4aa7-a34e-4eb99f4f95af", "value": "6144:d2VEppbDxzjl1+FEIHWknFDKYuzBXmrp22NHdsIfR6tbrIp40A4Dh:5pp31CFEIHbFWYEcrffsIfkbrQ4pyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209434, "uuid": "9884219f-df51-47dc-b6ec-2a305b504a5a", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209434, "uuid": "13253b36-80fc-43bd-90c9-1e9c8382dbf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209434, "uuid": "6e9f77e9-55d2-4c3f-ac2c-76a1e5db6aff", "value": "descriptions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477f3fcb-ff57-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629203589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203589, "uuid": "86ef5def-1d16-4d15-9d68-37865b15cb8c", "comment": "Malware payload (Gafgyt)", "value": "83fb83172f831069abef790cbac34bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203589, "uuid": "7ecf0cb1-ba25-48a8-b88e-10d1a03dd2ce", "comment": "Malware payload (Gafgyt)", "value": "eaffdc1f331b0d529bef594dd8f58b8892846a13b4d669d1de3dee6a0c305225", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203589, "uuid": "150b3466-6aaa-43b3-b173-19ef0bc291f8", "comment": "Malware payload (Gafgyt)", "value": "add8ff33e08656c3088f16b0f0647d09e66e98e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629203589, "uuid": "a1d478f1-1629-4afd-86be-c487773ee70c", "comment": "Malware payload (Gafgyt)", "value": "9287b114cc7f4050746e34452b3549464e636c2dca956f84b26f6b690c8f1abe7333e395f001380ec3d84addaab3b93c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203589, "uuid": "82330a2f-91d2-40d6-bb74-b2cf1cafa426", "value": "T17E734A47AD618FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203589, "uuid": "fef865cf-9ac2-4aec-9e08-0008bf6787b8", "value": "1536:kAMbedEfIKy1BABWWNxiEVN/C/3yzTN7mj9VqYLe8f26e:vAeefvyoWWF/w3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629203589, "uuid": "0a745b46-1bdf-482b-a4b2-abe4f96462a2", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629203589, "uuid": "379bba0a-7299-4190-ac79-632e905bf743", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629203589, "uuid": "27bf7ede-d465-4ca5-ba54-4975cc64482b", "value": "83fb83172f831069abef790cbac34bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cb53b9-ff2b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629184690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184690, "uuid": "c5727afe-d312-4cc9-b865-daa921e14478", "comment": "Malware payload (RedLineStealer)", "value": "31cc886455ab95fcd14e94eb6f6fd215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184690, "uuid": "902f03ea-6b70-4b0d-8936-07ff1ca4b58a", "comment": "Malware payload (RedLineStealer)", "value": "ebe93287268d23cb70e2fd54681eb5531315f39b8c5aeeed6c64de50d585978d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184690, "uuid": "0f33a602-0cea-4701-b0f8-5bf712777ed3", "comment": "Malware payload (RedLineStealer)", "value": "6f2ab15784b3ba813cf01297adde3956e84ee516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184690, "uuid": "119a93b2-6c41-4fbf-9cf3-256f8287f388", "comment": "Malware payload (RedLineStealer)", "value": "009ebe0be3fb54d68961955d8b8bf7870588f9fe4ace4460cf919b7cd7078af2c5ebf88130a4923009d0a52d2f8c6cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184690, "uuid": "22dae4aa-955f-4553-a1a6-cc45f1c31c87", "value": "T1DA749D30B690D435E5A702B45975A37C643DFEF05B25D0CBA2E52AEE1E342E8AD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184690, "uuid": "4eb4ab99-91a3-4067-aa54-ce945e7aacc8", "value": "ef24e2f166ae9439e57f7d9921c9b1aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184690, "uuid": "6e39883d-6df5-4f62-811e-fb502beab10c", "value": "6144:kmBXNWic6p/CCbcv0NbJVvUdBIQZJSRrDppkx8qmG:HXwic6lvbcs1UdBBJGDppg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184690, "uuid": "8426fb4d-34fe-484a-b6e9-9395fef1c485", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184690, "uuid": "e6b00824-af33-40db-8759-c3243bcb2295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184690, "uuid": "6bfefbf5-6fc2-4ed5-ae82-ee7a7e88f874", "value": "31cc886455ab95fcd14e94eb6f6fd215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6740267b-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629210084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210084, "uuid": "70686258-1812-4d16-aba1-414128b1ea35", "comment": "Malware payload (Formbook)", "value": "a3ab9dcf6e3ba0e1f026fcf4b18065a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210084, "uuid": "bf104839-ef8e-44cd-a5bc-9f2d42878609", "comment": "Malware payload (Formbook)", "value": "ecacac4e9f514e780ff7124b6fdd97251dcec9947d5815166b2b57d2a41ddf0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210084, "uuid": "62285fd9-3c4f-46cd-bf23-b8cf40eb95fd", "comment": "Malware payload (Formbook)", "value": "9dee0e59021d3092cdf34b9cdbebc582c304b33a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210084, "uuid": "89aac022-7cb8-46dd-9843-b5cd882d6d90", "comment": "Malware payload (Formbook)", "value": "291c7dfd5df57b2ff2b60f0b470c4a286bd5aebacc13d86084d21d5bdcd822db14638bfb9bc5c586bbbff1dfa9b9b82b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210084, "uuid": "3d4ccad5-b832-4e14-ab56-7c10a57bf76f", "value": "T153257F3D1BB825A7D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210084, "uuid": "b76b51eb-89af-4fbb-b60f-4c8def88cb14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210084, "uuid": "1aea847f-ce0c-404e-a19d-e46c021102d8", "value": "12288:2MZDc9F3nC0Py3gAhLEJbjJEKD0vO43bP9cvprU6I4F+d7PkP+Mj7m08Om5ME1Kc:I02y9chrNI4IdPuja04SEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210084, "uuid": "44c1f88d-40a7-45b8-84a2-5fc79e79ad78", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210084, "uuid": "0b481bba-5bf8-4968-8ede-b4b0793aea5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210084, "uuid": "4b38697a-eb49-4e95-8b20-abb452c70a7d", "value": "a3ab9dcf6e3ba0e1f026fcf4b18065a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099e5c4a-ff4b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629198331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198331, "uuid": "bcd29bc6-6c92-4fc5-8389-e424046e972b", "comment": "Malware payload (Dridex)", "value": "c9a7adc86cd87248057ee4b75a278cff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198331, "uuid": "173efd1a-8e2e-452f-a846-1e706124897f", "comment": "Malware payload (Dridex)", "value": "edac88f1e44206cad339a83b1c221e09682df23818ed4eade3b4bf25b0b07604", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198331, "uuid": "fa80aabf-fee9-44a0-b63c-d02ad2b98743", "comment": "Malware payload (Dridex)", "value": "02c6e611975f6bf7c92eefce50dc451a02c4fa25", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198331, "uuid": "b45b69f5-b42d-4755-87b7-5a5aa4b445df", "comment": "Malware payload (Dridex)", "value": "c4b3e7b0adc8dbe34b223d39150e03dd214067e72e766a58f05cc93f4c9637b24a40ebc51964f7a25f7b67e7ec7b87cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198331, "uuid": "ce79941c-75fe-4a62-b5d6-b05ebae97823", "value": "T19F54F1952E63D84CFE4F3D7C8CCE15786F98DCBE0A00266F22E1BA59DAE47D41D18492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198331, "uuid": "84e49a3c-3721-4904-949e-d09c520b2533", "value": "6144:SztZbAPPimNA/kjoitkwc+tIG08OATN2sgqtmsmpq+222XaSo3Q:ItZbAPDNAcM8IG08OAB2bw+WqS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198331, "uuid": "8364f327-187f-4379-8e47-29bcaa6f9180", "value": 279303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198331, "uuid": "fa325006-1b55-4bb4-9cbb-42966da69f89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198331, "uuid": "6fa08e4a-81c8-4f93-999e-74b3465ed9f5", "value": "Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_983055157.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a67a75b-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629210009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210009, "uuid": "8a4a34b1-1ab2-410c-801c-0d2289085156", "comment": "Malware payload (RedLineStealer)", "value": "8a4d2f2d7e151209a033238785392763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210009, "uuid": "7a3ebf7d-19a5-4a05-9352-cc00f9deee26", "comment": "Malware payload (RedLineStealer)", "value": "ee28b804071d9f6eefc2862e3773b896be7dc159cc37a29b9b9c4a61692701ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210009, "uuid": "9bd08526-2e03-4ddb-b220-81929f9e116a", "comment": "Malware payload (RedLineStealer)", "value": "3f666dd2bdef205c3a5884d192472da5f894fa18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210009, "uuid": "931fdaf1-7431-4711-99f6-d5e403b0ec3a", "comment": "Malware payload (RedLineStealer)", "value": "91b60c2de659ab00b2b178ea007bc41c8b58af71b46584b676d847065ff95d3d629b7bf7fb5cb3597632c50a805fe5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210009, "uuid": "abda71e5-68aa-43d6-9bc5-3e2fef66846e", "value": "T12774BF207690C035E5F751F4997A82BCA43CBDB05B2440CB62DAEAFE2A756D49C3079F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210009, "uuid": "93e81502-85eb-4d53-bc80-c4ffab1234bd", "value": "3cf7934f6b854bd488143a7d36a97eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210009, "uuid": "82ee0f6c-93d4-4794-9ef4-a3868c311da3", "value": "6144:bXgMYsqNBzy2a4Xb6h7oADN+ciSiILEdIf10Vn0ZCF/s40PnwHM9Ya:cMoNs2aK6dowbvj710V0Z6UTPwHM9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210009, "uuid": "a6fa9712-d014-4391-b511-fa34293e4cd4", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210009, "uuid": "c65ce247-ae77-4f14-aeea-6955470bfbd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210009, "uuid": "6f29f27a-82fa-47db-b71e-94f87eb64b04", "value": "8a4d2f2d7e151209a033238785392763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619d431c-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209216, "uuid": "39a7a61a-530e-4828-b86c-f3de8face4f6", "comment": "Malware payload (Formbook)", "value": "69e21ce49840d68d2eb691150fcb3c0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209216, "uuid": "5d814d9a-f9db-4007-8c42-d7c85458a4f1", "comment": "Malware payload (Formbook)", "value": "ee7768e5b15b6e83c04033a244e19f19cc63aecedbb01786edb6e15318a2a2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209216, "uuid": "b573fa3b-e70c-481a-ac25-2b616db33ab9", "comment": "Malware payload (Formbook)", "value": "c05b39f4271670f61250124583fe60f0ff774b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209216, "uuid": "bffa8f91-e545-49b9-ba5e-75cb4d239c2d", "comment": "Malware payload (Formbook)", "value": "db01834f6d8d6df973cd27592907cbf4672038377c310c62d4cd5ddc6defe703d51c381244c13ebc44a091d0ab325a7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209216, "uuid": "e1d007b0-5a53-4089-b433-d170d8ee0ed5", "value": "T15D94CF11A682DC36D7E3253A61F1D574293D6A321B4F1AFB139809BCFB741F1A930A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209216, "uuid": "9d4da528-14f8-45e7-bfb3-cdecaae0bab7", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209216, "uuid": "bc246afd-3655-4593-8f86-3f28beb1ae79", "value": "12288:M7ix/BYYUltDeUy1aM14NWzW0ep9sob3AMfP:M7ix/fUbJuaM14NQWjp9sobXfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209216, "uuid": "5f55e7fc-00ff-4e7c-b98a-629ef7684515", "value": 424104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209216, "uuid": "c6d87553-2ab9-47d4-8ee6-fd1964caecbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209216, "uuid": "08c70e45-12aa-4e2f-bd31-1a86b218d9ab", "value": "Roominglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a10295-ffb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629242782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242782, "uuid": "20800875-788e-4f93-9354-a5ac3b8b95b3", "comment": "Malware payload", "value": "e9e36181d5d60b337734db20fb97fdff", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242782, "uuid": "5e6e7044-cb1d-4960-b4c4-0bd750b12b0f", "comment": "Malware payload", "value": "eee98e5b88e109b24187ba51f7f8c1b2456ab6376e7d9ffcb8e7f48d1df30533", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242782, "uuid": "5e269b16-5ef4-4916-8de2-ecfdf800ce2e", "comment": "Malware payload", "value": "c84783e44cc2ae21944bd3538c25e6b2e27afe0d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242782, "uuid": "c597c406-afb5-4c6c-96d6-e197c0f185ff", "comment": "Malware payload", "value": "38e43861b19764acba685a2b5c7e1bdc1beb5ae45ff7553d4a2f688553f67f4988057bdcd33b20b52f1a35669967359b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242782, "uuid": "355f1d42-8798-41ba-b1a3-040564102575", "value": "T177E40CB495DF50A1F6AFC90126ECBE6401723187DBCA3E64537CE2105BE9FA63E0548E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242782, "uuid": "3c0cd4e9-f979-4ac1-b82c-2e76750a58a7", "value": "6144:b1ECy1HEPwSGWo5qjUv9DDfjTtpHouriMtJRHJ1kycFnYJzWwZOPV1LaXsetY:i1HPtpFJ2nYJzWwZOPV1LaXs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629242782, "uuid": "e773e85d-599e-451c-9ba1-d66bb7f7282a", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629242782, "uuid": "13a5bd3c-74b7-4f2c-bf9f-dfe3d156b903", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242782, "uuid": "54c2aadb-8fcd-47b7-a1e0-5e6747dc2b1e", "value": "SowpnTdb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350b0329-ff1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629178217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178217, "uuid": "8e01f0b4-8c43-4d1c-a7d7-f0fa57301560", "comment": "Malware payload (njrat)", "value": "3abd84055d546abcff98d0fcd3a58faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178217, "uuid": "6ee2a9a0-d92a-4da7-bce7-b1bea7fae0e0", "comment": "Malware payload (njrat)", "value": "ef5573e0dec582bcbc5d39db16be3623b7e335cd715679dba32e1b801386dcc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178217, "uuid": "2f361637-1f86-4dd6-9086-017344941621", "comment": "Malware payload (njrat)", "value": "73eda2858babe8d36ccd0defc05f9b27eb1c0311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629178217, "uuid": "8338c475-0fba-475a-89dc-41ceccb370a8", "comment": "Malware payload (njrat)", "value": "b34613b62cb0ad32fcd063d172c9698ffcc4b102440527cce3a4d37468d376e2990daf42911d9619dafbe250859eb0cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178217, "uuid": "bac347ca-ea70-46ec-b85d-59d24239c96b", "value": "T136E2D78F63988524C7BD537A4962434587F2AD475C93EB1E0CD87CED2F3B7404A8B1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178217, "uuid": "0335c385-e4ef-4015-924a-894ac4c12d57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178217, "uuid": "12892158-ae9d-4020-9b4a-63c4c70dc688", "value": "768:i3fyE3ZklKnyhlfKDmkyWVjHcrf/uzNIywb:i3fyE3Kl6SOyecLu2yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629178217, "uuid": "1f90a20e-8d5f-46d5-a871-86841b0bd3a0", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629178217, "uuid": "fbe8fc55-84d2-4dcd-802a-1dc946701089", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629178217, "uuid": "a8775383-531d-42ff-8e1d-a0e81b7a1305", "value": "Server.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d8a8aa-ffa9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629239014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629239014, "uuid": "74e7a72d-da59-4c80-b9ae-e1a93969e4a8", "comment": "Malware payload", "value": "dd56fcc8c60b93ff7292e1de873eaecc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629239014, "uuid": "5427c2b1-283a-405d-8166-0a03c68475d8", "comment": "Malware payload", "value": "f020ae19916f4c2ba2934163eb78f047a34068d9d28d2ab431d1aae7dc72b37b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629239014, "uuid": "9592d8f4-3e6f-41ad-ab24-18d207668662", "comment": "Malware payload", "value": "e3102ff909a130605115b6d75dbe20834c3137d8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629239014, "uuid": "85a11e3b-9be5-42fd-b1f8-6111a492cedf", "comment": "Malware payload", "value": "fb13fa98d233beef16415c41b722be7950053e45f246b976c40fc2436e7d60153ad8a4e02e27b9ad99dc1fc73ce5a0a8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629239014, "uuid": "49d2c670-bd5b-4257-ba88-410adc7a7fd9", "value": "T19CE52325BD9ED026D18FD831C151C997A414068E5404FA378A3BC588ACF3D8A9B1BFFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629239014, "uuid": "dd97e3b5-63f7-40ee-97c5-2340c6b3ffdb", "value": "49152:oGSYoXQOUj31d8FIfm0pg6MfFdqtjnjHlVtN4uWwtmJW2Lze37tQrgsm/NxfO:oG8gOa37lLS6MfFdq5lVH4koi7tQCN9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629239014, "uuid": "dd63ba84-b060-44e8-82b3-60989a97db0c", "value": 3212309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629239014, "uuid": "b403f5e6-b9c7-4587-926c-25ec9889dc49", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629239014, "uuid": "ed1106f3-09d9-439d-9456-b156f8236c9e", "value": "Update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b008c70-ff23-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629181395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181395, "uuid": "0f8d1b75-f4a8-4655-8f02-47fa93fed67e", "comment": "Malware payload (Loki)", "value": "566ab735a70217bdbbf017712ddd44a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181395, "uuid": "acce0dd1-13d1-4709-8f4e-331139fd797c", "comment": "Malware payload (Loki)", "value": "f0392c0072530a0fbb36542ab364e98512d222fb9074b11f553bf107a5e4dec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181395, "uuid": "5a0327f7-58ff-4eb1-8d65-6b3b6e4812f1", "comment": "Malware payload (Loki)", "value": "28df7c44a117a1abed38947cc14225834a6fb144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629181395, "uuid": "65cee31e-28f0-4d77-b76d-9ac26811066f", "comment": "Malware payload (Loki)", "value": "a165c33692f256a5bb690db1a7021829e2347a30d090e7e31a9bd945fdd053b9407509f07002f44a2fb507dd281364a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181395, "uuid": "516daf2f-6093-42d3-a6a7-6166167619ce", "value": "T173A4BF01B981D476C35248B2524FE7FB5C287B309D25CD8BE3645EE4FF329A1A628B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181395, "uuid": "8b812a37-c6a4-4da1-bdb6-012f4368e591", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181395, "uuid": "bbb7a84d-6342-44d1-ac29-0f9965debfa6", "value": "12288:U4TjArdJoQ2juTQV6z7LZ86nQ4/xveGvCjWi:U4TjArUfjuLLZ8t4/xvzvav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629181395, "uuid": "cee76ad6-d6b0-4319-b14b-4b10d4e95809", "value": 465042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629181395, "uuid": "8440d2b4-85e4-4a78-98b5-f7c13f1fcaa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629181395, "uuid": "aa3727e4-50cd-4dcb-b8fe-dc4e0288cb1f", "value": "izzu file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d201f55c-ffb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629242905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242905, "uuid": "6c244c73-9195-465c-ba20-239068de8463", "comment": "Malware payload", "value": "8696a6256cb49aa1527d74f175346594", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242905, "uuid": "0ba1e2ab-e6f3-401e-8745-25164d2b1c0b", "comment": "Malware payload", "value": "f10541d934aa04fdd82839b1d1767489191fcecc6026ca5e12a19e9c84562b19", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242905, "uuid": "ef5b3373-2d52-4c7a-a918-dea38778a749", "comment": "Malware payload", "value": "7ff732a7361234eef8b340816cdd782d21c84c53", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629242905, "uuid": "13639244-7b7e-4112-935e-ddf5058045ef", "comment": "Malware payload", "value": "0de64dce3576c1705d4da6bbd02753ce586858b54c2735a944756a79fbf77b0f4c722f48d37b2875e127fe11b804955d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Confucius", "colour": "#9E6C98", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242905, "uuid": "b371fb54-8526-4aa1-a829-13c067acadb4", "value": "T10AC19514B3E80632FCBF4F739D93A3811378B759AE13DA6F5884A1176C162140A71BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242905, "uuid": "2d31f5bf-e035-4e01-965b-e706652d2266", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242905, "uuid": "66127914-834a-40ac-b2af-a86db56ffd4f", "value": "96:O7CXzzua41/7p35TnqmaVJIJGI9gnAmoWs5C7atjyBb7:OszCa4N7p35bqPV2Jf9fPwatjyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629242905, "uuid": "09ebc7db-0979-4a2f-a5ab-b9df37ec49b5", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629242905, "uuid": "4d6534b2-a857-43fb-80bc-6ea70baea8d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629242905, "uuid": "5fffd3a2-c49a-4fce-8e9b-6fa5361092d3", "value": "Msdjkfh.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a59a68-ff37-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629190088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190088, "uuid": "e0332a05-bc1f-408e-bac6-2de6f5f8cf12", "comment": "Malware payload", "value": "dea2a4e91e8e1e437d1a5370822654dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190088, "uuid": "5fc5e99f-99c7-4800-9c73-4f36d0772786", "comment": "Malware payload", "value": "f1cadd1d86535e516020ad2445dcd78daea6398629956003cded204f506b401f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190088, "uuid": "d140fd33-f56d-4db5-84e0-7c890ed16b3e", "comment": "Malware payload", "value": "1de5ebdfa556199f466f2d79f7931b23c14bcbc7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190088, "uuid": "2c396f32-9f2c-429d-8f75-9be8cf95ab28", "comment": "Malware payload", "value": "39f591a0df9eff5dbad0eb3589b5ea429e2e9281c21b0395e27e81b1f685ad35f5db153a0243bc82e4459c1f1f5a8da1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190088, "uuid": "7afa3c08-29b8-488d-8c6a-9a058e643267", "value": "T16643726DC0A706A88F89ABF4372B9F4614CEB66EF385A533713897301BE5D76401297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190088, "uuid": "8bd88f3e-6e26-4194-af92-56276a8f5866", "value": "384:nG6HWMA/WvFod06JaqPsNzV78IiJj9nCvwCY0t7pY:nq/0s9WV7NpvXt7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190088, "uuid": "3d528e9c-1f3b-4afb-92bb-8bfa2804359f", "value": 59558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190088, "uuid": "8c0ef604-06e8-4dd8-981c-97dec3f7e485", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190088, "uuid": "589e9995-a354-433d-9b42-089ed64be98f", "value": "P.O\ufffd6576invo.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e4ccaf-ff5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629206478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206478, "uuid": "55aa2dfe-3eaa-43e5-a483-b53ffb337e26", "comment": "Malware payload", "value": "86255e186d21c74c14693a644dce28a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206478, "uuid": "e164266a-5eff-46f7-ba0d-a016972ab891", "comment": "Malware payload", "value": "f2d27ce8d345c73931ceae72ca3100eda4481545a6e7d584bc20d19193dca2c0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206478, "uuid": "82d2b03d-e423-4195-89b4-c9f5aebed1b5", "comment": "Malware payload", "value": "d4177a60f4884035258c7de621d3c3ec9421e282", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629206478, "uuid": "4a1d5f5b-6a4a-4b14-9519-81d37f4be727", "comment": "Malware payload", "value": "64b7b421bb91a12a885149f4e890b13ef985c4038237302be26e52f52719f457f6f58618e82d0db9b884687ba0b44222", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206478, "uuid": "eadc87d0-07c9-479f-89e7-9254f6a46bec", "value": "T1AC226D28D553B807D116087CE16582F4E32E9023B752BD7A1415B2EE4B613D347CEEFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206478, "uuid": "68c82d2e-0ff8-403c-842f-60e270a5d961", "value": "192:ScIMmtP12G/bWvsq2VwO1KrdlJFOyX3OR:SPXjmx2KO8jJFlnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629206478, "uuid": "4ac3e223-d815-49b4-8f11-46f050c0e1aa", "value": 10334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629206478, "uuid": "d553931b-b705-4c3c-b306-7ff836e591da", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629206478, "uuid": "1552d5a4-5987-4fdf-a62b-1ea4a63989cc", "value": "TT082112.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a6f49-ff2a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629184154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184154, "uuid": "7ccab791-d716-4bcf-9def-29f96ce47bc6", "comment": "Malware payload (ArkeiStealer)", "value": "d2f2203a348e0b1d549d36756d3f3b29", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184154, "uuid": "c6c79c8e-37f5-4a40-aa3b-409075726e5e", "comment": "Malware payload (ArkeiStealer)", "value": "f319ebc542a9c29b6d77257de754ee490daaa152631214419bdfd9cdfbd08b49", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184154, "uuid": "9655c8ca-7934-4bd6-8137-532ad0cf8f7b", "comment": "Malware payload (ArkeiStealer)", "value": "55bdadf0c9951d57edd0f9779d144edbd4eaacfa", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184154, "uuid": "c7e8e7c5-d787-4879-a5e4-cd2bd4df25e2", "comment": "Malware payload (ArkeiStealer)", "value": "1e8af688856cc8443ac82621a871ba244138ad1d822d9c8fae85a3bcf5bf7c0abdaf960d359dd0debb70dc25618ad18a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184154, "uuid": "3a19e1e8-7c57-4f8c-bc84-53efdd814239", "value": "T1C814D026B9B2D67ED4A2023444A6F6E05969FC31E660451F37983E6F5F703C0532B36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184154, "uuid": "cc9163dd-2732-4bd6-81e0-be4c6de64cbc", "value": "477c037bd85187d535326c948fa8e5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184154, "uuid": "1cee6e51-0eb9-4b01-bab6-8374774f945e", "value": "3072:gAKkKR9aM9UA0v9A/DKBExrcCzBN2GRgQuKT0yB3cPOko6A6:g+KnazLEJciTlio6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184154, "uuid": "b5da4682-fc20-42dd-81cb-554ac5273200", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184154, "uuid": "051275b3-3fcb-47d9-90b5-72cca49239c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184154, "uuid": "c38eabe0-d208-41a7-b79c-dadcb07145f3", "value": "d2f2203a348e0b1d549d36756d3f3b29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab98428-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209016, "uuid": "9accf7e3-15bb-4422-8c47-827ad98839d6", "comment": "Malware payload (AgentTesla)", "value": "c155211357a9bc33558df29df890b144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209016, "uuid": "7a561440-78ab-488e-91e9-bd6ea668872f", "comment": "Malware payload (AgentTesla)", "value": "f344867661283f2c9ebdb803975b696d4cb6d79e301149b4b89e1005db76c497", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209016, "uuid": "7ff1c2b6-572c-4b49-9538-fe072266f5a4", "comment": "Malware payload (AgentTesla)", "value": "7c1fac2d070d19d04b59ea6c29534d7edb2ae91f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209016, "uuid": "37b5335e-8342-4c9b-a1b4-6fe25d65d5a3", "comment": "Malware payload (AgentTesla)", "value": "559f2acd32ee0585e591ea9508acba86702e53c174910448a69971995d4e47617674ed03bac5d0cc47880d094407eb94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209016, "uuid": "963104c9-3ee5-4a9b-8cfb-167f5bf63de5", "value": "T1B42570381BB92567D065D63EABD18617F04096DF3411AA57A4CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209016, "uuid": "301ee9de-76c9-4dec-a9ff-d87463d09c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209016, "uuid": "a75fa7cb-ba1a-472e-8f6a-4d6beb563b0f", "value": "12288:+3Dc9F3nC0Py3gAh1EJbjJEKcbtlFxQtzEpTYDCtvyKV/oNu9K61HFgFoI9RH520:StDAYpce7V/dbH6oIT5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209016, "uuid": "3fa0d9bd-7c69-4c6f-a7e3-1b5f7602ca51", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209016, "uuid": "76f47245-4cb0-4bb7-99f1-69948b515f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209016, "uuid": "0575c0b5-ab9b-435b-bb94-1a7cf16f1aba", "value": "ChemReq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619695cc-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629198908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198908, "uuid": "38184cb0-51a3-47d2-9cd4-03f05c1f3e3e", "comment": "Malware payload (Formbook)", "value": "78f9e1c763b6122770edb91f36d509c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198908, "uuid": "d90e3b53-f754-4886-a9da-d4eb1379ef39", "comment": "Malware payload (Formbook)", "value": "f37a8771594f5f11d6ce79551120f5d5c74ed90ae6372b98724864f07023cc34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198908, "uuid": "10bf78ee-a905-4983-b8fb-8bcd51e38b55", "comment": "Malware payload (Formbook)", "value": "c2c0b6ce921cc93b3f8f8f4d4631a7778433d1d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198908, "uuid": "4f644cb9-f5de-4927-a59e-00c5cf20b966", "comment": "Malware payload (Formbook)", "value": "4b0cde01d290ddafe7530d1478e12443f38a77fa016f353acdf425ec27b2d8158fdfa6b20306b1c220f88b8d45e1884e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198908, "uuid": "16d08bef-286b-4921-a3b5-2a9a1b503ca1", "value": "T1A945E83915B82B27E079E365E6E45407B3E0A85FB225ED59BCCA43E70206F4265C373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198908, "uuid": "964af74b-066c-479c-9e32-a9a1651a399d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198908, "uuid": "9ac2a57e-f921-462b-92a2-b919e8ed3717", "value": "12288:YaBSkmH0DD1CPFYJDc9F3nC0Py3gAhfIIalhBTT0HFNQzPsbRxHJrvln7yP7QcvC:Ymmg8PFYkblhBTT0HIPsdpJTJWz1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198908, "uuid": "6c7b7034-df2f-425a-9840-5a0519566274", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198908, "uuid": "cbf3a1e3-d7fb-4a16-8b3c-cb861b8d351e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198908, "uuid": "4396d183-bc08-42fb-8d08-bdeb0bcf6a2d", "value": "78f9e1c763b6122770edb91f36d509c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b6f361-ff38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629190320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190320, "uuid": "d910a180-8abe-4302-9657-f1cfc48493ca", "comment": "Malware payload (NanoCore)", "value": "1f90419cec4147fa32d17f3c30a3fa3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190320, "uuid": "2962e179-10d9-41e4-8241-aba73f424ba8", "comment": "Malware payload (NanoCore)", "value": "f4236b44c0b2ece0fb939f9011e3e30c400ad359432155f23afbe5a6c3e97f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190320, "uuid": "b390acd9-d7f9-42dc-b3a3-3c3cbaad144f", "comment": "Malware payload (NanoCore)", "value": "5460ee1445a73d0c9dd69890a0f0e571b14432c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629190320, "uuid": "4977d1fb-0927-4a62-ba71-3533568cf93b", "comment": "Malware payload (NanoCore)", "value": "c219c9e361c6a97c7d267fc87d8ba8bd25a0933b5a5944e8a52c75295caaffbebebcc9b7dfa4c9219924ccb544e1f1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190320, "uuid": "7bdf9d78-9c21-47ab-b851-f29c1c705b91", "value": "T1382581381BB92667D065D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190320, "uuid": "e2cd8839-2ce3-401a-bd6e-e93dcf2b1ab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190320, "uuid": "07d59dbd-0658-4438-b56f-c9d723a7ff32", "value": "12288:dTuOgss4Dc9F3nC0Py3gAhzEJbjJEKps6yB9djexkkpUuK8c2qA0YQnObQibLCTq:44B9sxkkquXc2UnmLiWJ3JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629190320, "uuid": "2ddba4a2-a784-47ed-98d0-7f552329f345", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629190320, "uuid": "8b43b8ad-dfc0-408e-912d-e0d978a4d6ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629190320, "uuid": "fa54c459-150b-4960-a6c2-9b9f873a3af5", "value": "1f90419cec4147fa32d17f3c30a3fa3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba34014-ff2b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629184805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184805, "uuid": "67571c39-f7fc-410c-a879-20bbd49e7686", "comment": "Malware payload (Formbook)", "value": "6ed87aec021b3fb313ccb925de4985b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184805, "uuid": "3700cd88-14f1-49ff-b97d-43bbe8ea7cd5", "comment": "Malware payload (Formbook)", "value": "f514071342a4576d842e3921ee377ee167fff4820e26d0bc05639600e332d440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184805, "uuid": "968e3baf-6000-4347-afb9-46c3cd0fddab", "comment": "Malware payload (Formbook)", "value": "37c2548cc65de7a8d6bec900c23900ee1c9ba8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629184805, "uuid": "fd643fdf-5113-48e0-9283-9540dbff6b60", "comment": "Malware payload (Formbook)", "value": "6f428b113ec51e8a06f2085a06d9b242dfe9d3f1ef6faf969b59230095bd82e5d3aef2de21911aff90ea4cb3d3c1521e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184805, "uuid": "1860a56f-1a47-478b-a0aa-530d16d6ee33", "value": "T10A55F97815B8293BF17BC339DEE4480BE2D9B45B7211BE1670D617670703A02B9A367E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184805, "uuid": "24931b05-e8dc-4dab-b7d2-d2d296831d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184805, "uuid": "128d36a0-8676-4cc2-970a-14674363b60b", "value": "24576:ts1AdGc0cezErp9rZHRDaFn96+F9uHWRWoJebGb4RSLEJOed:l7mBViqWzbGbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629184805, "uuid": "90f0a187-795a-4e8f-a35a-134453f6ec85", "value": 1371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629184805, "uuid": "0d34e89b-75a2-4f4a-908d-5393df9999ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629184805, "uuid": "812be3c9-8ef3-41f2-b759-618f2aedc7bc", "value": "6ed87aec021b3fb313ccb925de4985b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7737f1f-fef2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629160505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160505, "uuid": "2dc434af-eb92-4bfc-a66e-bce13b7f4f62", "comment": "Malware payload (Dridex)", "value": "68dfe6f31d54e1a8110d879097cf0896", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160505, "uuid": "cdc96bc2-05cf-4fba-be20-27318a4f2fa1", "comment": "Malware payload (Dridex)", "value": "f5629297c6f90f054181e0fc5fdb17c67712188ddcde2642ce684d6d7d04341d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160505, "uuid": "d082ed6d-e540-487a-a9a7-5c4f31957a17", "comment": "Malware payload (Dridex)", "value": "a07b9154fe04606ba44b0a750c4d22b9bc099cd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629160505, "uuid": "74bcbcb9-dc93-4677-8c59-fe061a51cda9", "comment": "Malware payload (Dridex)", "value": "f8238dee62297ed53fc84b29c1f5be04d1b39307163d702e76db963f04eb4317585bae89bc28f557af6f1610ce1209f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160505, "uuid": "b8b5be09-cc66-46fa-a69e-78c157374ea1", "value": "T14B140227FC595D43C28CD3FEBE132A94034B7501E709B5DA54B62EAEAF0843156FA09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160505, "uuid": "5e8513e8-45c2-4fe2-b78d-20069f6d52d5", "value": "3072:3J/ogkBdPxNLhEA7lZng3C1MV1ggxqOeuqqkFy7dU6QOQ4bZaj26hV/fif:JogkLjLhEALgKw1gxNGkFqdUQ3bZU2mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629160505, "uuid": "a9cc9688-9114-45af-b130-ff27143b7455", "value": 207722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629160505, "uuid": "9a049289-2283-4d4f-8992-35997e1971a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629160505, "uuid": "fcee1082-799f-4da4-930e-d17e0f90e66f", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.16132.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d48d5b-ff1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629177415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177415, "uuid": "9aead7e3-8b0c-4e2b-a110-7316520eea46", "comment": "Malware payload", "value": "5517a5a24eb90ec623923f8c8ec5541d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177415, "uuid": "9ad0ff4b-867f-49b8-8ffb-0c12abbee66d", "comment": "Malware payload", "value": "f56ecbfb3ff67a82d23b8ddfa5f8cb46fc23b429056e02abddf30bff0630ec29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177415, "uuid": "033e45a8-7956-4b2b-a212-11639871d822", "comment": "Malware payload", "value": "7e802c60004b1ea1227e8f8734d5794c244eff39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629177415, "uuid": "6b9e1209-a256-4b9a-979d-3ea2791e4b7b", "comment": "Malware payload", "value": "3b6a555e01ea18b8c3b9a25c8df8dc3c608ba347130b57328373969d0e92a5c8d52cb3a6e2be02ec249b9afd5e50b62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177415, "uuid": "895599d8-965b-43d9-8984-18236dc3da31", "value": "T1DF55D83819743A37E179C339DEE54C1BF6DCF45B7621AA6A70DA13670202A01B9D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177415, "uuid": "8853e9c4-01c7-4bd0-aa91-3783130c41ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177415, "uuid": "3774dcc6-e124-429c-bf7b-4cdcf775e2d3", "value": "24576:RBQgocqc2zqAlFnHMTXcTRiPVFY/5tMZNvrFrMVtQ:KBmtPDY5tMbBIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629177415, "uuid": "63cc6c73-3913-4ab9-9f1c-3d3926d41892", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629177415, "uuid": "69c8edf6-18fe-4180-a1dc-598877619db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629177415, "uuid": "c95caef6-4646-42da-b203-a7ba5ddd2ac4", "value": "REMMITANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f24102-ff3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629191825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191825, "uuid": "df8fc304-de26-485a-bc04-53a5acf503f2", "comment": "Malware payload (OskiStealer)", "value": "8c7c82469de5aacc1025699b79718847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191825, "uuid": "8c0a40ea-a04b-40e0-86e7-3dd459b61502", "comment": "Malware payload (OskiStealer)", "value": "f5abfba489bfcef9819f0ca20cd54efc779d6091f6462b6083c363636739f41b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191825, "uuid": "c9556286-788d-4044-9c04-4fb758f1b37f", "comment": "Malware payload (OskiStealer)", "value": "46d38208bc64db83dc306d05870675f3b4208389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629191825, "uuid": "c7f85153-28e0-4d06-8c59-d63c4d30eb7a", "comment": "Malware payload (OskiStealer)", "value": "cc9c44bd525f032333ce39c090480b3ec7cac03ba2103062ece6aa8eb5aa2a44485ad20b4708533c14950794962775d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191825, "uuid": "496f02f5-0741-4ed6-b426-197416ef6dbb", "value": "T10B2581391B7826A7D065D63EABD18613F04096DF3411AA5764CA0FA7B302AD2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191825, "uuid": "63ee41aa-0a59-4c14-b9a8-44188fd74c92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191825, "uuid": "2ae42ad7-af6b-4753-bf4f-d30b87991ecf", "value": "12288:3d5HEJbjJEKY+WddGJHbhfqO+sGxVgtdsTe6czZuGmSsPJcEljysDc9F3nC0Py3x:9Nm9rZP6MQ/Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629191825, "uuid": "48d3be28-b637-4f24-a5d2-991e830c6e77", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629191825, "uuid": "dcc1135d-3d85-4b7f-9b38-6ef0b77995f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629191825, "uuid": "93bb2c16-eded-4feb-ba83-db507b532aab", "value": "Dubia Order_PO74555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31e3faa-ff66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629210212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210212, "uuid": "8a059755-9e01-49b4-ad91-5f561ae2eeb3", "comment": "Malware payload (TrickBot)", "value": "a1104313fa872266a6b482a2dd28d2cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210212, "uuid": "a5d33d27-0c40-4040-bcdb-491746f9f57c", "comment": "Malware payload (TrickBot)", "value": "f60d8bd3ca821e7de945f17d646654b7c0f25949aa8c6f780313925076444fc2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210212, "uuid": "1cb4699f-ba4f-4c44-8bcb-becf64b45320", "comment": "Malware payload (TrickBot)", "value": "324c0a4a1c935ea2516510befda8211b2d384c81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629210212, "uuid": "969c5187-5d52-4364-b2c4-1dd71bf25d46", "comment": "Malware payload (TrickBot)", "value": "be184a6cf6950eb2ae263700e7ebd09753f75c7bc71b983d799dc4b528d66c2ae2e3affd1c2f60e7a63d7bd224efd025", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210212, "uuid": "40a21fdf-b396-4f77-b3ad-c4604a485870", "value": "T1F4E4E051FAD1C077C2AE06302F527BB967F9ECA16EB5D507E744F78F0E32941462A222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210212, "uuid": "dbfc0588-7e32-410e-b895-1e1eff92911b", "value": "0293ee5688b0a5f1cbe136d065e99917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210212, "uuid": "b50e1447-3741-48b9-842a-924018bfc0a5", "value": "12288:zbxfY510CzWwF0quExYmSN+oBdFZEMgIeZxs7WNJaX6FAx:96WwWquEiJdBdUIFbX0Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629210212, "uuid": "d362d190-db55-4e4d-879c-a7b1dcf1e31e", "value": 716851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629210212, "uuid": "6b88c276-fc1e-4791-be2e-f3379ca0d7fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629210212, "uuid": "31ffb6c9-863d-40cb-aa27-52bdd6318b25", "value": "a1104313fa872266a6b482a2dd28d2cd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3b2a2b-ff60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629207761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207761, "uuid": "a2107f3a-8c84-4fef-a195-16728be61a02", "comment": "Malware payload (TrickBot)", "value": "a38c312063725e7d2e7966227ffbbde5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207761, "uuid": "ecd15a84-1e08-4ca7-9b91-53206be34e46", "comment": "Malware payload (TrickBot)", "value": "f6a4af73637cba42f841b3934c6057e39290ad53a3b669b783f0958556680b06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207761, "uuid": "0e1b09be-8f86-4172-8a78-7356d7d197c5", "comment": "Malware payload (TrickBot)", "value": "574a1dbaf59ae229940b2259015466ce994d742c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629207761, "uuid": "e6801b19-e7f5-482b-9b05-495622009d0c", "comment": "Malware payload (TrickBot)", "value": "eaf7a2ad87e061a249550d086ef9bed66cb6b5b3e989fb7e92644f8a6599509950af035d7bc6c3e66d5e81e3afe91817", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob123", "colour": "#DDC935", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207761, "uuid": "80432574-f331-44a5-846a-5a49ce22fda4", "value": "T1B0F392D473C0D05366CD1B93FF057EE9E07AA876A5C8A203869876DD24BE147C2B4EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207761, "uuid": "ee644b9a-f3f4-4f07-bfe7-711814bba32b", "value": "3072:33eP3133URRJsiiEKk+RmyPdZAo702bSNyFZjgAD5dTiHLflsaooPptBchehiGv4:33eP39PR5dTirOaooBfEehiXVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629207761, "uuid": "aa376303-9407-4f3d-9000-217a453121f0", "value": 161004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629207761, "uuid": "3006c7a9-311b-429f-a6cb-27ac2b53e8d8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629207761, "uuid": "71eed515-cef1-4fe2-8cad-f465cfd75199", "value": "6171 - Copy (1481).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd414cf5-ff6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629212806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212806, "uuid": "9821de59-3059-4123-9649-861492d2bd89", "comment": "Malware payload (Mirai)", "value": "6940ed64b7b3a70fb6235c48b8bf446d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212806, "uuid": "153572e3-a8e8-4396-b241-da6d30528e4d", "comment": "Malware payload (Mirai)", "value": "f6bfcb8ffb443f6687a7f37e5965f8fd28fc0f71dc0142836dc60510e58cf545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212806, "uuid": "e44b374d-0d3c-41e1-ad94-fd18ecc6349d", "comment": "Malware payload (Mirai)", "value": "5ad54be6121706e083dd62228570e8b8348936d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629212806, "uuid": "06c26cf5-0d54-4270-80c3-f4037291da7e", "comment": "Malware payload (Mirai)", "value": "ab03a039cc1ab776ac682f67a845485a94ecac6f5ac37d217b63d3637d6f66f6bc5d78429e94869c4f46bca5a32df2cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212806, "uuid": "072a175c-6aa4-40bc-b3eb-357252bdc25e", "value": "T1CDC31A05FD404B27C7E227BAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212806, "uuid": "76d5ddba-b3dd-4786-b622-8be3f6afb088", "value": "3072:SJDZ+6lJQTnoo3DKOzmGfcX5X5hLuhu+6+1AzfqojwQQRh6RYAvZR:RmGa5X5hLuhucojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629212806, "uuid": "a6e26492-7817-448c-9b15-21bf51a86dd6", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629212806, "uuid": "205567b7-30b4-416f-b96d-84186f208f59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629212806, "uuid": "e9f03e51-c3a4-4ff9-be52-0fb51714063f", "value": "6940ed64b7b3a70fb6235c48b8bf446d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6607bed-ff93-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629229571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229571, "uuid": "4bfdce67-36af-4946-8e3d-bb86a581c2cf", "comment": "Malware payload", "value": "279a4ba41e455c31d1b00403ea8c5de1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229571, "uuid": "3cf30bef-ca7a-4bd7-96da-ef10d6dfa7e0", "comment": "Malware payload", "value": "f77e4fa75a8fe4af5b59b5c85ba46fa54b7ae232b410899aaee610a7e3f643d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229571, "uuid": "3405fb5f-ab16-4562-8156-374e85450c09", "comment": "Malware payload", "value": "4c1891c37b5a381562f4e056f44f4516d32bc35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629229571, "uuid": "18425a58-0923-467a-9b40-11684c734ad3", "comment": "Malware payload", "value": "5d90ff2c560406499463c7beb259984870f5e58cb11a44dab91e36ffc46c1e795e157770bb6fa4184c232a84e6d969a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229571, "uuid": "4df5708d-86e0-4c15-935d-f175a4df2a7c", "value": "T1CD05E53C19B93A27E0BAD765EBE18817B050D49F3521AD99A8DE03A70703A5375C733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229571, "uuid": "978e097c-7a4e-457e-a253-0f1236e0b824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229571, "uuid": "326ce057-5541-4fca-bfa2-904d221d445a", "value": "24576:Su2EYLp4JiPMsJA6ugMa88yM9rcinwQWQ2:L2D44FJKgz88FmiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629229571, "uuid": "10366169-4486-4daf-8ad7-48345f529e4e", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629229571, "uuid": "f5b0eda5-f9fe-4cf1-bf63-0933e0456893", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629229571, "uuid": "67f0e5b8-753f-4af1-89dc-4490775af89e", "value": "Invoice-309-Ref-284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962806d5-ff4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629199426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199426, "uuid": "e7ebd9d5-d408-4575-bdfa-2be005e4f579", "comment": "Malware payload (Formbook)", "value": "c214d0b61db999dfc6cd3090dab26711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199426, "uuid": "5a8a8a1e-8ccd-4d29-8356-0ada2bd2b87a", "comment": "Malware payload (Formbook)", "value": "f7f5dc4483ba1acdb1e2118ac855a9d4c0b7333749808a11ae69c6e345cdaf6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199426, "uuid": "045fa648-7f57-420e-bfda-e3055e284a14", "comment": "Malware payload (Formbook)", "value": "5e3f9bb2c41b7d827d46f36ec08951588ceced2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629199426, "uuid": "da12d345-d9f7-40a5-aeae-361e09a43ee3", "comment": "Malware payload (Formbook)", "value": "e1066c3055342ef16f790d6371d24d7c349d4921e72f738fbb0f85bb88622eb09455ce79434dd4db5f8a4a39c5942d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199426, "uuid": "4983c7d6-4cc4-4ef0-81ac-10407e097618", "value": "T1EC2560381BB92667D065D63EABD18617F04096DF3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199426, "uuid": "d531f5dc-e4de-4d5a-94ee-c83a460b85da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199426, "uuid": "78657045-d800-4535-91c6-a820950b39d0", "value": "24576:7Z7LAvpruFDSOZuOYS32qpR2DOi6rs3DDfw:JAxCFeOPYSGqp8DLE+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629199426, "uuid": "f6a33938-15c1-4ee5-a1a4-01411dfe7bb8", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629199426, "uuid": "4a155387-c319-4959-b6c4-df878f5dc591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629199426, "uuid": "1c4d784b-da28-4e8f-9bef-dede1b73a8c8", "value": "c214d0b61db999dfc6cd3090dab26711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e218509b-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209431, "uuid": "0742404f-38bf-47a9-a8d0-925e859a8a78", "comment": "Malware payload (Formbook)", "value": "ab0f28545d715ef637a548968b62654a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209431, "uuid": "b9e452a3-b063-4a60-9e28-892d4c3dce76", "comment": "Malware payload (Formbook)", "value": "f81eb28b9cf28b8a5799bf19e2f4e05e789754a23e78baa42ed114d553265020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209431, "uuid": "00ccf5f6-1e97-4465-bab5-76af939e24bc", "comment": "Malware payload (Formbook)", "value": "62dda3ffdca6b60469d01002ed30016fd1415c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209431, "uuid": "264ad99f-421c-4724-9f9f-d2acc4bd0dfb", "comment": "Malware payload (Formbook)", "value": "392da82ad278a6a05119919349217cb25cd72238f50662a4a962786a6956efb54ab7295269c886682987ab4de2393336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209431, "uuid": "aef2d80b-76ee-4c93-8ad3-0d9488ac7dfe", "value": "T1EA2581391BB926A7C065D63EABD18617F04096DF3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209431, "uuid": "05e92396-fd07-41db-a576-871b1661bb28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209431, "uuid": "666981d1-af55-4067-9603-56bd844ef6bc", "value": "12288:CDZtWDc9F3nC0Py3gAhKEJbjJEKsVdSTkedYjCCijq8LpeFmf+qJUjFwKqghswtJ:ZgeCj5ij5cmfCTpz2WdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209431, "uuid": "e303404f-d85f-47e3-8610-d0176d0861b6", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209431, "uuid": "1955be87-9ba6-4a6e-ae87-1a89e526ffe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209431, "uuid": "d6909ab5-1230-4353-99ff-84244f4eb345", "value": "DOC081621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d6b914-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209270, "uuid": "c07e13e0-6fa1-43e5-ad22-1eb32933ad9a", "comment": "Malware payload (AgentTesla)", "value": "c12b9137c5ceccee311215cbd5a8d7b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209270, "uuid": "a519d5f1-5cf4-4fdb-9bf1-f5a18bdddfd4", "comment": "Malware payload (AgentTesla)", "value": "f89405314d1136682a57f21b7b4e16cb23514c143b97032d7798c85711a9b63b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209270, "uuid": "00a8c334-d9fe-4311-9792-d72534136e62", "comment": "Malware payload (AgentTesla)", "value": "99fbecfd0e5348afba415bda708b3a929ab0bf77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209270, "uuid": "50fcec3f-ccd0-4e67-be1c-5df44b166a58", "comment": "Malware payload (AgentTesla)", "value": "d348b4956c9531ab3fbba323ea9cb2b6d81699c32abdb5772a3c3f5364d80be92ccc9617417b03935ba658dc76761a9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209270, "uuid": "2cb4638a-bf24-49f1-9735-a1902cf99bc2", "value": "T15525703C1BB82667D165D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209270, "uuid": "734d74de-ff39-4b8e-9c64-b904d4a666c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209270, "uuid": "46ab45f2-9880-49a9-bf95-a541a635a820", "value": "12288:MpQDc9F3nC0Py3gAh6EJbjJEKcMt9lsh6ZaU77zSA0eN+46V8O7oghAtJGCRj9st:UC26g07OF46V8IhsGoSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209270, "uuid": "daa41789-8c68-47ea-aa1c-b37af64e83ef", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209270, "uuid": "54f68f7a-53e5-4bfa-b236-025efd142187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209270, "uuid": "239a67e9-b1e2-42fb-9461-bf8042312708", "value": "c12b9137c5ceccee311215cbd5a8d7b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4211b8-ff4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629198983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198983, "uuid": "cc49088c-c94e-4c8d-9aa6-e0e6c758acf2", "comment": "Malware payload (Gafgyt)", "value": "6de3d7f3e2cc21f001c990f6d7571390", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198983, "uuid": "7da39b23-68ba-4d84-bd9d-58a20d5e149a", "comment": "Malware payload (Gafgyt)", "value": "f9e27df4dd44624ef33f252a132f26113dea4f0687c5a76540ca8db5d875b144", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198983, "uuid": "0c46dfbc-bdad-40d2-bf71-b43bf47b8363", "comment": "Malware payload (Gafgyt)", "value": "f9c3b8f83c8f11794498b70874971de492cc706e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629198983, "uuid": "a31a63ab-b0a3-4ad2-a792-d09f2ec74ee5", "comment": "Malware payload (Gafgyt)", "value": "7a9821a6190cdd27d468f92d262d12e594495998fb7465747bec4f16a40d85abf1486f48d69eef50b7a1665de69a9e32", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198983, "uuid": "9ea423eb-6fdd-4342-86aa-84f1ff61365e", "value": "T143733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198983, "uuid": "134e8e7a-e5a9-4b34-9888-be9f267f5762", "value": "1536:nm+c5+sQWiKLoxKFn6pD+OTxzM0MmLI2VOCjXUfJRk:45+mr0xKFn6J+O7MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629198983, "uuid": "2312eb5c-f92b-4316-8881-18af1f36e9fd", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629198983, "uuid": "9b120496-3fa1-4e6e-b2c2-38582c187fce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629198983, "uuid": "acf5914c-08b9-459a-ad15-924f746f8dfa", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba4a561-ff95-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629230117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230117, "uuid": "afe71e03-5368-4013-b84e-5db6ac8be134", "comment": "Malware payload", "value": "8c214f1101c56897513a3a139283b4ef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230117, "uuid": "ecbd98e3-feb6-4649-a36c-8c4b85f46b64", "comment": "Malware payload", "value": "fa38d6208a1cd2e30e2a8bb966d0d069948b425d1b3696c50a6505a7d2416b6c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230117, "uuid": "46bf12e5-f174-48b3-944d-9a2427a9af67", "comment": "Malware payload", "value": "7b17e1254fe9c49f03b7798f6241893b87435506", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629230117, "uuid": "c1503ddc-2b17-42a5-8853-cd325790cd43", "comment": "Malware payload", "value": "8c943349e6bebcf64ef3e61950a6e8445df4dc7913d3c61ed5f7f16fb5652ca44b292a181179fc3284daed3301164955", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230117, "uuid": "174d0963-efc1-4df0-9891-6d991ef15b83", "value": "T115328EB6EE02F836C39391FD568A07ECE21C93854264A40FB05651BD0B424D787DDECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230117, "uuid": "4fbe2dc1-160c-439a-98a9-705ce2844850", "value": "192:ScIMmLqbXnPnklCpv5bv/0gh7B4bL7uVJ92EC+fTrm3uv1O/BgQya:SPBqznPnkctU3iN25+ffm3udO/Bnya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629230117, "uuid": "9a1bfe98-8c07-4079-8208-323cf2d4da1d", "value": 11803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629230117, "uuid": "1c7e4efd-ff6d-4960-8742-de6bc3ca12fd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629230117, "uuid": "6b3be739-d74b-4a10-bdc9-b02e68b5051a", "value": "Dear Beneficiary.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a83c3ef-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208855, "uuid": "403ef3c0-3cbb-4a57-82ac-a94e8fede8f9", "comment": "Malware payload", "value": "6976639e701646e25c0a96c67b9ffe5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208855, "uuid": "7c74c0e9-b014-42f7-bdfc-d3db95e9342f", "comment": "Malware payload", "value": "fafc941faeb304dd3650c4a6dd6b04f55d13654e1ff7542411b7e19687315932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208855, "uuid": "882e5daf-247e-446d-b281-a64551bbd41b", "comment": "Malware payload", "value": "f959928d00295a39b859d5679a921c5595a7dfc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208855, "uuid": "4619a7e2-2d7d-49dd-9925-2bbb7a69df6f", "comment": "Malware payload", "value": "d0412f3089df6d8b23ff38313f5618d6c827ffcaf1bf0dcf4616c32304111812dec46d751395d57ccb7dc2cd2d9bf808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208855, "uuid": "d2c7bbbf-5028-4a41-9b00-246cb1bf859a", "value": "T1FF55FA391DB439B7E279C339DEE4481BF6E4B45B7121AA1670DE13670743A02B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208855, "uuid": "558e83c2-0fe5-4bed-9de8-3a53acbc6de8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208855, "uuid": "935ec1ab-c60d-46f1-886e-53370e5fd18c", "value": "24576:kzelQcacWzmWIM08QU44Fn/L0Qjo8gKoF8WlwCYTUo:/RcBB/gKUNDYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208855, "uuid": "7a50638b-302f-4f54-90f8-ae001d365e68", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208855, "uuid": "df193e76-20da-441d-9fb1-bcbd02bdbbd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208855, "uuid": "7576fe2d-d8dc-4fd4-97c4-79e06f185983", "value": "yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb6562e-ff63-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629208993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208993, "uuid": "4f66b9dd-e3e2-4088-9dd2-6f02df3060b6", "comment": "Malware payload", "value": "b7373b3990955631c29a76abd1fb5a8b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208993, "uuid": "ef77b948-a68d-497f-9198-f56011d92334", "comment": "Malware payload", "value": "fb0631a9cb70f0bcf9888a4efa740ba76308231dcc67521128de6777d947ed01", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208993, "uuid": "035213ae-aeb3-4545-9eb3-40f5de23de02", "comment": "Malware payload", "value": "546c199fca7a5b4098f0bf7d019caf5be108dd78", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629208993, "uuid": "3f503d8f-ad09-4001-90f9-0b6e3aea1815", "comment": "Malware payload", "value": "08c920b72df41913b213e48e08b212e1961c1f7c88ab09433de03a8f3d1e7b6613745417c6aba8ad990a847a56a34dc1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208993, "uuid": "ad5d1333-b7bf-4882-b68a-3e588a42635d", "value": "T17B55FA3956B47937E179C339FEE4480BE6D4B46BB6116E1670DE136B0342702B8932BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208993, "uuid": "fa026121-dfeb-4774-9499-f752f8d5a03c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208993, "uuid": "ed2820ae-bb31-4f30-be69-c4752d87b2df", "value": "24576:hsCOwCcgcezdLvcMliZFn1dxMLOc8p0qqsFKou1BbUjwzYLqT+GR:pnBrCLOhp0xouPokziY+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629208993, "uuid": "ad445588-bb28-4adb-9a2b-c2526dd68584", "value": 1385984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629208993, "uuid": "614ac2ae-0942-419a-97c3-c368bc77abae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629208993, "uuid": "e0c13f3d-5035-44e6-b85b-42b71b72922e", "value": "DHL Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d5e2dd-ff65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629209493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209493, "uuid": "ae3ac90b-a07a-4686-a1c3-353fb3b257af", "comment": "Malware payload (AgentTesla)", "value": "08e4f6433c840fd35955a2e2e22e0bfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209493, "uuid": "59914fa1-3879-4865-9ec8-ccc9579c1086", "comment": "Malware payload (AgentTesla)", "value": "fb9f9e367b2eaeaff12ea4910af5e00e3e886ed8f8e6e67cd0ea727b60d101a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209493, "uuid": "c42ea4e1-6d9a-4c64-961d-6eda8231f954", "comment": "Malware payload (AgentTesla)", "value": "26a1a5a5a0740a898bfa33f58860ff9aa1d44b4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209493, "uuid": "fc960b8a-5766-4feb-8253-00abfb771322", "comment": "Malware payload (AgentTesla)", "value": "d7136b61fb8f5852aec9a2b5b8518d8980c57aee88db61805efbcc4fb8d01ca62d425fd08c7af2bd1f9d178c5ed79e36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209493, "uuid": "1c5a2823-fa0a-444f-ab19-78ebb816aacd", "value": "T14B25603D1BB92667D065D63EABD18613F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209493, "uuid": "597a531c-4fbe-410b-b193-4d316e67b9cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209493, "uuid": "a6e2d9dc-d9be-4877-80f1-137a457db7f3", "value": "12288:LCnDc9F3nC0Py3gAhTEJbjJEKoqk/qcvMfOPNlcc7huN809tlp5PkQ76pHOQB8rf:0qjckfeccFlwp56pzBhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209493, "uuid": "141aeddf-8285-4fab-8c15-d9e87e1bcea5", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209493, "uuid": "6d3923fe-efcd-4d75-97c3-4780193a8318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209493, "uuid": "9dad8fe3-a724-418d-ab60-a2f597bd1b8e", "value": "PO#668003-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05295bf5-ff64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629209061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209061, "uuid": "895f7172-844b-49f8-b744-7a513f3875b9", "comment": "Malware payload (Formbook)", "value": "fa690986e568f62d61f562bfe81292cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209061, "uuid": "57233009-d480-4ec0-8016-b38e9e158a21", "comment": "Malware payload (Formbook)", "value": "fbb68d8435857838998c6bc25af2854e56916be9e4935106264d06733286aec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209061, "uuid": "24c442c0-0676-4601-b298-20a18c06b9f0", "comment": "Malware payload (Formbook)", "value": "51cab317139b72904e1dcae573e91a7997d147fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629209061, "uuid": "630d69bc-77d6-4808-bf28-28e7e3a92101", "comment": "Malware payload (Formbook)", "value": "0bb66b1b8d9f58e5db76fb3e01e7877e4c1cdb9e28f2fae5c72d7dfd4ff669e39794785d2eaeca183e89ff708bacecf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209061, "uuid": "0130f85b-9b34-4a6a-be5f-a759fa8d63a0", "value": "T101A4BF81BB904432DD22993DC2BD5F34583B3F745BAA96DF938078765FB22C41922A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209061, "uuid": "c6848d76-01eb-40b2-a5a6-974606c7d2ee", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209061, "uuid": "9892f7a4-9b44-4bab-bda2-a98acb3b93ab", "value": "12288:FkFrg4vUltD8aNmeeKMyFsU085gQupIW1:FktfUbIee5FY5Tupz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629209061, "uuid": "d8fa164a-5a4b-401a-9d6d-ae20bae4ed40", "value": 478081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629209061, "uuid": "6ee8ecee-6cf4-4725-b2b9-80aff4b978e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629209061, "uuid": "193a94d5-75dc-4931-b2e3-46c64ce4661e", "value": "PO_PRICE_REQUEST_00989_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0968ea78-ffa0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629234838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234838, "uuid": "b8858b31-94ab-497e-a247-fbbb0e043b2e", "comment": "Malware payload (Mirai)", "value": "b98f36bdad78227cd706be135993e25a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234838, "uuid": "3533c8bb-cfc9-4be4-b2cc-aa60e698eb50", "comment": "Malware payload (Mirai)", "value": "fc6054b7d7901f69e58fa612691639791c8d46de1b51a0da35ad25dcf8dfc14a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234838, "uuid": "e61aeac2-0013-4e3e-8cf4-9d8e0c863d96", "comment": "Malware payload (Mirai)", "value": "64b6661a40bdef84465617bfa143ae0ff45f9332", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629234838, "uuid": "b3c732c6-a53b-4f4d-a8b8-e5e01b9c2181", "comment": "Malware payload (Mirai)", "value": "c26c7730ce57e4b07f9fb96ef7a74b7e8cc7daf1d33a111e31841d1c8b45689f80d672036a5a56712f0cda73d0d2612c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234838, "uuid": "755991b2-f30e-436c-9bb5-6655969effbf", "value": "T13C834AD7F800DDBDF849D73B4493090AB130A3A04A921B3273677D67FD761A4992AF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234838, "uuid": "8e1653a1-a4b9-4888-961a-98c69c9ea2bb", "value": "1536:mTuHrg3Dfp6m/3nfbepCBt8pUM+8SG4L8tqLP3GyxKIZy3oUYTWRLCm:mTuHUzfpv3nzepqS9Sd3LP3GyxKIZyYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629234838, "uuid": "fc7fff23-ef5a-410d-bf4c-6dc1ba469f69", "value": 82172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629234838, "uuid": "b2389949-6b82-4cb6-b543-3565bd995282", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629234838, "uuid": "a6bf0c19-ae83-455c-9953-2170b5a88161", "value": "b98f36bdad78227cd706be135993e25a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8202a1c-ff47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629196986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196986, "uuid": "3ab1c3fa-3b43-44f4-816f-920c48ac93f2", "comment": "Malware payload (RemcosRAT)", "value": "a311cef429085f54e95b32fd836c56b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196986, "uuid": "8479e0a3-42f7-440a-aef1-1051fc04a17c", "comment": "Malware payload (RemcosRAT)", "value": "fcdb09f9b63c86b92059cb0c636da21a2daee289a120cff346a7d73b02bdff4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196986, "uuid": "3ba2ac5d-f7b2-4c4b-ac35-defa630eda52", "comment": "Malware payload (RemcosRAT)", "value": "591a3cecce37189369faf4c127ba28f7f44b2ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629196986, "uuid": "4526c503-34f3-4405-ad6e-cfd004bd4ce3", "comment": "Malware payload (RemcosRAT)", "value": "30def898a0c4ffb67b2200f67908714cb6fb33ab40a4d9c737cf4d532139e9e8fcc645d7fa89a11a9dc661624f6e1db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196986, "uuid": "23d8bff0-b24b-4dfd-8e56-d65ed8a7b660", "value": "T1CB35B63915B82B27E079D369E6E45417B3E0A85FB225ED58BCDE07A70206F4265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196986, "uuid": "c6a66a09-1937-4110-9db2-d539a5c1caa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196986, "uuid": "55d5b52c-f3a3-4657-a37c-b476c53bef85", "value": "24576:3ZzrfrFYdblhB5v/UzG180aamj05G2OGaep:5yt16zk80aamj0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629196986, "uuid": "07722fea-5e04-4224-8534-54a6b43ec8bf", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629196986, "uuid": "70bbb47c-501c-412d-8db1-d6c7535b36d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629196986, "uuid": "b810d87f-509e-4d8d-a928-bfc1de7b7185", "value": "Proformar invioce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf99b02-ff1e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629179276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179276, "uuid": "303a75dc-21f7-49e5-99b3-412fcdc89900", "comment": "Malware payload", "value": "a37ae3925a3b9a95b3bd08b21a7eacd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179276, "uuid": "bc372aa8-8b18-41b0-a1b5-f8c42ee9ef4d", "comment": "Malware payload", "value": "fd6bdac04117feb225a5cdd52677ead27065fcfe89efcdf6e1ac7f951a0780b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179276, "uuid": "52ea8be9-b3fd-41ca-acc2-cf7566b61446", "comment": "Malware payload", "value": "f43bc723a0c4dea85a5bb322a488fc42432d3e95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629179276, "uuid": "ab541c08-46e3-475f-9716-bd9e8f26d4c6", "comment": "Malware payload", "value": "c388f9c5c69a7c5cdb80e2c10bab0bbfec49b95101913e73e6241290c070af13c178077411ad5ecb4833f45e84c380b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179276, "uuid": "90d1d854-f238-4e7f-8387-71b06cab29ba", "value": "T16F32B0EB590AA332D0261FBD6309378726B974F5C7348AC2CE74806AC8E635A7D35954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179276, "uuid": "b534099e-7a17-4a78-a0aa-850c222e2351", "value": "192:2plaj9y0JLNfn9tjVqT2RayG9oJwdfAnu2vqfNapCGACkvGgfH72fdy8GTNW:2p0c0JLZ7jXRPG9oJzvqf6fkugH7es5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629179276, "uuid": "608b8b2c-cd3d-4dce-a225-a2d81a0d5f3e", "value": 11520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629179276, "uuid": "09d4fb0c-87ea-4f44-91e1-4393df1db02d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629179276, "uuid": "33463d70-02c6-492f-b803-9c7610a2b850", "value": "SecuriteInfo.com.Backdoor.Linux.fjjy.18964.2082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c88b2-ff04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629168104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168104, "uuid": "d8ec8009-3da5-4486-9b53-419ca397ff68", "comment": "Malware payload (Mirai)", "value": "22d31743824814f44762e61c97d292ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168104, "uuid": "53e7a637-e3c4-4116-a151-3c049dbfa667", "comment": "Malware payload (Mirai)", "value": "fdf199bf9088b78750f13b298bcdc9c4b6d675bd16c87df1c2d4a94bff440d4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168104, "uuid": "a9fb2833-a4bf-4391-8b76-ebc4a657492b", "comment": "Malware payload (Mirai)", "value": "1e00cd178ac097d394ae1b8d527693b97def996b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629168104, "uuid": "74dfa3d8-1bb3-4221-8a20-bc6eb7505c1c", "comment": "Malware payload (Mirai)", "value": "2e9fb8a89d09aa55680f9e7e7c99cfecca2a82d11f2b5c0bae3210ba14603031a4ac0374368ceca105e10be84dbdd44f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168104, "uuid": "2fe707a9-d791-4317-b274-2f4888ed03e0", "value": "T18D93A419BF640FF7EC9BCC374AA92705258D651A22A93B35BE34C918F24B21F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168104, "uuid": "7be752b4-5459-4f04-99e1-0d12dc8f86b4", "value": "1536:9nEXUQXe4dYWNmSoqaf6aR7RJQ+ffIOjZIHq0W:9EXUQXe4dYWsIafZRiOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629168104, "uuid": "33bc84c6-a173-4f2c-a5c7-4d2b8d3f4c0e", "value": 96468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629168104, "uuid": "6fe4aa7a-39e0-4489-b4ad-1b6abb352746", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629168104, "uuid": "af910196-b379-45e6-9b6a-e9ba5c5bd5a0", "value": "22d31743824814f44762e61c97d292ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2d8a85-ff48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629197186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197186, "uuid": "dcb92040-61f2-4ac5-a4b3-18d95316ab53", "comment": "Malware payload (Dridex)", "value": "64a6adc922cc7c1d082cedc6470370dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197186, "uuid": "6c398333-b103-4dab-9e8c-45449f75ce25", "comment": "Malware payload (Dridex)", "value": "fec5dde9490b6ded513d55c8a2c322f711433b87926fd03c60df61f7b6f89ac7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197186, "uuid": "0d8abc3a-f195-4560-aea6-85053d08791f", "comment": "Malware payload (Dridex)", "value": "892b7b53c0156c3ac8b5b2eb1d07b1cdf3c70d65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629197186, "uuid": "ec244354-05f4-4314-a007-57074d7a911a", "comment": "Malware payload (Dridex)", "value": "9592a9bf269a33b852687c1cd82f37b5df6af5e0692c199cc5bb690856f73b682751756664d3e7c29eba502d31449300", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197186, "uuid": "62071315-6e99-4438-809b-f8852c9d13a2", "value": "T10044121BED20756BC18CD3FAAB572E6913886B00B305F4D615E21E7B5F685A347E203E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197186, "uuid": "eba228a3-78a4-4ba9-966c-70a56bf7a225", "value": "6144:iogkLjLhrLE03Fj7HAy2QYRSvgHFmrNYD8h0Va18gW0zhiZvL4fGM:rDLZroQj7HAb64l4YDI0Va1LW0zAceM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629197186, "uuid": "cacc7c48-5093-4247-ada8-a5c2bcacd053", "value": 271633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629197186, "uuid": "8a9ead99-9c85-46b9-8bfc-bd95a8f77439", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629197186, "uuid": "e1be0b3e-8cd0-4dfd-a8f0-f5a4d4f8a5eb", "value": "ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.46034995.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03627ac-ff7b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629219280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219280, "uuid": "2b3da36a-1002-4e79-b54e-de6609d3f3fb", "comment": "Malware payload (Mirai)", "value": "93d5ba69a2cfca7c800b46c48abe8916", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219280, "uuid": "a523b023-01fd-4031-9bdf-5a9d9efcf60f", "comment": "Malware payload (Mirai)", "value": "ffdf1e0a306f97d5b803f0100ebcc3cac8fba50358c6ab332cf0ac3b7f9194ca", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219280, "uuid": "424ca5a0-8dc7-4146-9c2b-83d64f5c4cd8", "comment": "Malware payload (Mirai)", "value": "a00f33824de502e2ed7ff5eeb273db4538868a31", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629219280, "uuid": "f97380c1-865b-48e7-8977-586b758e1400", "comment": "Malware payload (Mirai)", "value": "f7b2b9eed95b38cf6321c650a5a16008f4f91aceda74979d722810565b6ee672efd888e424daf5c652e2fc2b038a7715", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219280, "uuid": "0c37e8e0-a2a8-4207-ab1b-8856dbd578ca", "value": "T1DCB36C176692C6FAC08342B92BDBA1618823F67D0B36331773D5BDA43F158C96E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219280, "uuid": "55f6b64e-8143-41ec-96bb-5cfb0d37f24e", "value": "3072:Zt2nlia9qRBFZm4z1EYfcbJGphawfuJv03CKPCNVOXinYuM8R:MsVm4z6YgcphasqcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629219280, "uuid": "b43fcd15-8513-4d12-906b-c7d5b8be5ada", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629219280, "uuid": "a5472c46-9117-463c-b7b1-4876d2825955", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629219280, "uuid": "4c3daf68-d413-4a14-ab1e-769e72674355", "value": "93d5ba69a2cfca7c800b46c48abe8916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }