{ "Event": { "published": true, "date": "2021-07-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-01", "timestamp": 1625184182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "71ee7626-33e0-415d-a632-61af4e8e18e9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77767c9-da82-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625154132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154132, "uuid": "196fac8f-e3c2-4b1c-a3d9-f459bff37eef", "comment": "Malware payload (Loki)", "value": "082f43edde28a07af52951f8e2e43628", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154132, "uuid": "ba76b06e-8a0b-45cf-ad23-6c58c019fa05", "comment": "Malware payload (Loki)", "value": "00b858d35a080af2c87da96354058f140fe988ce286ea894fb11cdb8652cecb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154132, "uuid": "8a43224e-997b-4637-b060-2aadf5b8861a", "comment": "Malware payload (Loki)", "value": "382117f9392cbdc729fc8ef54c3217d2eb2631fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154132, "uuid": "48aa65ad-03e6-4b14-aec6-366429f9c0ba", "comment": "Malware payload (Loki)", "value": "bd304b0df118c0699d54ff33daec3cf45ecd73c17d69c10fbd40bc86c46fe604dc8773ba9e48451b12ef121793425281", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154132, "uuid": "1e399fc2-7e54-4586-91dc-2686929341d3", "value": "3935D00BF245DA41C5592638CCFFC27413B5EE9A7D128B0B2A987AEE3C72751CC552E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154132, "uuid": "5f8de64d-3f9e-4e39-98af-28a705015527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154132, "uuid": "afb5ed50-ec92-4708-a79d-e373f102f94a", "value": "12288:VXDcNTMIiu2IUgb0pVhzhhxPAJQ4s0j8/wHRpljL6u9M2wsqxzEhh:VzcxxXhUgbgVhzhzUF2qR3jLSsqEhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625154132, "uuid": "ebcb4c30-5f33-42a7-a588-d9809ca70feb", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625154132, "uuid": "475fbbbb-7cdd-4d84-9fb4-de7a14286082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154132, "uuid": "38b2934d-f470-41ca-9d3c-e157a7e5dd9d", "value": "082f43edde28a07af52951f8e2e43628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5c92b2-daa5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169205, "uuid": "15d96c3f-32a7-4738-9ff9-1004d4695ff8", "comment": "Malware payload", "value": "0b10ac9bf6d2d31cbce06b09f9b0ae75", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169205, "uuid": "f2c5d1e2-b4bd-48eb-8280-a2f84a4a87a3", "comment": "Malware payload", "value": "0180d1ef09fcd684e0f496ecca21b11bc5142fe068f10ad5699027fbd7688103", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169205, "uuid": "5f9888d5-1f10-41c5-83c9-e82b15d4d9f9", "comment": "Malware payload", "value": "0c061ec90fbc61a868c2ce7aaac4fe79b42cc6c0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169205, "uuid": "01b58ecc-696f-4289-be32-be207a919c0c", "comment": "Malware payload", "value": "af68c10014221c0b7332a88f5dad6ee8dfe456c5489c1447c8fef21be7b4773134ec880ed27fc1debd079adea685fc46", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169205, "uuid": "0346bf66-4c2a-4c32-92d5-16e62c19af85", "value": "9D650222B101C076D66312708E18F7B952BDF9705F250ADBB3E81E6D5EB04D2B63A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169205, "uuid": "823c28f4-df9a-4faf-919a-696aea1afbcc", "value": "75773686702c9c4275cef9e51cfb6fec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169205, "uuid": "4023fb9b-b898-4fef-a4a4-db61b82dd8cc", "value": "24576:+Xwyr6MErO2Bk1kcNSPJnxRNT4aOsi/EnHfXBJQqkfRhdjtJrWBNFUcxbW4Dw3dL:+XBr6MOO6U8jT4ahjnHf/QqsTdjtJrWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169205, "uuid": "74c69496-1d98-4124-83d2-e1a6c060cb25", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169205, "uuid": "fbfcc44f-b50d-47d2-84c5-437eb4c6b3b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169205, "uuid": "96dd9813-562b-4a07-aa28-8445bc0d2be6", "value": "0180d1ef09fcd684e0f496ecca21b11bc5142fe068f10ad5699027fbd7688103.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895202c1-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150968, "uuid": "20635f40-0e41-42fd-a6a5-d62e42e90b3d", "comment": "Malware payload", "value": "3f662336c4183027a75e35554ceca01e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150968, "uuid": "82d0c9a6-0292-46b1-b60c-bbeabfb011c0", "comment": "Malware payload", "value": "02cee62b086cd120c6cc9383b17687999d92800f5a54755ef5bcde2795fad18c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150968, "uuid": "92e42578-1eda-4a69-8941-16088a6268c8", "comment": "Malware payload", "value": "e051e05b4fb6d92b3662a6f372dddb0cf7cc1538", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150968, "uuid": "005fce61-40b8-46e8-98b8-47df3a77a260", "comment": "Malware payload", "value": "ab400f43c0da0998ed41997ed2d2e2319a8c7ab6e065964d761ca9583c739d0b5b834fe51da1b3e4b409f834c2e0dd2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150968, "uuid": "e30ace63-8214-4788-bd93-d8a170338066", "value": "4113E11855C9E364FB601C77AF304519AB8662B6CC2FA67F3209CF98E2D2867C5AD406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150968, "uuid": "e5747753-8c8d-4ba4-a79f-44766302e456", "value": "768:qdAbVhKbDwOehgy58Gn39RNRN/SXAjUtOfEcE2gjDq3U7qa:qGibgUGn39LAtOfEcdu3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150968, "uuid": "50d40795-956c-4a00-ad90-1b6ccd2384bc", "value": 42488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150968, "uuid": "1dfe3884-df67-4d35-ac4d-6bd259224739", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150968, "uuid": "eb37480e-c735-4e65-a9db-6c18e392e336", "value": "3f662336c4183027a75e35554ceca01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc949dc-daa9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625170704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170704, "uuid": "45a7f252-1c92-48c3-987a-06b5cce3c080", "comment": "Malware payload", "value": "89540cf3ed4d33b5d9787b1d69f60fc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170704, "uuid": "f966aa35-6ff9-41f7-8096-f2bc0a9859e1", "comment": "Malware payload", "value": "070dc47307cdec1dc80820401b39ecd316609f69815bfe7478ae16608a361fe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170704, "uuid": "722c6a1a-16fb-46d8-928d-252e874f289a", "comment": "Malware payload", "value": "a69a6bbe93b937345b13a087ebccdcffdd9a0706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170704, "uuid": "64b27082-cc28-4a05-aa7b-2b5f5c4ac6ca", "comment": "Malware payload", "value": "ff2806e052de369b737e232a50b794cdf3a52f118b0111f48e83ca23ea9d2d483d9f33fee4d565264722b8a6a6fe9f7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170704, "uuid": "fc3979c8-fa8c-4d77-8ee1-3c17aa6262e9", "value": "47D4E05EB73181E7E855CE361A658C3A9F706C74AC1E050E3542BE863BF231A1D42E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170704, "uuid": "6626c21e-ad20-4aba-991f-13a1a59ff2f6", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170704, "uuid": "6ffc9321-dca4-4752-82ad-13e300c6976a", "value": "12288:+SAHq1SSTBdAXxxXrfHevvs9B90JiKenoLoylPw155KCGRn:sHIBdIGvqn0gZue5574n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170704, "uuid": "e698255e-75ed-4361-800f-9f87df83c707", "value": 624096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170704, "uuid": "ab11eeb5-b2df-4532-a693-ee955164523e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170704, "uuid": "abeefc87-7f34-48c8-82e9-7af2d5e1c4ab", "value": "89540cf3ed4d33b5d9787b1d69f60fc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45af8d8-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138263, "uuid": "ff6ee23a-d644-45e2-9df6-cd3f561b6058", "comment": "Malware payload", "value": "1cea08f6fdca2447cb14b302ae4a2e37", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138263, "uuid": "e86986f8-1df3-4709-ba58-71bd0b80f855", "comment": "Malware payload", "value": "077f1f844b94865aee503babc1382d24fc1e61c4ab3e14fd86a402867717ab86", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138263, "uuid": "c73214f6-8a45-46e8-9268-b77c5d4a14cc", "comment": "Malware payload", "value": "1f25221727c32b5a1a84d4488fd9523261f34701", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138263, "uuid": "f620a66a-013d-47f0-8e92-b32ca79f56ec", "comment": "Malware payload", "value": "17a6a818ebfe56ac6d18b7f9e7efb7971a030bdd9074e552322934349a665e44bbf30adbf34fe2c6c0c300db4f3f2b59", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138263, "uuid": "17f995eb-9b46-4152-9e1f-a50f022310a3", "value": "E7F0A46C4B8E93900D19FAB4BA0E1C349706D4D60FC11876AFC292E6C2C46351677BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138263, "uuid": "7202ea61-e72a-46e5-98b1-5daeb0b74127", "value": "12:u0Ur3Z94iJ6W5vNcnXcKcnc3Z9TIc3Z+gcqc3Zdc2xBJBem7ysrB2J27sIf:wjDUt75o1VJBVyQBoyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138263, "uuid": "3e810842-0f3d-4e7e-839d-b790bc01f971", "value": 582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138263, "uuid": "1db25504-758f-4d57-b1c9-a7c552af5ca5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138263, "uuid": "3357600e-9503-4187-beba-75bc3bfa4ba6", "value": "Raf2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6db0a10-da68-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625142938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142938, "uuid": "5c567fe4-9f89-4ef2-9c02-07e0f58b0d28", "comment": "Malware payload (Formbook)", "value": "fbb86a0ca6bdefd28a6c70f7cd3040c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142938, "uuid": "bdd079da-e83b-45f4-b0bc-540594c30708", "comment": "Malware payload (Formbook)", "value": "07af0ffdb9e42eb6ca145708be323b7641311d943d28ba746d5f16dd4c5a3eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142938, "uuid": "7765ea6b-3355-46dd-b333-3b128322851b", "comment": "Malware payload (Formbook)", "value": "48021810130cd715a6970f51a0ef8272d0642fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142938, "uuid": "a52e2cd3-6039-4d63-9ffe-a6d59c7ad1fb", "comment": "Malware payload (Formbook)", "value": "81ef3254217a8615df06c84d1c51756686594bf171773dcf0b1108957eecb7a6a702a723cf3ed2c5015225573e4da66f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142938, "uuid": "65bec438-e1da-4f14-a588-370f124aaa40", "value": "7B1412623BD4D8B3CB930BB20D728A439FD0D51221B51A0FEBEC4B56B9315D5E927263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142938, "uuid": "dc594223-b6b3-4ed4-a104-4fd44e997a23", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142938, "uuid": "ea2f0524-56d5-40ea-86e3-7c4668382f9a", "value": "6144:iqjIKDFpnLrM+xzNbwww/tPhf5W969FuX:zpDjPM+TkBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625142938, "uuid": "cba13af1-52b4-4841-91b3-1d834a10ae0f", "value": 197103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625142938, "uuid": "1ffc8cda-3578-4ce2-a410-80e2d0394386", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142938, "uuid": "1ff898c6-74b5-44d6-9600-ef7f82861f7a", "value": "owen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaf1d36-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139213, "uuid": "6ba21c9f-7c52-42ef-aef8-63db0da7c6f5", "comment": "Malware payload (AgentTesla)", "value": "20f150d2a67eea2e9ed51b42512ce9fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139213, "uuid": "803d976b-0cd6-4a43-b2bf-d75d46d9c8ed", "comment": "Malware payload (AgentTesla)", "value": "07c86587141b33f679aa1c4daab65338b9e43c1f3f44bd9f33c7072e4d75ec91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139213, "uuid": "935542fb-f651-4f81-bf8a-815a0234c951", "comment": "Malware payload (AgentTesla)", "value": "ad094843de74f526dfc082964b5a934c18d8f91a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139213, "uuid": "6b590ba2-7090-4855-ad21-ec28627c03a7", "comment": "Malware payload (AgentTesla)", "value": "7d1bf91fd669322676c3e0ec1f4ea584ed26d8c1bcaeeea69d62c6aa2c77ebeb1bff271ff3a38d14b5c8087983fbf9a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139213, "uuid": "3e24f1ad-20ca-44cd-bafe-d0ff3345ff2a", "value": "B2D412682AEC16B6D3738B3656E53294CB7EF9637A0FC15D2582434E0683F41CD91B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139213, "uuid": "54717c49-4c03-4618-ac86-d4bb224fb7ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139213, "uuid": "73f1e56f-79d3-4ace-ab4a-0b69a16234f8", "value": "12288:D9bVj6RwH97Gk+WBKXNq+0+eNneZH6CwALQfih+WV6a:VVjWMtGyBYNiRNe8sYTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139213, "uuid": "9cea5716-b8dc-4515-83b2-c136b03b8a26", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139213, "uuid": "fbe65fd9-6f12-4905-966e-e5340cba79e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139213, "uuid": "5d54077c-dcdc-4c4e-90d6-00a7e50942ca", "value": "Bank Swife slsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a4589a-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138268, "uuid": "ee6aef6a-9db9-46ae-80c8-14b05c30f79a", "comment": "Malware payload", "value": "234bcc3a4789b1e44b7c2346be0a266d", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138268, "uuid": "58f8e68d-a929-4220-abd9-39f902b44b26", "comment": "Malware payload", "value": "082d3dd4423f0504fe14ba1104062ce457d0dd9add566d3d4f8ea1654455f3db", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138268, "uuid": "2b2b59cd-299a-48c2-8dd3-067b50585241", "comment": "Malware payload", "value": "712e0f00831051a488302b822156165794602fe7", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138268, "uuid": "f8fa6715-83f3-4422-88cf-84ae62d60bdc", "comment": "Malware payload", "value": "57fa3836fed003524ba6bd12d4f22ca7961385a96a389fc0fdfc782ec768ea764790741b5d93a3a5d3a68cf2df0f59b3", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138268, "uuid": "e42466e4-8412-40fb-8a64-9e3ae7205e7f", "value": "0CB092FB44370F088C0A9E10AC6F447C7B0660C70B1030803E42D2BAC0442B56A10BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138268, "uuid": "c5d58a07-cd95-482b-9c96-3d6f9f3807ab", "value": "3:jTDisoo7X2xW53EWEHn7vsLAryowpuLrn:/2qT6W53Z+rsLAry70Lrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138268, "uuid": "7634392b-c770-49e3-8934-f6345a2208d4", "value": 113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138268, "uuid": "0ec6c644-293d-4f5b-84c3-9eee64ff112a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138268, "uuid": "b13a2a96-55e6-4c58-9634-64d44fbb04de", "value": "Rast.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc339927-da4f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625132182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132182, "uuid": "fa6a8aa5-0c0d-46e7-b098-cb09a24a73de", "comment": "Malware payload", "value": "a9843f8044849ec534127659c0d7676e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132182, "uuid": "c061ba37-8570-47fd-8b35-af1c02b3429b", "comment": "Malware payload", "value": "0abd8824eda7711a390f2a3c2e6256d77abfce6cb5dc7ff1310e0117e97df188", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132182, "uuid": "8454a0c2-656f-4b3e-abbd-c43a226c7238", "comment": "Malware payload", "value": "656f5ffa0764cb6f9b6f247c22f0da23a353b897", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132182, "uuid": "bcb19605-c3af-4426-8ebc-9b0ee3d0b500", "comment": "Malware payload", "value": "ae5e1f995f71de6984426670509e44a1d2479692467ebc33e1aeaa4bd6c43ccc3d6cde5c8ac7f5448c7bc40225c11aec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132182, "uuid": "009b7bb8-efe2-4a43-8c9d-25d11151c45e", "value": "98B423193952F8EEC84C23C0852FE3D7FBDC493F89B675908C1A9A41F5B032DD296A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132182, "uuid": "b2006402-7178-455b-9f89-6499db94d837", "value": "12288:uPFJkY26jF+TXNvuEzbhRCBO7ASMooGABnmhm:udJn26jFWtTzbL4O7ASM4ABnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132182, "uuid": "8dd2fae0-6f11-406b-902c-1f605a623b5a", "value": 527257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132182, "uuid": "b40cbd5f-fd76-49aa-97a0-4434c650bbc9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132182, "uuid": "22219710-b10c-4ba3-97c5-70566bf20728", "value": "New Order 84731.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7cc764-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625133470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133470, "uuid": "6b5de44c-e774-4134-aac4-d98ace960db9", "comment": "Malware payload (RemcosRAT)", "value": "aeac0c6a68e2ca3d28b4d74ad5af4b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133470, "uuid": "95fcb346-4a4e-413c-ab80-424ee12bd07e", "comment": "Malware payload (RemcosRAT)", "value": "0b21cb47c8a19319e7a3ea04878670d09a51e7b377fdcb9e0009f1cb0700348b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133470, "uuid": "fabaadec-90f5-43ab-9e47-0cee53298869", "comment": "Malware payload (RemcosRAT)", "value": "aaef3c9cdbaee144f8c4891b0cc3632420ec5ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133470, "uuid": "b57cade6-74a9-4702-a70d-1699bb0b60aa", "comment": "Malware payload (RemcosRAT)", "value": "ac00070dd7b90ed9fc43b87dfeb58726d86e5e94ad01eba3b6dfcf345b84ad2936ce5363889a9e145699eb4bef7c228e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133470, "uuid": "aa1fa13d-44c7-443f-b01d-3b0c6de023dc", "value": "18C412286BED5194E733AF7672F93101D77DF6363A0BE00915D2478A09C7B81CEE162A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133470, "uuid": "e4354d39-bbed-4355-9def-6afc22e32fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133470, "uuid": "052ec95b-033f-431a-8a7f-c8af2915dafd", "value": "12288:ksYMUfIVLX3IlVn4lYNVqBy2/NsVp6NDHLKMUKV:nP/VLHIr4oVeyxQhLKMvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133470, "uuid": "70083b06-0fe1-4f03-a6da-af1ea4a10b8b", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133470, "uuid": "0ef3aea8-f833-4998-86d7-d2cd0a71ace0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133470, "uuid": "c6d9f2ae-7b03-4194-8cdf-54e6129e1f81", "value": "aeac0c6a68e2ca3d28b4d74ad5af4b33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f75f16-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134717, "uuid": "290c3c8f-8294-4b05-a0db-ad28ebbee813", "comment": "Malware payload (AgentTesla)", "value": "9e31c0a38c7763847b7af2f5b773e07f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134717, "uuid": "28d58ff5-98ac-48ce-9f2d-8464d2087b8a", "comment": "Malware payload (AgentTesla)", "value": "0bd227d2f60b372d2981b296ee2fd1a11d18efd1ccb24f08753b8c857e019678", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134717, "uuid": "7a66c6d7-ec43-466a-bd2e-268be28af768", "comment": "Malware payload (AgentTesla)", "value": "a52100f0c386c4560504d378a8c422692b1557e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134717, "uuid": "9c7f5880-683c-4e55-ab40-7e4d035833ab", "comment": "Malware payload (AgentTesla)", "value": "851178ddc8987a2c844ed87bf186f627131fdaed9566f4277f1490a2a858f77ec2ef897f320d881736f974fb855ea710", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134717, "uuid": "e8352c65-7613-44a0-8f59-9a8f1c2d75b1", "value": "7445D00BF748AA45C4592238DCEFC2B41375DD8B7C538B0B29887ADE3DB2721CD556A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134717, "uuid": "c8081f4c-e4ed-4fcd-81de-47fe936a76c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134717, "uuid": "64475c0e-cc70-4362-9aeb-2758a123f5ff", "value": "12288:QHF0pFVMPhzh3gbNeNdJWwDL8OdCUHD16BWKF7VpmgkOQR/hxWAKchx:qiVUhzh3gQ3MwPHCUKWqVp0/ychx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134717, "uuid": "6fa0ba55-731f-45dc-86e6-6207ca08981d", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134717, "uuid": "0fa9ab3d-be26-464b-8c33-7ebf32bcb4bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134717, "uuid": "a1ded14c-b953-4c4d-8486-544a73f2fded", "value": "9e31c0a38c7763847b7af2f5b773e07f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ff6020-da4f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625132170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132170, "uuid": "f14c0972-016e-4f64-810d-82f398d7ac06", "comment": "Malware payload", "value": "934cc31f3d71af4979e61eac8f4ce05d", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132170, "uuid": "fa747bd1-c200-481e-ae52-45219601a174", "comment": "Malware payload", "value": "0d74ba8f9637e7c33a66d7cb6a3dbea81267c8aeedeaa08efe8785300b0e81b7", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132170, "uuid": "9843f14b-2ff3-4e60-b965-cea09ccf5f7e", "comment": "Malware payload", "value": "4f9adce0a9edb38be917365026c1c6f09954efb7", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132170, "uuid": "8de314d6-332d-44d8-972c-48ceb5e61f9c", "comment": "Malware payload", "value": "b3e39bed0b02ac63e7f7cd4e1b934225f2bd2192248d84e380ca4f5fa08df773ccc655eeda6d16f76ec443df7c040b37", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132170, "uuid": "c1835534-ccc9-4131-b57b-f492290f8138", "value": "4CB423593951F4EEC84C23C0852FE3E7FBDC493F89B675908C1A9A41F5B032DD296A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132170, "uuid": "cd18bf7a-7855-4404-9e7d-289372c95549", "value": "12288:XPFJkY26jF+TXNvuEzbhRCBO7ASMooGABnmhf:XdJn26jFWtTzbL4O7ASM4ABn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132170, "uuid": "dfff49bd-aebc-4641-b021-fe7d1467788b", "value": 527427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132170, "uuid": "7203aaf4-ad87-4adc-98db-6935812be254", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132170, "uuid": "c70057e1-37c1-4f36-a016-6c62710bb2a9", "value": "New Order 84731.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00617b03-da1a-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1625109077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109077, "uuid": "47f96d77-f397-4d07-87ec-a852e7b1886e", "comment": "Malware payload (NetSupport)", "value": "a7e0858bcbe8173ced0018c7028e2485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109077, "uuid": "1dcd894b-40dc-4f1d-86b3-a36a09aec3c3", "comment": "Malware payload (NetSupport)", "value": "0fb72219b208ae4a7af0780b73a4b8410f0f52dd480c7c3467c310d6ca608a42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109077, "uuid": "7044ec94-0cf2-4b96-b3d3-80cfad910027", "comment": "Malware payload (NetSupport)", "value": "cf81f08d15b08d15e363b0d05da44ecf92c48712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109077, "uuid": "4e25912e-8b8d-4766-9774-07e66e058c22", "comment": "Malware payload (NetSupport)", "value": "0109d879e645a359170148d7fc933e9aaf408671aac5b2192bc299027f294c994541aecf41bf007e0744ef13e33d599c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109077, "uuid": "ddfb6147-ddb1-4074-8c8f-a37ecd0db4d6", "value": "AB85B03FF268A53EC45E1B3245B39250997BBA60A81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109077, "uuid": "6ad1b595-af8e-40f0-b340-0fb30d8b0672", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109077, "uuid": "9c39d683-9624-427e-a4a2-db8452163d04", "value": "24576:t4nXubIQGyxbPV0db26W97qKnCXsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOq:tqe3f6k5CMSffPMWrQ0ZkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625109077, "uuid": "a0c2daca-dbc2-470d-8352-2305cdb60cca", "value": 1764648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625109077, "uuid": "f13a779d-6e3e-4a23-820d-cdf90ed5ae74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109077, "uuid": "c7ab56a2-a44d-4baf-84ef-79024d3f0c3c", "value": "A7E0858BCBE8173CED0018C7028E2485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea1ffaa-da41-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625126147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126147, "uuid": "58bbd3e0-b7c1-4c2c-8dae-1ebe0a1f47be", "comment": "Malware payload (RemcosRAT)", "value": "d74e804bc0a8985240989ace87b87bcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126147, "uuid": "c275c76e-0605-49d1-a8f6-be8ceb85197d", "comment": "Malware payload (RemcosRAT)", "value": "10c58df72a83689d06a1562b349fa195f853465e14cdab38f7dc8ae77fe52d4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126147, "uuid": "f9fcc755-abc7-496b-bd50-850164921d4e", "comment": "Malware payload (RemcosRAT)", "value": "73c2932e0bbe05f9e7229eeab1d8bb546ef24f07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126147, "uuid": "a4f2905f-c778-40d7-bc7e-ce7bfb91d625", "comment": "Malware payload (RemcosRAT)", "value": "b1bdd33b0915f69722c384f0a0248f2d43bd457693d657c49964015aa1ccb616cdd53174dfdd5d40d14595b1ac0db301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126147, "uuid": "3803fabb-9e3c-4f6d-a81b-759e2e5e7756", "value": "3AE423C03194FD2FC1BF50F6A15EE9208376A628A0B5CDDE98F53C5F77E23894926606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126147, "uuid": "153e5349-b922-4a22-8ad7-2beca925137d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126147, "uuid": "203e3717-a546-4a7f-b866-9d908a336793", "value": "12288:QEFVzMFcNFIGlFQE7/Hv6o7/WofBVJz8Pe39VrOYryQgM/RwzcGISXyQLV8:VaMFxQEjHf7/Wybz8Ps9Vr4QPOzCQLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625126147, "uuid": "b0f196a2-1818-4511-a54c-af89fa2abbda", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625126147, "uuid": "f333da7d-a922-4607-9c8f-f36490de4f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126147, "uuid": "2cad6ecd-5c19-4321-9286-dda73cce7ce3", "value": "d74e804bc0a8985240989ace87b87bcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e27b6d-daa9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170719, "uuid": "28345d5d-bb13-42c5-a6ff-a249f971d9fe", "comment": "Malware payload (Mirai)", "value": "4d7e3a90206444f684872e8d5681436e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170719, "uuid": "2580f778-74a5-47e1-85fe-b8ba0d95ef1b", "comment": "Malware payload (Mirai)", "value": "11ed7f40f65729287e77499dcbcd3ab553b1de64d9b388b5b9eed4e36ed2a9ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170719, "uuid": "ee8cd584-18cb-4416-9065-425da97084f8", "comment": "Malware payload (Mirai)", "value": "e82b025149314bee5777920bb6d5ff3a3c97c6b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170719, "uuid": "2c3bd4b4-3d14-4052-a289-d5b7f1909a31", "comment": "Malware payload (Mirai)", "value": "35aad53980d5fd99a4cf7719af57a6b126b5e6cc9cbd17609dd87ce5fcc1134537155a5058ec1f6c8049805813781984", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170719, "uuid": "cf435429-77a8-44f3-a8db-bbc8f9999183", "value": "A3A2D1A03882DD7DD7F644B1DE25E187261E12F6E0F93238353916B8A6C281F6776287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170719, "uuid": "9135e8ac-8645-49da-a6ff-8e19986b65ce", "value": "384:zk3UQyFDNgB36T3d7n3peSzvV3wlnxcrE4SIrRrBhymdGUop5hX9:zkAWMLd73dOlV4XhBs3UozJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170719, "uuid": "13c79d57-fd79-4a35-9ebe-37e458fb4285", "value": 22124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170719, "uuid": "5010dd61-0141-4941-8b48-f9c72cb64589", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170719, "uuid": "47ca2b03-c3c5-4db7-9f74-27adbc25ecee", "value": "4d7e3a90206444f684872e8d5681436e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8484eda-da89-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625157113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157113, "uuid": "38450cd3-6f1e-4b0e-a575-65a7691e463d", "comment": "Malware payload", "value": "18dd0c3248955158925c6de3ddb24ed8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157113, "uuid": "eec71f18-1891-48b1-90c1-f89700b5e438", "comment": "Malware payload", "value": "12a0cbec3f1cec778446a9cc742e92d64414f60bd9062c1825ce21cc1f329e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157113, "uuid": "20a3834c-ff0d-4491-99aa-fc08cb38f10b", "comment": "Malware payload", "value": "0e29238cc90213db9dd99fe07c79172ff3769da0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157113, "uuid": "9b61a0fd-e6da-473a-87c2-f8b27ee544d5", "comment": "Malware payload", "value": "2640cd3e09c68e4d4f682416e120522f72c53413f4d85a25555594aa144b41179011b6a027134d9d762a80acefc5d578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157113, "uuid": "c9a72f90-3ed3-41dc-a5b6-18475dbceb03", "value": "B354AE923680C471E48675305867DBAC57A9BC72E6734603F3982B6F6F332C159EE21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157113, "uuid": "d8a23f64-b9e0-4e23-a41e-e6dcc2eacf0b", "value": "ba9b0f2c256a509c08b05c60ed64bfb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157113, "uuid": "14c4690d-678e-4c64-af1b-6c8200f0aec2", "value": "3072:O7H3H4E+LZOKfvxaRa57x2aFQ8bMbzFb7BZT:OrqLZlvxNpx2aiM+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625157113, "uuid": "7071ab50-3416-4a1c-8710-69e6fa8ee48b", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625157113, "uuid": "9b7ea663-ebe7-4451-b949-9704ca1c1768", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157113, "uuid": "4212a8c9-68cc-4b92-80bf-73ddfff3bd04", "value": "18dd0c3248955158925c6de3ddb24ed8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9fbb2e-da4b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625130148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130148, "uuid": "f10db458-1c13-4970-b3ee-1a6505c9e91d", "comment": "Malware payload (Mirai)", "value": "11884fe6e99aaa6f219dba2d70b9bccd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130148, "uuid": "e00314c4-ae7b-4dde-8476-969596457f30", "comment": "Malware payload (Mirai)", "value": "130cc01f035e9d6178c9b0c8cd191c5584a0545bde767e808624d63b52dc7017", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130148, "uuid": "6cf29505-54d3-46d0-aa00-ba3e2adc7da6", "comment": "Malware payload (Mirai)", "value": "d81d6601f0a737390a15b00dd51aa180044585c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130148, "uuid": "1fcee981-4011-4001-bfa0-babbbb63b7fd", "comment": "Malware payload (Mirai)", "value": "5f84151e75c764fa45ad24dc172dfcceeeacfa4b161b35546681095171202cfb3d4b10ddb2643a3fce4f62a35aff0296", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130148, "uuid": "33df7cb1-77ff-447f-97c2-5ba21f87d9f5", "value": "D064D08AED41AF25E9D526BAFF1F024973734BACE3EA7110D620972037DA65B4F36044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130148, "uuid": "f23b1cae-6ccb-4dc0-bff2-a85f2dd4813b", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncaabE5wKSDP99zBa77oNsKqqfPqOJ:78QpZsKCaiaabEDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625130148, "uuid": "e147b73e-2b28-4528-b317-9abf3d54335d", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625130148, "uuid": "0a54480f-9cb5-4e37-90c4-dd1db63c755e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130148, "uuid": "a20ab0a4-e565-4566-8d5f-ff94cce07bcc", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b22e27b-daaa-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625171077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171077, "uuid": "ccc84c67-886e-491d-be87-18a2c59d6ce0", "comment": "Malware payload (Mirai)", "value": "19e4f52d3edde84ff0a777ac6c43dccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171077, "uuid": "37903e00-5d17-4b0d-ac3d-808e27e763a4", "comment": "Malware payload (Mirai)", "value": "14146547dbce0520fa9405bfa5ead4a14e6b983e3a56ebf9c644a7e0a153779d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171077, "uuid": "c70f234f-555c-4fed-a479-55d8f58ca631", "comment": "Malware payload (Mirai)", "value": "daeb6f27d584391a49cf0620a8fd5d2b2e635e6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171077, "uuid": "3f793114-e1c7-495f-89ec-0d6c319319d2", "comment": "Malware payload (Mirai)", "value": "721219ecc34556c871dacd8cded2fed6946139d8b6b649cfe3b43d02e1151a1f83616d1297c5d8a14ac27a3602a6282a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171077, "uuid": "51835fca-d22b-43c4-8216-c103940b3783", "value": "70338CB5C579EDA8D1544A78BE248F749723E100C6A32EFADA44C6699083EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171077, "uuid": "5478ddcf-4d67-452b-a0f0-775a57c85c78", "value": "768:rauxBwtHSMsas4UQebjEjBTIztyWfs3IFG5eFUA/qwCqaoys1Cb:ra8BwtyuVTIz9fs3s0eFR/qwln1Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625171077, "uuid": "58b23358-7037-41a7-8183-e4e772226f33", "value": 51580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625171077, "uuid": "d3f26704-577f-46a1-b39e-335ea21f14ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171077, "uuid": "22edcc75-cf59-46d9-97af-4a7539a4c99a", "value": "19e4f52d3edde84ff0a777ac6c43dccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178cf228-da7c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625151207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151207, "uuid": "4e9848c4-e842-46b4-9cc2-e287f4c4ce01", "comment": "Malware payload (GuLoader)", "value": "fdb80da09e1fccaf719a87be2f4a994c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151207, "uuid": "7a26014a-2e39-4a46-a825-97e622a32859", "comment": "Malware payload (GuLoader)", "value": "14467c65ce71a7b85012630c4e55c389fe21be635c78a15e23755b7c7517bdda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151207, "uuid": "78b02d4c-d5a3-4c49-8293-4dc662e3745e", "comment": "Malware payload (GuLoader)", "value": "740ba43cb0d2a69ecfe4a501b4bd5f575c2dc40b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151207, "uuid": "d8ccea68-4a5d-44d0-b745-6e65bd203a18", "comment": "Malware payload (GuLoader)", "value": "d71950f64bf5053e711f588a8574b8b70de4ba4d3b7bcc539aae691f968ea2194b280fad024937e423416f7d88e3fcf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151207, "uuid": "3376ca56-bcf4-4b99-8ad9-6edecf498cdf", "value": "9E837C2376A95D65E2C787B009A5FC39A7E77C311843DF0A3901AE697870A0275E2B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151207, "uuid": "7619ec68-5cad-459d-a73b-8d7e7b1c0345", "value": "3f93623b9b54de473e83cea8b7333254", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151207, "uuid": "3fe8f1d3-b79a-4f34-a82a-f3722775c1ad", "value": "1536:zS5KE6Kk7/NXKZrJRPn1KNIM9DF8OwMBTIENhcDpER5uHKVcTx:m5gKk7/NmVhuIM9DZNEpx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151207, "uuid": "b74975a7-44d4-4e6a-a5e1-52e33f6a7738", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151207, "uuid": "b5c3bcd7-6e9b-46f0-8cf6-d726da5f1460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151207, "uuid": "488d0ab0-6c44-40d9-be0d-4ceab455e85d", "value": "DOCUMENT NO 9987002345 2021 PROJECT JULY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5584124-da34-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1625120655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120655, "uuid": "b751fa9d-45df-4b7d-99e5-b9219b05eec9", "comment": "Malware payload (RevCodeRAT)", "value": "d168a301aeea42495bfa790ed012223b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120655, "uuid": "550e05e6-43ed-4116-923b-3cd44a39a11f", "comment": "Malware payload (RevCodeRAT)", "value": "15003064a4b6d326954815712d6468af76d413335470092fbd820b02745d3e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120655, "uuid": "b0a4da54-929e-4daf-9e09-5d7e51b3ca22", "comment": "Malware payload (RevCodeRAT)", "value": "aa6ace276b374e41a5ec7ad7bd6cf09722756027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120655, "uuid": "858e8adc-6b18-4580-8282-5ad40dcc1155", "comment": "Malware payload (RevCodeRAT)", "value": "dc8319ffb2c80fcf7e7a8d1cab72ecbca580442a42c4ef87e0abc303157758fa5ef185981a7d933ea9fecd72917d53b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120655, "uuid": "2c4d28c6-cbeb-403e-928d-27b7b921c050", "value": "4245D0242AE88629F0BA9F7E95B4514547FDF723AF23C95C3DB411C90723A41CAF172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120655, "uuid": "44ee93f4-8276-4c3d-b7bd-6871471b8288", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120655, "uuid": "0dd13cd5-525a-4fc8-bea0-b59b1e4e382b", "value": "24576:XLhAQnmi61otMl+/x6b/xOzrVQ5fhT1i0X314gUJ5:XLh5nmLl+/x6b5crVQ1i0OgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120655, "uuid": "cf28c2a5-3f6c-4c45-9412-1400fc3c4006", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120655, "uuid": "e956591d-098a-4a6c-b0df-b446e8747f68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120655, "uuid": "0f4b06c5-956a-4fb8-8971-bf6b006f279d", "value": "BANK DETAILS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed6794b-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169365, "uuid": "835dcaf4-4250-4c0a-becc-a5cb73fce71b", "comment": "Malware payload", "value": "5a8783783472be67c09926cc139d5b27", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169365, "uuid": "c25c8000-42a7-4522-9f20-6f7eb5627837", "comment": "Malware payload", "value": "15633871c3630a559dd4e2c7a9b93b02d17dd64ee60a2d7ba340ebd14d13ffac", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169365, "uuid": "6d5a527f-27fb-4d0f-b418-cb6ff864f766", "comment": "Malware payload", "value": "4ea195fd2af0a4fa0ce2a9b052ca380206ad6fe6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169365, "uuid": "93f48a67-e1e8-42aa-90d8-163156b4fde7", "comment": "Malware payload", "value": "3a5567035afc5a2e7bfe1379e65570b7519f4cf6423910b607b8458527594391823cb31ad1ecc6353cb539e45865f1f3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169365, "uuid": "17d91e9a-0366-4ebd-b178-053a06b712c6", "value": "9E837C13F0D4D073E0235171A9A6B773886FBA3399390247F789467E6EE11E09E29793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169365, "uuid": "38089405-e7fa-476e-a98a-d321127aa813", "value": "4d4d03b1080112a8681ab2abc89c0a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169365, "uuid": "85be983f-04b9-4618-9dbf-186b7904c91c", "value": "1536:DEdMIFV/P7JVhgppbWbQePKjtkUqpdEEuYg:DE9Fdzhgpp+PKmpdEvYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169365, "uuid": "1970d1ec-ea95-4f18-98a8-67b59cfe4d0b", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169365, "uuid": "e7f3148a-db1c-433d-9d0c-8c67725c4708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169365, "uuid": "ac47fb01-e5d9-4220-b2c6-d1b220e08899", "value": "15633871c3630a559dd4e2c7a9b93b02d17dd64ee60a2d7ba340ebd14d13ffac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb96d263-da71-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625146784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146784, "uuid": "5e3040dd-12ed-4cf8-8d51-6358eeebee4d", "comment": "Malware payload", "value": "0f65290ae96097510511d905c02bf675", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146784, "uuid": "b7405649-55de-4426-a36c-3576a58dd64e", "comment": "Malware payload", "value": "17b5d075ed67fda41b5b7ca7f53bab58d82872e678293f0697ed68e342be831c", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146784, "uuid": "d74973a2-6e37-441d-92f1-d0f432364e47", "comment": "Malware payload", "value": "16f7ea5cb190c0cdbd2c9344459ae540c730759d", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146784, "uuid": "98fe8c8c-8719-4a53-86ec-483d2938ce2c", "comment": "Malware payload", "value": "5aa21de125677c15d93071ee65b7ab05b526c8010e786efd4ff9a40688a77c9bc7bbce361280ef16c75a159385513100", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146784, "uuid": "1a14903c-b7d2-496a-a707-552e82bd02cc", "value": "0EB423EDF9BAEC60C5679BAC19B719212DABECD7CFE11F1A01456032CE648871870C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146784, "uuid": "d031e226-f5d7-47b4-8609-8f0b073bb632", "value": "12288:VCeziVRRYMnuqOiPoB6+celF4gnUTbrUjOSCN12p3l:VCk6n7ToBLqgn9Ojb2p3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146784, "uuid": "69fe26c4-af8f-48a6-97d9-fab2381bb213", "value": 500496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146784, "uuid": "38c63565-5d33-4cbc-bad8-77a74dc807e6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146784, "uuid": "1ce99ac9-7880-4f5a-a225-d79e2bf609fd", "value": "NEW ORDER 010.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f12559-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625139363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139363, "uuid": "309d19f1-9e3d-4a1c-9396-dae90402a380", "comment": "Malware payload (SnakeKeylogger)", "value": "f0176bcf45b112e918726068eae39306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139363, "uuid": "17a6c56c-2806-42bd-9812-4fee0758cbd8", "comment": "Malware payload (SnakeKeylogger)", "value": "18143a1b4315ecaad0f887b3ae467aaffcb85e5eafa8502a8c179151746af7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139363, "uuid": "43f4f55e-75e9-4792-8405-1d8ef2b20489", "comment": "Malware payload (SnakeKeylogger)", "value": "61010cbfe46b57c207aad05e4ff125b907b9c952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139363, "uuid": "0f828466-2f9f-4b71-bcc6-250f3399e551", "comment": "Malware payload (SnakeKeylogger)", "value": "7b0ac914a89389f37638e694eafe283bc64ec6e70c4d8eb3743520db2d2c59e4b8af8cea32a1e68ca1224ddd085c2fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139363, "uuid": "e5f21ad3-fbc8-40f3-80a1-fee926e1c163", "value": "72057E3D597E123B81FDC3999BC98D1FF884952730217E7898DB43A5470AA8379D223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139363, "uuid": "3326f7ac-33a9-485a-92f8-cb4cbb1d9824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139363, "uuid": "847af17a-dbf8-45fb-903c-3ac0d672539e", "value": "3072:ZlSqfUfx3stporu4+Owv1RpOuqd7+zFRLpIuxfm7QIbfhsTzMgKVzWHKTmQJ1AHp:uqAxSp94loOunRGuhlIlskg6UKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139363, "uuid": "a2299985-aa0b-458b-b5d9-c4d4c62f3f0e", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139363, "uuid": "19b19f77-f852-4f3b-bbb4-e13ceba6c54c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139363, "uuid": "31caf580-f39e-470e-b4f3-015bbbe49167", "value": "microF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1306b793-da92-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625160648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625160648, "uuid": "8e2804ec-9531-41da-9613-a1378e7f724f", "comment": "Malware payload (CryptBot)", "value": "29045a16e92dd7c95fbd0d317ffee047", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625160648, "uuid": "8fcff723-8ed4-4700-afc4-81859b7a5957", "comment": "Malware payload (CryptBot)", "value": "1913f2f2bed5b14fae809fb0dcb8d35a46f2e4f99fd5c021e8ead58dd9541ece", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625160648, "uuid": "3afceeba-4fb3-4598-9f9d-8aa5d10617a1", "comment": "Malware payload (CryptBot)", "value": "c1fc1ca5275e806d5446bc9d8f4dfe6ccde04a15", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625160648, "uuid": "b7c5ee0e-76dc-4f7f-970a-64cf2f54f6d1", "comment": "Malware payload (CryptBot)", "value": "16944489dbc1bb36708b37508e2658a6b79b5bdbcfdb689471cb06449738a0bbfc3488b2b7c50eb1d67f19f072a6f305", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625160648, "uuid": "bb6922f8-35d1-49b3-8157-fc8786e1326f", "value": "7326339A3BFA40B6F9598474D88ABB32D5FCD74857200DEB3F94811E2FBD480E60D529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625160648, "uuid": "bdf904e1-60d2-4fcf-b84b-87cb2c82397c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625160648, "uuid": "47114a01-4ac5-46e2-91f9-f1086ae2c649", "value": "98304:x5Z334WoxvqFhwRgu7bp1r8v//d+ghXxxhxkyTBqmq30K/Yp8hCvLUBsKdFxp:x5Z8sDwRj3p1qH0ghXZRNqb/Q7LUCK7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625160648, "uuid": "dc3d54f4-a57f-4e66-984d-b12c6ae3b0b8", "value": 4703245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625160648, "uuid": "6b94ae68-9014-471d-9d6c-0c38e4d1ae6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625160648, "uuid": "68905516-bdb4-4aa1-8d39-5f818c5a585d", "value": "29045A16E92DD7C95FBD0D317FFEE047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04645287-daae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625172649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172649, "uuid": "3494fcad-7d8b-4375-9554-5d4b4cbaf514", "comment": "Malware payload", "value": "818e9f315cc504223d35be6beffa6924", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172649, "uuid": "7c1363a7-204c-46c6-8df5-892ffbb6df66", "comment": "Malware payload", "value": "1a29079f87db28bbf04fde9ce88749ded368b3dbf4317d6ea11904201c44be34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172649, "uuid": "046b272b-f012-48ba-87f0-466e364a8f35", "comment": "Malware payload", "value": "ef03dc9eea969aaff4414df8d1c13860f2b05167", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172649, "uuid": "4a6caecf-e2af-4e32-ada2-efde2af388c6", "comment": "Malware payload", "value": "f6faf384b612efef54eb1c22185a1b6976e30c1a86586f47af097ee6023553aa34817d194c09a4b6e31892829cac59d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172649, "uuid": "96e8e6f6-a7ae-4a70-bbdc-38a346b5c101", "value": "BDB3265303851BBDF68D0EC5C89B245B30F2D8677D251298ABB36EE7BD3B9C49430626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172649, "uuid": "f053ed1c-5ece-46ff-ad53-d7f4f0cde64b", "value": "3072:Rzhzs8Jb/HIAE/szhz6wE/szN/kSBEJ/KkhzsMXIDShzs7zsAJKBnyaJVDP:Rhzs8Jb/HIAE/szhz6wE/szN/kSBEJ/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625172649, "uuid": "df912962-d03c-4b16-a244-e0a26c2377e0", "value": 109652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625172649, "uuid": "3511380c-53db-4c3b-abe2-418cc2278ba0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172649, "uuid": "82205f2c-cf4a-4df9-aa3b-1607aafedade", "value": "Avast.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564e8d0-da47-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625128547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128547, "uuid": "5d001136-491d-4310-bda7-ce4b345d6d14", "comment": "Malware payload (AgentTesla)", "value": "6918472f27d48ed8ebce09cb7a5be1d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128547, "uuid": "2eb2ebb3-2b3c-47f6-9456-c9295459e556", "comment": "Malware payload (AgentTesla)", "value": "1b9bb1e946bfa8aedec8483a97b8abc7bac0da1e58150d23b2c0473aa1095782", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128547, "uuid": "e80fd730-eeba-4f1d-921f-13c5db809a3d", "comment": "Malware payload (AgentTesla)", "value": "2add77b563c0ad7c8aec9fe157b931be737516cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128547, "uuid": "56a4b5d2-9e08-458d-a29c-eae295782b2c", "comment": "Malware payload (AgentTesla)", "value": "98608c8e35c63c9a72652c631a46303c80507ed55c3f40ff6986a8505203631a8db937f969f930337b64fababd2bf4cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128547, "uuid": "100b2a00-b3da-4ac9-8b5c-3d7c16a57c84", "value": "F0D412346EFD2274D1B61F3265F5F292C7BEB7367A0AD40828D252460693B80DFE0769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128547, "uuid": "fa598b24-7a48-4304-91cb-742e411b3112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128547, "uuid": "5b03ce66-927c-4c71-b23c-9d2724ed63ae", "value": "12288:S+YlylsKAlAJKBPg5PEPQna6cZrim6JetuBta2aSLEFZvsn:0EsKAlkKBPYPEPjfrFGrm2aSLEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625128547, "uuid": "5096e35a-39e4-4e74-9f10-95d6547a4a86", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625128547, "uuid": "5f48522d-b944-46c3-938b-e7f38d6b436e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128547, "uuid": "798c2f14-ca33-4aee-9517-4e8c622d2a25", "value": "KCCIXCMp78seCKo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a20607-dab3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625174806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174806, "uuid": "2c14d2da-247e-44f9-a46d-7de924e3d023", "comment": "Malware payload", "value": "3d4d4d1ea4aed701a68a0a15bbeed778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174806, "uuid": "cd68fb7f-f297-42b2-9fe4-6ff88bea0aac", "comment": "Malware payload", "value": "1c7a790071604c278c73b380f6226788105af99809949e387d80b1e7fd395e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174806, "uuid": "f704e024-b5e5-4c00-8de5-2a30f659bec7", "comment": "Malware payload", "value": "3651cab8135d8e83ad3375f1aae43cb96d7dc69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174806, "uuid": "d1a02bff-cf7c-4e5a-85a2-48851176c264", "comment": "Malware payload", "value": "33335b7951b05e0c8f638f580243f42ebd002717abf93db0e5e8ad34ff545acb711985424fe4c6dff6b6c779f780ee91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174806, "uuid": "ad147ea6-1454-4c23-bdba-07d4ede305cd", "value": "73155882A4D40356D06E653AE8EC78F652DDF91E6409EDCF11F1E75A803B30FCA8B619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174806, "uuid": "5e54549f-9547-4a18-9647-a091e5b52e7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174806, "uuid": "b846de87-9f2d-45a4-a6b3-c6e666374615", "value": "24576:sxip08EDqqZyKXN4thgJC8GVjghCWp8mo:gr8EbVshGggh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625174806, "uuid": "05d5c56f-963e-44d3-9efb-975e94ce0634", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625174806, "uuid": "3fa35f40-e5a1-409b-b298-f67ccb7bf67b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174806, "uuid": "a32cc855-db51-4fec-b060-636363b2f74c", "value": "RFQ JICPRHR10631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40bdddd-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134826, "uuid": "0a595fad-e57a-44a1-814d-bb5435f7b2dc", "comment": "Malware payload (AgentTesla)", "value": "fa8b123cffb8ae462baa3bdd34ef0f7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134826, "uuid": "6643db5f-70f9-4db5-a7fe-6b974dfb039d", "comment": "Malware payload (AgentTesla)", "value": "1cf4e320f7613304f8a237645fa79dc94b2922925462cc19825e95e4fcee5a76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134826, "uuid": "a07d9349-2a86-4095-a30f-cbec26e93f0d", "comment": "Malware payload (AgentTesla)", "value": "683fd2732f073e0fd26bd48e114a479827872a5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134826, "uuid": "8c15d6a0-197e-48ee-95b2-d177649a95f4", "comment": "Malware payload (AgentTesla)", "value": "45c3530067afe7ff85994ca02be074150bc6dbcaaae3dfc48f3c622ff482e76d870ccaf73532c213cdbb1925b458e847", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134826, "uuid": "df83037a-434f-4e8c-ac67-ad7bc910c7b2", "value": "42F48D202AE84A29F0BA9F7E95B4511547FDF713AF23C95C3CB551CA0723A41CAF172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134826, "uuid": "7ce9848b-e04b-42a1-9698-fed234043394", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134826, "uuid": "2324257d-3654-4404-a70d-8b32ef48ef12", "value": "12288:H6Oq3u5BbX5Tyhv78jrGR/5AW8DFKS3rcW8ofBOSWqH8YTmU8G+LLi:aV3u5aT/5A8S3rkofBcG8YKUALLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134826, "uuid": "51bc22d2-c843-42bf-aeef-087045423bca", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134826, "uuid": "17c1bc69-e06e-4d88-81f3-e60b7d47216d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134826, "uuid": "cde3d8e5-d166-4b94-bbe3-5fa47805d651", "value": "fa8b123cffb8ae462baa3bdd34ef0f7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efde3b64-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625151140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151140, "uuid": "56b918ec-6b6d-4d2a-a179-fbec20d9f9db", "comment": "Malware payload (NanoCore)", "value": "ad0c72111abc4983dc9281668fe04054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151140, "uuid": "20931a20-4eec-479b-910c-1ef18f21aa0c", "comment": "Malware payload (NanoCore)", "value": "1d8d1ed93e2bb02931e7184988ad25b149d75beaaf5c4604144aef7981352109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151140, "uuid": "80a4fc32-da2a-4811-a826-930ec959b2ae", "comment": "Malware payload (NanoCore)", "value": "9dcf551ff7290e71a1b59ebab9af4e7fd209f99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151140, "uuid": "68dc925b-dcb3-4f29-97fa-83c9a05edbfb", "comment": "Malware payload (NanoCore)", "value": "ee0107fc49bb18bb31afaabc54b6332997b75fc6aa8b87a42d48ac47754d8102d11f396dafbea785f763e936e86ac56e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151140, "uuid": "3c232a74-61a5-4905-a71b-a796106018f0", "value": "2F351201BBD18C72D17329325A396B146D3CBE601F258A1FA3E4192DDF359817629FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151140, "uuid": "a6eae3fe-b747-4ab6-956b-7cc9b1125fd0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151140, "uuid": "b88cb46c-603e-4815-a6fd-b6a5b0a5c622", "value": "12288:PQnk3GDYKGcblqQJ8TjouNL+UUnf0O2euOtFnkKelAC0k/ATOeKqTssS7QSWJutv:BAOcZpJgMQgnf0Oxvp6s6VMuVyJrhmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151140, "uuid": "ed41dac5-7f1e-48db-9664-ffc87cf0d61d", "value": 1115047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151140, "uuid": "229c1b1c-e69b-49cb-980a-ce7cc5eac81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151140, "uuid": "64f32bd6-db08-4c56-b5d7-9a73238a0667", "value": "IMG.09949030049.PNG.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df64fa6-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625123005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123005, "uuid": "44822496-a331-495d-9bbf-06d7353919d0", "comment": "Malware payload (AgentTesla)", "value": "0c3d32778d153a0179c9d0558836e45e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123005, "uuid": "6cad6248-d78e-493d-8868-1504b120872b", "comment": "Malware payload (AgentTesla)", "value": "1dc204167cec6c3857affbdbf790b14fd80ca914b39310b6458dbc5164bcbc6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123005, "uuid": "f4d8a159-d145-4d4b-a2f3-2d48761f6498", "comment": "Malware payload (AgentTesla)", "value": "abe7404f07f11ac68b2b9b44a2c24cbbec9a5fb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123005, "uuid": "4fb41140-03df-4e3a-a287-3c3733e242f9", "comment": "Malware payload (AgentTesla)", "value": "7b3eacbdb20d959b2f8d805d9b35d0aa1f6d2465b5b3bd6e712c88c713381803f6998e365c12b78baab42139c0dc8734", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123005, "uuid": "dd4a6a00-3b92-4dd6-88d5-861b8b51c973", "value": "AA253AAD725072DFC8A7CD768A681C24EBA0B477430BD203A06715EDEA4D997DF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123005, "uuid": "53aa8f11-da1d-4736-9add-649fd1cffe8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123005, "uuid": "fba28c02-6551-481b-b330-2f3c8e2b28c4", "value": "12288:7np0U0pVks0MHuz2qH9i2VrruhRNu1/qDnRd3YgyrIdUosXGU17+pVQAXcG6o2iK:7pRlMKEfRNu1/qDRVfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625123005, "uuid": "443a03b4-6803-485d-8c14-e965490cc1a6", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625123005, "uuid": "ff7c66ef-9b55-4f57-b7c0-2addc9eca6f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123005, "uuid": "1e83e855-d289-456e-a492-25f2db8b7972", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.10190.1338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702a0b4d-da72-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625147060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147060, "uuid": "7d44670b-e7dd-4016-bca3-c251666b78fb", "comment": "Malware payload (AgentTesla)", "value": "37e21c11f2b7b0033ecac9dc3a5232f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147060, "uuid": "8006a0b0-da02-4dee-a806-c53386d85bea", "comment": "Malware payload (AgentTesla)", "value": "1f395105436d3b493c8682a2cf6081f5e85f07d1657b73fba0809a6c6a419bf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147060, "uuid": "5027d566-0249-4cba-a4f3-a1eca888d0ae", "comment": "Malware payload (AgentTesla)", "value": "fc56dcee9c0cd33141bd3aa7e1c49437e3413201", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147060, "uuid": "82f3ecfe-96ce-4bc3-8a6f-881ef9d2ff1f", "comment": "Malware payload (AgentTesla)", "value": "ed75a86942c8c1a1bb261a411614bc64deb6d600557a23a1c4f0d19ff9031bea2f53b3acb520a378f8d9781f4bf2d1f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147060, "uuid": "951f016e-662f-4c12-94d7-baf35c811d3f", "value": "7745D00BF6049A45C8992238DCFFC2742375DDDB7C528B0A2E987AEE3CB2355CD552A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147060, "uuid": "cb4dba6c-8ce1-404b-81bb-d4ce94355788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147060, "uuid": "a884b804-7bcc-4fcc-8756-ed6d4b6e8dee", "value": "12288:7mKQrJhzhbGHEdHDncWxGI0g6qFBfn2IzgQ8aXSayA7ec1Egh5:uJhzhldjT4grrJB8aXGJcagh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147060, "uuid": "d2039538-52a1-4b38-8c38-285f52978e37", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147060, "uuid": "a21ebfdc-f5fe-4439-be59-07f45475fcbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147060, "uuid": "31d3aec6-9cd2-4229-80a6-a7ee4508f35b", "value": "SecuriteInfo.com.Trojan.MSIL.Basic.6.Gen.27145.9998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45863ec9-da7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625152143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152143, "uuid": "1392d715-8d57-491e-958f-c4e1c8e70945", "comment": "Malware payload (Loki)", "value": "aa22e0716f2f4cf5cd59cd46f8645575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152143, "uuid": "7bf3c036-bc3a-4f5b-bf97-54eacf2978af", "comment": "Malware payload (Loki)", "value": "2070d6f358d9a25cce07e2179d7a4625bca289e433a74718bc9300350f1d3e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152143, "uuid": "ad15b497-ff77-4c97-bfbb-d29c32cd160e", "comment": "Malware payload (Loki)", "value": "beb3db7e8d4f765b6b0f5ac42fcf5a16ba169118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152143, "uuid": "5daaad30-f981-483c-9511-1fa892303e22", "comment": "Malware payload (Loki)", "value": "d13111158ad28bd0160801c66f1bf0472d0037f88842949549cff9cf8bb89e5131fea4a3e646a5c90fdc84dc02e2d42a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152143, "uuid": "ab5c280a-db2a-4b15-a1e7-3d88190bf0ba", "value": "79D48D312AE94229F0FA9F77C6B7A44057FEF5235F1BD95D3C5022C90723A42C9B162A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152143, "uuid": "de9bba05-9234-4b44-b363-821bc14d78fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152143, "uuid": "083525b0-64f4-49f1-a3e9-19dba4b9bc22", "value": "12288:jp+yB1EOGQysGIqvRl0DN1+hXfmO81dyZiCgb:jPJGRODWf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625152143, "uuid": "9f80840b-c675-4242-aa71-d87f00e7a581", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625152143, "uuid": "b9cad12e-4f3b-43e6-8c6d-0a07b53fb2f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152143, "uuid": "cdf96094-c558-4092-a8d8-0d6342a86990", "value": "RSZYOTNF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5f2427-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134791, "uuid": "871ad4f3-342b-4e01-8026-e9774dee6875", "comment": "Malware payload (AgentTesla)", "value": "78c26c6d6fafc8c472d053c5dc31d081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134791, "uuid": "0c3c7039-f73c-4ecb-852e-1bd712d0681b", "comment": "Malware payload (AgentTesla)", "value": "21927bf4f06796fa88673a1c57da732c96b0db449c79006c9b73f48ac18f0a89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134791, "uuid": "af9362fb-51d4-4d92-8dde-6b52d5504105", "comment": "Malware payload (AgentTesla)", "value": "1d7bf87bdd9ae7c751547638a235538c3c5af524", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134791, "uuid": "2b687241-f0e1-475b-b11a-861a83ad33e8", "comment": "Malware payload (AgentTesla)", "value": "c082d6ff0a63c35e6c6f5ad2cfc651dc927bd73d3ce96526e73198f7a99e9b9a7e56a596425c0c09d78406076da018c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134791, "uuid": "8f686bdf-2738-4af4-a681-602bce7d815b", "value": "3EE47C202AE84639F0BA9F7E95B4111557FDF713AF23C95C3CB551CA0723A41CAB172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134791, "uuid": "40c9ae15-cb9a-4b43-b121-1abce46484ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134791, "uuid": "d808f948-844c-4aff-ab40-402c33c34997", "value": "12288:5G+84fqBbX5TyCOU4hnYWkNOqIiH30env4Q+pr7WO3Hdlu:I4fqOYWkNx0envp+17z3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134791, "uuid": "ad101ff7-9bbe-4e61-9e47-1e5401d6916c", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134791, "uuid": "bbecf83b-2d13-49a9-8eae-5a40f96f0a75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134791, "uuid": "6b480c2a-df76-4f5d-9bf1-cbe6b8f1841a", "value": "78c26c6d6fafc8c472d053c5dc31d081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43462f5-da41-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625126156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126156, "uuid": "b358993f-5352-4eb4-86bc-21ead6d85025", "comment": "Malware payload (RemcosRAT)", "value": "36b4a8ee8074c2577246d6352259abae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126156, "uuid": "9bc0ac63-af48-43af-9e0d-ce38a3c9cdf9", "comment": "Malware payload (RemcosRAT)", "value": "219fc775299b765c2a1626b602f478d3642139dc243a46120281843bdb5bd5e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126156, "uuid": "90211d34-f39c-4127-aa15-ae36c6aa0934", "comment": "Malware payload (RemcosRAT)", "value": "eba14adb59e5b8c8a37738ac94a79406ac783245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126156, "uuid": "4653e1f5-7590-460b-840f-276311d16aa8", "comment": "Malware payload (RemcosRAT)", "value": "463a78e815d557de4636f4636d887636959304302f084f27b0125fde398bd40635b9bcfe34b5217444cb0be39e101d71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126156, "uuid": "bd93aaaa-6864-4e2b-a35d-dd2bddded602", "value": "B4D42320B21C609BE15D13B0749625C2827068CB64E5E7FD2DFE7ABE14F939E4E91F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126156, "uuid": "6ac21dba-8fcc-40eb-bb50-a275c7533557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126156, "uuid": "cb7ec324-86ce-4ccf-b5d5-88a0321a6992", "value": "12288:dEFVzMFuJujIh3XhkD20JlHaNY3aGVv2H9/dNS6rjNUOxhg:qauJuAn8J5/5vSDrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625126156, "uuid": "8d4606ae-caf9-48af-9d33-4d7396dbbe66", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625126156, "uuid": "83b38fd8-a939-42c2-a4eb-28b2cb8f6956", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126156, "uuid": "bddb808d-dbc1-4290-b027-95d23ca8a15b", "value": "36b4a8ee8074c2577246d6352259abae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8ec8f6-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625122999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122999, "uuid": "fb272728-a29d-4df2-890f-13b09bab40b4", "comment": "Malware payload (SnakeKeylogger)", "value": "f661d62498c92b7f4c8ad3a6aa000b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122999, "uuid": "545b8066-6eba-4139-b281-77362a06af66", "comment": "Malware payload (SnakeKeylogger)", "value": "21fdc7575a436316c0235f3240191d0e4773e8a54d1d088c76cfab7c705bb0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122999, "uuid": "43a7e1b7-6d6b-4a55-bff1-d13e460096e1", "comment": "Malware payload (SnakeKeylogger)", "value": "10159498e92458d4c5dc00b76af95da5a6cea4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122999, "uuid": "771d343d-f55f-4a49-ab1a-9351a6603dd7", "comment": "Malware payload (SnakeKeylogger)", "value": "c95938ffaa06904079b46dbf6af0626fd71f79d87d44f3e3e6e9349f125978d622339a6f8c5f13ce534a642c3bf980b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122999, "uuid": "03651413-6179-4046-95d9-26f5ff53d8df", "value": "80B412283BFC11B4D2B68F3B67F03155937CB626790AE51D25C2428F48D7B81CED1A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122999, "uuid": "4106146f-fc76-4aa6-9c0c-cc3f9957ed7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122999, "uuid": "8f4374b1-3b5c-4303-a6fc-2de4a7d0a672", "value": "12288:VzUl74ulJfv8/agskKiefd+sBUcLiet5x5nFw2:m7lqcLVpUcmetRFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625122999, "uuid": "9467c2c4-9855-4d22-bd46-e6dc70c8fe30", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625122999, "uuid": "9bacf508-1a8e-4072-8a37-e62408755638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122999, "uuid": "a4036754-0987-46d8-a864-da81b9d0e4cc", "value": "SecuriteInfo.com.ArtemisF661D62498C9.3864.3151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be17cb37-da7f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625152774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152774, "uuid": "e1ca982d-beed-4239-b432-6021f7053063", "comment": "Malware payload (AgentTesla)", "value": "10b3e8971837b0dce74ea3b09d938be3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152774, "uuid": "c1377717-f65b-49e5-917a-6e493e1bd3e4", "comment": "Malware payload (AgentTesla)", "value": "228638e7a1c7f902617aa1b7f1347b339d4ef673fb25885650e278b49b7f9d2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152774, "uuid": "eb6f298f-ff0d-4e63-9a47-62ee75811754", "comment": "Malware payload (AgentTesla)", "value": "1cabdf8a6752cf463dd0c72929f95485af9e45bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152774, "uuid": "324c0f4c-a5ee-4ca9-95b0-eaf8c654928a", "comment": "Malware payload (AgentTesla)", "value": "7f1d76a1192ddac40a7f3ba574f6b318a1be003d0fc58e02974974fec4f68ed55430102902800f27b2e86999300d64bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152774, "uuid": "3f056155-8f21-416e-b12e-535bb9cbc1b7", "value": "2CD4122D39ED427AE5BFCF752AE9B1A19EE973626707D50D30C2131A0713AC09DC1A2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152774, "uuid": "d53c1863-1848-41d0-8743-2ab834e147ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152774, "uuid": "93cd8d9d-bff3-41a6-8ed5-4e3b00862559", "value": "12288:F1eJa67qkIlOBBnb8mEOiVFu8W4Ixh7kvW5aeMbP+uibsLoyNDonTIWSL:zeJzqkpvE1Rq72WRMDWsLdDonMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625152774, "uuid": "b7cca53f-6d6c-4ccf-8a27-6a217473119d", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625152774, "uuid": "a51ac45f-05d5-48e3-87f5-4fa1b706d4b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152774, "uuid": "fa77e3e4-7838-45e4-b5a3-a2a4aa7b1ed9", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5da3746-da2e-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625118052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118052, "uuid": "f3a83cce-19d5-4ec2-946d-8ab5423d0fe9", "comment": "Malware payload (BazaLoader)", "value": "215e0accdf538d48a8a7bf79009e8f9b", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118052, "uuid": "e9581b86-9501-4d6a-bd7e-7b0a844480e2", "comment": "Malware payload (BazaLoader)", "value": "24f692b4ee982a145abf12c5c99079cfbc39e40bd64a3c07defaf36c7f75c7a9", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118052, "uuid": "d205eb14-3cbf-4dbc-9c3d-0b392ddfb061", "comment": "Malware payload (BazaLoader)", "value": "4ff45fb8003ab1075bdbbc9d044b7c31374f3cdb", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118052, "uuid": "52383e0a-022e-4779-a041-6a6f977fd8b6", "comment": "Malware payload (BazaLoader)", "value": "cb174080ba91ec8ee48cabf6d6b23bac41d5bfb920eb646917d4c022adfe4359b5acd0b452872c295c297b33a6c763f6", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118052, "uuid": "0ecb94dd-3006-40a7-b830-f9d76a32a013", "value": "0B54CF09B2B508ABEF6F9BB680939601B6723821C3759FDF475483799E0EBD0453AF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118052, "uuid": "da76c0f2-0ed2-408e-ba4e-0576280394c1", "value": "365e89d9a085550ede8ce40eaac82aca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118052, "uuid": "d613fbac-d743-4dcf-aead-930b4612b62d", "value": "6144:gc3BqZ6NCDsPC5Ufc8epw3GWRMO041VTPnrsb9hkf9Q:gt5UfujOhVTPnrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118052, "uuid": "3a01defc-3e38-4d1e-80af-04a7568c9cc6", "value": 291845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118052, "uuid": "fa50dc73-a54b-4d84-adf6-2a32b4954eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118052, "uuid": "17399151-a5a2-4a70-871a-99b6fc72a34b", "value": "215e0accdf538d48a8a7bf79009e8f9b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f1b08a-da27-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625114831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625114831, "uuid": "e5e5ac02-7b11-4eac-8e1a-1fbfaad65166", "comment": "Malware payload (GuLoader)", "value": "bf7e2cfd3aa19fc92eb1574b5004d3af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625114831, "uuid": "c3937690-fb47-45c3-9a5c-6ad490f6add9", "comment": "Malware payload (GuLoader)", "value": "250089a2a47ded2fa9d117d80b35cbf9c0119fbb6d1586cc516186cdc8ddf770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625114831, "uuid": "baddfab8-022f-49ba-a7e7-08a8bf70b7ca", "comment": "Malware payload (GuLoader)", "value": "dd784df8ce6f8be07f8d563d073b561f1d02a656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625114831, "uuid": "42cb3526-a082-40f0-b293-e540cee7f0d1", "comment": "Malware payload (GuLoader)", "value": "71ed9bd332147c29a52be6a2127911f11518fa49141e0fbc81f061b5855d061de22ef0d1dc3e083170c2dce4ed93cc3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625114831, "uuid": "3ee3a800-a9cf-4b64-8294-ea5a8e4268db", "value": "16D34CD3F950E684E448C9B1B916DABD2A197C3651041E03F384BE0B39756D3F3F6A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625114831, "uuid": "d9c326f7-a95c-4065-a49b-77604c29354a", "value": "0e1d7223078daa4940364087de70eab0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625114831, "uuid": "f6fcd314-bf11-4a2e-9f83-e1b1bf1792d3", "value": "3072:FJHWRSvR2IZjmUresirnuQNwSizQAR8m:vUSJHCUasG58R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625114831, "uuid": "f148eb07-3154-47e7-9b2c-d7c941bcfffe", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625114831, "uuid": "210b3a9d-137f-4bec-b922-d6d7cf5aab82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625114831, "uuid": "f16d2cea-b388-440e-b4a5-cbade0bc0799", "value": "rNew_Contract-details+Consignee+NotifyPartydetails-1-7.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8d2c95-da72-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625147058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147058, "uuid": "93471c54-6a1a-45f6-b195-ef7b0e3fdab3", "comment": "Malware payload (GuLoader)", "value": "a642407a68b5d65b8ec864c6b7fea8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147058, "uuid": "bea4180b-aa54-4adb-a5d5-4718d9d9b05b", "comment": "Malware payload (GuLoader)", "value": "2514f9ca9dd6b0af56778ab646f7f460ad976db71d4c782164fbf44b52f9d035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147058, "uuid": "c1d5fe92-c348-4341-b82a-e3ab3153423d", "comment": "Malware payload (GuLoader)", "value": "2f57c64e1efde2400996f818aff24909482ae68c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147058, "uuid": "4d58ea32-b288-4b3a-adb6-f47d68b14308", "comment": "Malware payload (GuLoader)", "value": "224913398de3d86b4c15d03ff4f7d84f8bbe267c2ed3d984adf6e6feace237fdbbe33d33498677a048af7fc3bcc6e474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147058, "uuid": "1850a6e3-7e98-4031-937a-56a88445a8a4", "value": "FAD373537E404149D9F15433F52E0445A90864AB7D024ECBA3F2A649FB7CAD3B6BEB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147058, "uuid": "cd2695db-856e-4a9d-a3a5-01dc4ee24b88", "value": "32122f333e5389674e4bc7e05959e542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147058, "uuid": "bc58ad78-1cfd-4a24-9b3e-a36846fc012b", "value": "3072:tqx7MCdrYyGOve+VsiZhprSKx2lA/QAd:tqx7MCd2EeSsmrhx2lA/QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147058, "uuid": "3f29346b-fcdc-4992-ac10-1ce8fb02a50b", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147058, "uuid": "6fcf9589-555c-4894-b598-43c5fae0fda0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147058, "uuid": "a3dbdac5-f46d-41d0-bc8e-cc6790c1add0", "value": "SecuriteInfo.com.Variant.Razy.884489.8042.1706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef25e3b-da63-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625140455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140455, "uuid": "d5e1a569-f7b5-4c56-b7b2-2eb4bbf91cdf", "comment": "Malware payload (SnakeKeylogger)", "value": "58a3b89df130cf9f9d789c4d8739520c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140455, "uuid": "fa23260c-0cbd-4240-ac8f-f77090ab1635", "comment": "Malware payload (SnakeKeylogger)", "value": "2552ac3f021d90df5817a4ab62448f4495ec0194f2ff63d5afbc45c6e668047b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140455, "uuid": "7b07380c-5f37-4861-a986-e4c1cff3248f", "comment": "Malware payload (SnakeKeylogger)", "value": "5514771d8da1eaf3a2c5b5d5fc26146710fc2790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140455, "uuid": "53ab39c9-87e3-487c-8abb-e5c13f2792e8", "comment": "Malware payload (SnakeKeylogger)", "value": "654788702c09e8d237c269e24e8dc7634ba4cb10af28d92c4a4ff7d5a167eff563bde8021d072f5882ca33b118a6d166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140455, "uuid": "98d7045c-22db-487c-b255-9a07caf3adc3", "value": "0BE48C583500B39FC49BDA35CD64DE20AB617EA6930BDE07705331A89EBF3979F051A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140455, "uuid": "9ae76565-a6f2-4a1b-8cfa-1c357aa986cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140455, "uuid": "9880bb91-666c-408f-8f99-b88776fbe18e", "value": "12288:QmSTQpvfl9r5UM10uj5V0oCp71MOww2hb31c6mEl5Z2srw+yVi1RUO3:lST0fl9r5f1h30xiJd31c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625140455, "uuid": "fcebf722-a94f-43dc-9e89-d15c2aa00651", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625140455, "uuid": "b686a868-047f-4cc9-9e47-6b5dfbea740a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140455, "uuid": "4630908c-3a57-4708-8eb7-f1cb83162e21", "value": "SecuriteInfo.com.PWS-FCSO58A3B89DF130.32237.22162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5203bc3b-dac0-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625180510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625180510, "uuid": "6f91695a-01ba-48fb-ae63-387ab02f75ff", "comment": "Malware payload (DCRat)", "value": "a3e65a51e8671ab491a48a61224e803e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625180510, "uuid": "661b1f10-5d77-4c25-b1bc-36c0e4581697", "comment": "Malware payload (DCRat)", "value": "259ea4e98e396bfcc009c608c6ed9df29115dac534347a7454cf98a97bcef93f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625180510, "uuid": "3a86adb6-5349-405e-83d2-005e919b91f9", "comment": "Malware payload (DCRat)", "value": "0688ed4e174ec65c964e632c6d70c8530f7e4a4e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625180510, "uuid": "113ac17d-7a47-4438-9a2c-6442933bf1ac", "comment": "Malware payload (DCRat)", "value": "2a1500cf26f50c14c6355a090a41d7c05f0ae81ec6de04a8272649e958ce858f65bbd200d25cae93c3ae50d329d91cdf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625180510, "uuid": "d94e3a58-2c8e-4314-b34f-2f4405516ea5", "value": "EE3507423A46DE02D02D2637C9DF447407B8AD017B66DA1B7EAF33AC65523A71E0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625180510, "uuid": "1c149080-3753-4451-aeea-d9a3d27a7ac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625180510, "uuid": "3d06b681-ab9c-4a52-961a-310ca06a5712", "value": "24576:6KXtEURK+SMRFJwW7RzwW7RQNsKwW0RWNIRwW4RiOpCGwW7RiuIy8ihb6gSmUvnh:6WtEURK+SMRFJwW7RzwW7RQNsKwW0RWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625180510, "uuid": "6807d44e-82e0-4a4a-bf71-cec9b53d5b3b", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625180510, "uuid": "0f2bdadf-5a47-4fd5-b715-8940ec65c27d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625180510, "uuid": "8325710a-295d-4d08-a13c-8d83ea4c37db", "value": "a3e65a51e8671ab491a48a61224e803e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7a5e7d-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169385, "uuid": "704d4189-52ad-48f9-8e59-125bfad6c9d1", "comment": "Malware payload", "value": "06d72a4d99fcd76a3502432657f3c999", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169385, "uuid": "c34adcff-3d23-4936-9238-536df88b2fb4", "comment": "Malware payload", "value": "27312973aefcfa2511573a28ff42ef12ecbfcf56db42bf4d1371b0a1f1f2732c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169385, "uuid": "e0debed1-266d-4e89-852c-b8bdae7f1728", "comment": "Malware payload", "value": "9976e5121c264a2b0dcf09ddd6c8cb53fdd964f8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169385, "uuid": "ffb0da22-659d-4a49-84f3-82fc9e79cadf", "comment": "Malware payload", "value": "12dd64ba1ac83aabf6a36f427449d1f130b929a7bc57bf684d6b8506a41ac57e222bdc1ad7efce88500fd37c86e501cd", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169385, "uuid": "b0a3213f-1d0a-48b4-878c-6efceb2f538c", "value": "73935B20F5E8D472D02705B17AA9ABA6417EFC30673001DBF7584FB96E611F18A3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169385, "uuid": "09e7ef2f-c9b2-47d1-a669-ce607cabdf06", "value": "e92f23a31d750ca8bdcb33464b923f85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169385, "uuid": "ecc1b228-c3f0-47c0-9645-b95148541eec", "value": "1536:3XSjp9WAi7TqfEkNXKPnKEgX2MNeUXkTM12Ar9jqrM/Wm6T+KnkEVSJQcyQaoA:ng87/FgX2MVkwVjhOt+qcyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169385, "uuid": "3e3f07c5-5ce2-46d3-ae49-4e76636ce6da", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169385, "uuid": "f4ccadb6-a4db-44df-ade9-cf9056cbd900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169385, "uuid": "b888370c-39a5-432a-9765-508adcaead8c", "value": "27312973aefcfa2511573a28ff42ef12ecbfcf56db42bf4d1371b0a1f1f2732c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec797f1-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138226, "uuid": "6fad108f-8422-4c55-828a-757f92c5d20f", "comment": "Malware payload", "value": "037e717de225d305363e9b27f3165334", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138226, "uuid": "40c3a8ba-72e2-496a-b135-8d4e122a45fc", "comment": "Malware payload", "value": "27c35f54517bbd4e9ce9ce6760bef19ca49a3d1bb31397bfe50a5ce996ae9757", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138226, "uuid": "24ef0250-1fca-4c16-a9f8-21132af11f4e", "comment": "Malware payload", "value": "d5ff19d88e25888394345d32c9da6f86e3a7783b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138226, "uuid": "4b47cbd4-e74e-4748-b5cd-de4661b931b1", "comment": "Malware payload", "value": "ad1a27b9d5960e8e3b36a6274090a450b40dd8e8b392194747e40ea42ca91d9b79b12f7916562d284657a454b7536fd4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138226, "uuid": "3ba2e269-5dbe-4da8-8ef8-69550abe2326", "value": "91A24006F7A9C99AF2120335D99BC294B36ABC5C6D81820FB7583F0EFCB18B55B12750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138226, "uuid": "18325cd9-619d-4e00-8dbc-1360a1162fab", "value": "96:TjnR6rOGgx4b0C6Zjp6bfu/OpK81Efkp/XxFpgNV9LFqEOLrKr+EF1h:fn6OGgG0C6/6r28pp/lWRxorKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138226, "uuid": "b6b31aa6-3008-4802-9b5c-d6cb270cfb02", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138226, "uuid": "f3c427df-a7b6-447e-9be7-2ae4d8cf3310", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138226, "uuid": "ed2d2d09-2b55-4009-8e4e-e494b4903eee", "value": "27c35f54517bbd4e9ce9ce6760bef19ca49a3d1bb31397bfe50a5ce996ae9757.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91676551-da20-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625111897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111897, "uuid": "fb59bec2-decb-4fe1-9197-341396d6c2ae", "comment": "Malware payload (AgentTesla)", "value": "0603dc717aec2c00ef1dc39a5874e4c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111897, "uuid": "b0b9eac5-e6d9-4b6e-a663-1cf49eeb01da", "comment": "Malware payload (AgentTesla)", "value": "28a2c2e93e324747394b8b7da0e872ccd8aedd4394fb8f571a9df5e10f58e36c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111897, "uuid": "5a819ad3-7b40-43b6-b869-aad9b62c525b", "comment": "Malware payload (AgentTesla)", "value": "455c1263726dd0a175fc3012958f4a41666ea370", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111897, "uuid": "aa64c7f3-3e25-4c1e-8518-fa4a2ca576f9", "comment": "Malware payload (AgentTesla)", "value": "eca771da344a3bad1e54197b2781b8aa4e8f86b00a10aff00ac5a101367ed33e05b38f56f6454c902450c33ad578df46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111897, "uuid": "1aa8776b-d141-43de-8426-34b2d9e24424", "value": "BC45D007F309EA55C5592238CCEFC2B113B5ED9B7C228B1B2D997ADE3C72311C9516A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111897, "uuid": "4dfd2baa-8517-4fc0-bddb-0c24cc1732bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111897, "uuid": "3dec058e-a39f-40d5-ab93-ce88c89e1a3e", "value": "24576:nihzh88W72jL+m/aqIRqRZx7JPE2xUhx:nihzhSajL+eR2Dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625111897, "uuid": "77fbee30-eb51-48c5-95dc-aee15b74359f", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625111897, "uuid": "e60a3d59-0195-49ef-a2df-a0588081b5e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111897, "uuid": "4d9a6f06-1f80-4101-a5e9-40dd7d417057", "value": "SwiftCopy_30-6-2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c278c2a4-da74-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625148057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148057, "uuid": "8f854f51-bd78-49e5-a4c7-483db8d2a192", "comment": "Malware payload (BitRAT)", "value": "ea162544ba39974ea76f27d5db4c15ad", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148057, "uuid": "4cbaacae-beb4-405f-b54c-483d6266208e", "comment": "Malware payload (BitRAT)", "value": "299afdf96e5691a426fc9d0579dfde112bd6931c961d688b83c984f2f7f67be7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148057, "uuid": "a5b101fe-696a-497a-a379-4c7a5924bd2d", "comment": "Malware payload (BitRAT)", "value": "235cfed92c310e473546290573836de59028c4da", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148057, "uuid": "b8fb6f51-601d-4874-888c-e84012b22b46", "comment": "Malware payload (BitRAT)", "value": "dd9e6d004eb12fff4a8ebc5d5973158c007d916b64540c30ca4effefa4adfa95aa73b7b8578beefbfb71a571078afed7", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148057, "uuid": "2b99ba85-c646-4620-991e-0188853143b0", "value": "B675236694A2DE22DF92CA70F9D61FC31972AD1172AED73E1F9C3398B63409D1CD9042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148057, "uuid": "5f60f472-5fb4-4d33-bf28-9ecf1590bac6", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148057, "uuid": "80699c33-67aa-4dde-ba3a-282e12035d54", "value": "49152:ARy93Dnysu+ykh3w6cEWxTq1QKj7elDWm6y9gt:l99u+ndkpxeCI7e0uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625148057, "uuid": "30824b21-6da6-4ede-8c1d-176764234d21", "value": 1574961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625148057, "uuid": "01463d4d-bcbf-4f64-b0c3-51862fdee38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148057, "uuid": "3b32dacf-d841-48e6-a155-2f3c33c2678d", "value": "June Accounts Statement -Payment Slip 0629202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47b7be9-daa0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625167039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625167039, "uuid": "3a75d316-f319-4148-a7c2-894c09920bd3", "comment": "Malware payload", "value": "58233026044bd575674bf9f12f2232d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625167039, "uuid": "d08f3130-b285-4b60-b0d2-1e95c0b8b02b", "comment": "Malware payload", "value": "2a69e5bbc8ccb77889ed50ea10278bd6b2076211d2a00a76b35526c7b3383953", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625167039, "uuid": "608447ad-6bfe-4fa5-a1ca-1756b48d331a", "comment": "Malware payload", "value": "b203d2b9d4565b546541da484081ca42ac367fa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625167039, "uuid": "f9848be0-1820-44a7-83f8-5051a6b103d9", "comment": "Malware payload", "value": "c1a02fff2ccc2dc4da3d26639604e1660196bd9cc2d4664a6d460c6e128408ae64393cc1a65ac39f6a108a981830bbc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625167039, "uuid": "2038c61b-adc0-4dd8-a1e7-6f7df9bfd4be", "value": "5754AE923680C472C58245305866DBA15BADFC7166B34A07F7A93F6F6E332C129F631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625167039, "uuid": "ee84c450-4fae-4f52-af80-378512b15d83", "value": "ba9b0f2c256a509c08b05c60ed64bfb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625167039, "uuid": "cb074870-3b6f-4ed0-8648-542847e16cec", "value": "3072:BYtIgFMLbNVwvGIRzs7xiusilnEGTupzFb7BnqTS:BwMLbMvGSMxNsilnBTSBUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625167039, "uuid": "b16a80a6-f2c3-4264-b415-c3b6f9c90f08", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625167039, "uuid": "c5a92d3f-5346-44f1-b0b0-940174b81ce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625167039, "uuid": "1523f810-3787-4814-8822-c16c608dc089", "value": "58233026044bd575674bf9f12f2232d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae55d6c3-da78-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625149742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149742, "uuid": "fc7f9021-9824-48cf-b9fe-595cb7d3fdd0", "comment": "Malware payload (AgentTesla)", "value": "e7c50599e02eba9857e0a594388ea8ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149742, "uuid": "062f0d63-eb38-4d7a-a602-0eebf5475f0d", "comment": "Malware payload (AgentTesla)", "value": "2b93abcfcf4c5489dfbc9a9849b2743dd82b0f09f2b772cdc73f3f4721cb9d1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149742, "uuid": "c6af2d02-1d55-4850-a0f6-68182a05c3d4", "comment": "Malware payload (AgentTesla)", "value": "7bf35b65d3b8e8ae6f46f76d06690c5c2d2bd5e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149742, "uuid": "5bcf1a87-2e19-4149-897e-8616a0e5aef3", "comment": "Malware payload (AgentTesla)", "value": "2e09080d1405c368603b99b3899143ee6f7fc5edced1b6b11c0646a5d9246038542619d0007c95488f20a54a499c495d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149742, "uuid": "2c426da7-390c-4f97-bd6f-f8e8cf7cac95", "value": "8BA458EAA5D8FFD7D1BB22712EE472004B634B5928115204ABCC751F37625CE2792F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149742, "uuid": "f2c82bf4-f68f-4e34-b939-dfed1e5215ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149742, "uuid": "3bf1350e-0efa-47ed-84d8-b0e0882e3190", "value": "6144:AY+/0cmapCiV99LDiF+lVUynFE3/FBFgR8gUI9RTNlhruFwAdlK711W:z+npFDiF+lVHe3/FoR8g99DqdlK7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625149742, "uuid": "ad8771ea-a5c9-4ac6-8e25-295faf6cddcc", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625149742, "uuid": "0023d399-a936-4c51-a5d3-c003e728148a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149742, "uuid": "0c60043b-43b3-42c4-94fd-147a280e946e", "value": "e7c50599e02eba9857e0a594388ea8ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188afe59-da48-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1625128874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128874, "uuid": "48165fcd-b6f7-4ee7-bc1b-9bc3374717d6", "comment": "Malware payload (QuasarRAT)", "value": "3fdc0562359efa1d73c2d20ec798783f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128874, "uuid": "b5a07bf9-6cd1-43fc-b230-d10f92dbf3c9", "comment": "Malware payload (QuasarRAT)", "value": "2c5d00f71931d80367ccae6bdd752ec56ab7647cc5312a0c7ddd24308ff9cc8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128874, "uuid": "0968b899-1188-41b2-887d-497263589c44", "comment": "Malware payload (QuasarRAT)", "value": "af5cac70104e7d8449c39931ecd30d726a1cdee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128874, "uuid": "0b901f5a-f665-48de-b7a4-684775bdeb1e", "comment": "Malware payload (QuasarRAT)", "value": "0711f31a255fe1cae7475412404e7e39cf6c4d9985157dd15a26664f235d3b54b4dfc68aa60b706ab7eb21be7d6e9a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128874, "uuid": "c91542cc-4cdb-4dc0-b058-a6d7f0c75593", "value": "69B46C4063F8862BE1AF577AE871142597F4F407B2ABEF4F4A40A1F92C667069D80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128874, "uuid": "0103337a-48f1-46ca-80e5-addbee666eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128874, "uuid": "1a3b86e7-2da9-41a9-a82a-9019129311e8", "value": "6144:8TEgdc0YRXbZvdo6EsRwd7dHD3HRXKlh/2+X55QBcEp8b8F9O689IVkeE2cTR3q:8TEgdfYHdo6GdDKx5QZncqVs2cdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625128874, "uuid": "6d125c74-87cb-4d7e-b121-94d1bec13b0a", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625128874, "uuid": "416cc9d7-3605-44cc-8b89-a7664a012416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128874, "uuid": "e86eae88-ceaa-4199-9815-e3a87efa3e24", "value": "3fdc0562359efa1d73c2d20ec798783f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd70587-da15-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625107006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625107006, "uuid": "efa0c355-8432-497a-ad8f-936a2d820154", "comment": "Malware payload (BitRAT)", "value": "a5aafdadabb57fcd741c68d35243dae9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625107006, "uuid": "d6070bc2-68c7-4cd6-bd8d-0d33d297ee1b", "comment": "Malware payload (BitRAT)", "value": "2d01db532167eebf691872391503f9a78db139e34310814e25498ae0637f93c2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625107006, "uuid": "0eee64aa-b37d-4fce-8963-56fd1e9d3920", "comment": "Malware payload (BitRAT)", "value": "d2272257bffb0e64a434694750bfd771e0fbb592", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625107006, "uuid": "3a112bdb-0a93-4ba2-a06f-15cb099a7576", "comment": "Malware payload (BitRAT)", "value": "e2dffcf338f2d3e440e821e602130c5d66cb3f9610bacd59116babeb36912925efa374bff5a75ea8ecac330421b9a151", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625107006, "uuid": "f3776e7d-9469-4d92-9c13-755210043eec", "value": "7E853361E7B15631D7558AB764632CC402A8CFA0E46DEA477BEF280E0F23F5D67A1231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625107006, "uuid": "fdf08674-61e9-426f-9295-517fdc2b77fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625107006, "uuid": "a40f9b34-c7e9-47c5-9f34-f2de819ab490", "value": "49152:0aFLPRYqIzkXcrWTCQY+W9SaxYS3gG1Ih:JFLpp5TCDpfxNdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625107006, "uuid": "b9f01ac7-e73d-4207-a6f1-9798141b7184", "value": 1781760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625107006, "uuid": "0ca54d6c-acd9-4b63-84d2-64ca70aa8c28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625107006, "uuid": "e2001b86-a810-4a87-a9c7-35cf74a30ab8", "value": "a5aafdadabb57fcd741c68d35243dae9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057a1b04-da1a-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625109086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109086, "uuid": "52fa1f76-c746-43d4-b734-cfd8ece6ac46", "comment": "Malware payload (Vjw0rm)", "value": "a80644c814a5b9c8f0618cd82c6c89e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109086, "uuid": "331c5ee1-e706-49d8-beab-0001d1181b61", "comment": "Malware payload (Vjw0rm)", "value": "2d3675bba3da579b093fd576fca9d1a47a3100d358391b5b7f3a368ee35a69e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109086, "uuid": "c0f4bf60-f729-48e8-9c81-bb5b16816cce", "comment": "Malware payload (Vjw0rm)", "value": "1f2719208472e54401e66978d919474ab7146a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625109086, "uuid": "63dfbd4d-7686-4333-ab4b-e0aa09c5c69a", "comment": "Malware payload (Vjw0rm)", "value": "657f19855833cee50b1c8e0a5a3a3e1a39b97bc08e8149f00d135aa8d8f8ffcca266fb828b67cb988c3c9b642cc9e972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109086, "uuid": "af5fbcb3-06ad-4787-a8fa-02a27de69668", "value": "80D5335E7D52EFA0CD2D963E26F4E566CE811E06CE16C21E1C1463BC4F9325B910BECA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109086, "uuid": "2eb0e7ee-d452-4766-974a-9a89f9074dd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109086, "uuid": "2b2d051f-5507-4edf-97de-478df15abdce", "value": "49152:H6P07OFkfhDu+G07Eq6T18ZpYn8OS8QdsO7q5AyuC7OzeEM:S0KKDuG7x6T1QY8CQKOhBCSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625109086, "uuid": "a09725c8-bc17-4033-bd70-1a4ebd73f53c", "value": 2914816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625109086, "uuid": "295a3724-16b7-4a49-8c46-758f8412ad84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625109086, "uuid": "6dd089bb-e25f-47cc-ad39-eb74efd8ec57", "value": "a80644c814a5b9c8f0618cd82c6c89e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1d370a-dab9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625177791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625177791, "uuid": "fb182bee-85ef-4868-801f-0629efafb78f", "comment": "Malware payload (RedLineStealer)", "value": "98354cba4193731c065c13683e996138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625177791, "uuid": "c3e8922e-6f55-4654-af6c-9cf1b93ca7a5", "comment": "Malware payload (RedLineStealer)", "value": "2e2bc0ade577e2f509754da94fa4b5c3ec925964c170c00d365b7307f1716862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625177791, "uuid": "223e9afd-f17b-43b1-a912-38fba5248b55", "comment": "Malware payload (RedLineStealer)", "value": "5145ba796aaf5e1b7f3ce56defc310fe467fc736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625177791, "uuid": "eea0e12d-2810-4a6c-a022-4165ac29d0fa", "comment": "Malware payload (RedLineStealer)", "value": "9b036d9eeda01059ae91356017ad2a8199db0aba2a303122178f81c8d7271e0fffaa4667a43773bb0db49166f6eb1197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625177791, "uuid": "02bae2c4-6a5a-4837-b1a8-d6745a33d802", "value": "2703D215974800BEF44DD13FE3E24831EF32A69F3926EE2A6DBD81FB08166471464B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625177791, "uuid": "a7c05aba-9ed4-444b-abeb-863375ac72bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625177791, "uuid": "1c12379f-67b9-4ffe-a636-768b9b38f7f8", "value": "768:LLYxQZ6++hIduJJ1U1NCOLtuEYzob6vWccgcccI5BrZIYaF/kgWzC747/SPD4uCC:LLYxQZ6++hIduJJ1U1NCOLtuEYzob6v2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625177791, "uuid": "2c5034f7-eae6-4d8d-992d-a4692c1d295c", "value": 39616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625177791, "uuid": "8922f3f3-5370-41b6-bc24-0b6eda4a4539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625177791, "uuid": "bfc169f0-78aa-4bb9-b28e-02974e0ac44b", "value": "98354CBA4193731C065C13683E996138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e53cfd-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625133494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133494, "uuid": "1e2137e1-5d5e-445e-8a82-25e4d49179b7", "comment": "Malware payload (BitRAT)", "value": "7614c67e2240964ae0c305cb9bcdc983", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133494, "uuid": "51c42d67-aa10-49eb-afea-7ed60e4fa5c6", "comment": "Malware payload (BitRAT)", "value": "2f60d49257dabdb9d52567d53e84cf10e828caa4e9cac68022f516d50ab2abd7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133494, "uuid": "8c568cbd-1c6b-49e8-af28-0dc4777066f6", "comment": "Malware payload (BitRAT)", "value": "3c88a6811f21759437b8770be5d1b2e7240947e2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133494, "uuid": "a38f0244-352a-4f48-a2ee-bee00353c62b", "comment": "Malware payload (BitRAT)", "value": "0ac680253a44bc9d37781cd92a10b462d4a85a7623f005ccbdbbe02138009c8aee6cef7371c5d768eb9c5a313387cf02", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133494, "uuid": "aad0ef20-9ff4-40ab-8f7e-cad27e726703", "value": "150633D27BF90AABF6058571A2B1B5CC59EEE4C35464BB9E78C5AB4036D040C643F8E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133494, "uuid": "807439f1-3124-4dc1-88d4-56cdf22aa6a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133494, "uuid": "3d4623fa-5602-4b68-a81c-f9d92a04c173", "value": "98304:e0tPb9olMOpfsGMYxEDIwdqgaRCGSNxkr+uboJR:z9b9oJpUGMvDIsqgaRCGlrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133494, "uuid": "2e7f918a-327d-4f32-9433-50c7955afa0f", "value": 3963392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133494, "uuid": "9444c7d1-35d4-47cd-84f0-8baad7ac13cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133494, "uuid": "5bd8a4dd-be62-4cad-81d5-cad5799912d6", "value": "7614c67e2240964ae0c305cb9bcdc983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e02acc0-d9ff-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625097718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097718, "uuid": "239c67cd-2933-4aef-af35-b4ea5347e1aa", "comment": "Malware payload (GuLoader)", "value": "b5571f25836cd41445aa42574af4b736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097718, "uuid": "ca94e083-e203-4d10-a22e-28824e55b66d", "comment": "Malware payload (GuLoader)", "value": "3012b7a51af86d42beaaf6488f7166002226cbaee3ccb92e1c2a2d4b107c3930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097718, "uuid": "bba766dc-f87a-461a-9c26-6dd8bc4c1318", "comment": "Malware payload (GuLoader)", "value": "84ce88c612b86fbd98e3d7b55227d95979a58631", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097718, "uuid": "b44f543a-98b7-4785-9042-ec259e55cf33", "comment": "Malware payload (GuLoader)", "value": "ea4125a9865cfaa91396994b319c87b8415e64d38b64152694054670f451d81d24ad70e40d8aa4c18f57867bbba32ed1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097718, "uuid": "7ef81d28-1059-4b92-8a62-9b2d0a02e3bc", "value": "F5C329577E57D065E206C6B0D000E9F7B830BC76F8528D07BDC1BE093A7A752B1A8E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097718, "uuid": "7a80d42c-6b17-4033-979a-f059bdfecedb", "value": "e32210a377db7dc6108aadf44007bc45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097718, "uuid": "302d6886-909e-4d3b-970f-20cbf5b51242", "value": "1536:NWlMcDP/5ToUTS13bz62av30HmmIoDQBlIAqFJv/x++4Si96Hjvrh0rPgz6vUUg+:shKuAGCI7zqbg7SQyx0vgKBAKBgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625097718, "uuid": "775816e6-1e04-4ed4-b496-34704d36bc8e", "value": 123688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625097718, "uuid": "387c97a1-6908-4307-9e4b-f0ffb13a018f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097718, "uuid": "90018b6e-0f25-4dd0-b062-86389e0c524b", "value": "b5571f25836cd41445aa42574af4b736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73d24c7-da8f-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1625159742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159742, "uuid": "8d25361c-ce22-4a3f-8e21-b252a642ef4e", "comment": "Malware payload (DiamondFox)", "value": "148248b875122d3b9594b68c62be5524", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159742, "uuid": "d5f6310c-1a97-4605-870b-7507a81964de", "comment": "Malware payload (DiamondFox)", "value": "30d4e233e4907544e9fab18f1a979454e18a5954fcff85ae7ead8ca1fa8dd511", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159742, "uuid": "90a333f9-d9b5-47c3-9445-54861df35569", "comment": "Malware payload (DiamondFox)", "value": "0090a30664234e46517c008d0aba4e2765353bc4", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159742, "uuid": "9147140a-0ee9-4200-8d8a-d6cb43b3b3a3", "comment": "Malware payload (DiamondFox)", "value": "7bebbf8164cb73ba73e3ca0c188c6e5b9c816df0e2fd96fe509aee49db8589927b8d37ea7237adb92c4cd8a7b1066438", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159742, "uuid": "94ca9252-cfc0-4b49-b570-19de2573d7a9", "value": "922633E037E054FBCA511139D50597BAE1F6BBC50E2CC4EFEB448A0F1E34EAAB119625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159742, "uuid": "349ce261-95c8-436b-863c-6ddb3ea32537", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159742, "uuid": "eae2b6b8-ee35-45ba-bfbc-644db20bafac", "value": "98304:xQ4NtWdo8jBA/oFOecZmj4mxrWKMx335CM3tWV1kBi6l2CvLUBsKLK:xQ4efjJObZmjxFMx55W/V6l/LUCKLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625159742, "uuid": "ebdf8261-05e4-4bfd-bf8a-efaa82afd946", "value": 4721028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625159742, "uuid": "9a837aeb-b8c1-4c89-a5e2-b17b43ed5e99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159742, "uuid": "5ac044f2-7124-470e-836f-e1b8a60e10cb", "value": "148248B875122D3B9594B68C62BE5524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee62590d-da87-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625156291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156291, "uuid": "adeff06f-bfe1-4b29-81db-29552abd8001", "comment": "Malware payload (Hancitor)", "value": "3f756c0689209815a6519a83acfea461", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156291, "uuid": "8844bc87-ec2c-445d-832f-208dc5658ae3", "comment": "Malware payload (Hancitor)", "value": "3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156291, "uuid": "6375bdaa-301f-4043-aedb-b0bcdf77319b", "comment": "Malware payload (Hancitor)", "value": "641c3834b4fd3209ebc2cce0cb5e9f35f382ad69", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156291, "uuid": "b33259da-4fdf-4e4f-9ec0-6c8dea3f484f", "comment": "Malware payload (Hancitor)", "value": "925da23b868a6f574da0dd225a99f2b2e25092418f20da734053ed57cc26c2346fd7f53b30552a6678cad85a3584bc05", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156291, "uuid": "ae0c0be0-2056-4af0-87ea-63c43e6bdfe7", "value": "06B46D23F2914837D13766799D5B92AC9C2ABE007D24BC4B2BD42F4C6F39781792B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156291, "uuid": "be6b3450-b032-49f8-975b-8a59df1bfd3a", "value": "d71cd63d35a7301b9b592007d038621f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156291, "uuid": "6ed66b3e-ed21-412e-92fa-3fdcc8fe5c3a", "value": "12288:Kf5NGH5+nA+R7L05les5ZlUEKoQNne3De0:2wZ+V7w5lesFUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625156291, "uuid": "113b26c5-06dd-4457-9661-0fc1b277b484", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625156291, "uuid": "24f15af4-379c-485f-b984-28f5d44379da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156291, "uuid": "d68b58cd-6a6b-4d76-ac71-075d9be4e2a7", "value": "niberius.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df4f480-da37-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625121609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121609, "uuid": "194208bc-3c8f-4d5a-a624-bf66ddfac032", "comment": "Malware payload (Loki)", "value": "2ea181d8162971c691e78a5879fcea76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121609, "uuid": "0d09c797-4064-4768-b327-650ab2b2956a", "comment": "Malware payload (Loki)", "value": "33eb4477b9ba00310daa0f67b484c2a2c1440c7987846932fa2cd46e9983816c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121609, "uuid": "f6b3c1b9-4cf3-4612-aafb-fed868368a76", "comment": "Malware payload (Loki)", "value": "7a20f121c9a9b6dd7d9f10fb676cab2c79f1e329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121609, "uuid": "257edfb0-3285-46f7-97f9-a4950d599078", "comment": "Malware payload (Loki)", "value": "bdd80c4b5dbcaee1a615d22ad063b856ed6e47990cee0cec64e68246b3a90c2c5cf2a8c8f2ebc4b9c36a5b95f3de52ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121609, "uuid": "242e9776-92f7-4f8c-a7cd-515541a092e4", "value": "1535D007F6049A56C9A52238DCEFC2B41379DD8B7C12CB0B29987ADD3CB2355CD517A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121609, "uuid": "b09d8c83-c975-4038-8bdd-2c826ddb23b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121609, "uuid": "8dcfb914-f757-4d20-8d22-31eb4854cdb1", "value": "12288:xuluoR0bgbjhzhQjEckU/lzNwR+8EHFnOx1EThh:4lCgbjhzhB28AQEThh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121609, "uuid": "7edacc42-b815-4e68-a164-811301c8370b", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121609, "uuid": "31aad1ca-20d7-4063-877a-fe8a81deb3c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121609, "uuid": "ecbf0b19-ef6a-44a6-9d4f-8e489e39cd57", "value": "balance invoice-72111295460_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda0a304-da68-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625142976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142976, "uuid": "b182f5a0-9ebf-4f24-8a27-8c3b1fbd9eeb", "comment": "Malware payload (Formbook)", "value": "46f88471151a0c69481bfa77f60aa1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142976, "uuid": "aca3707e-483e-460a-9f48-69fc9b1c0377", "comment": "Malware payload (Formbook)", "value": "3506ed727e44f3c97a0b9eb31f6c9d06d44c84fc4898e7f65d4d1cede84a2e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142976, "uuid": "a72095f3-dd5a-4fb8-b1f4-f2a52f615810", "comment": "Malware payload (Formbook)", "value": "bd6c0fd393671ac269ae1e5a6841579c0495f266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142976, "uuid": "a2656cce-7e08-4281-9285-a87f2a38fe92", "comment": "Malware payload (Formbook)", "value": "213b82f9aa8dbde2dbdd43977086044d1846f1a179d586b34848f686d272602a40b4cfc3182c1a93b91a7e6cd596aef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142976, "uuid": "31d26dc5-8e5b-4a44-b558-4936a82a68f5", "value": "0945CF4BF2CDDA13C4591638DCEB82701F71FDB66C128B0A2A997ADD3DB3F1198416A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142976, "uuid": "2a41cc89-880d-4406-b5d4-cf0208eff3e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142976, "uuid": "049a7bca-4d29-4a1c-baf4-52f040f4dd9c", "value": "24576:mZ9X8C4tKbhzh+0HaKgjQDzny/X0DoNHhM3jY18lU+M:ckyhzhhcjQDry/X0YHsjYSlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625142976, "uuid": "142ffb20-f87b-4a8b-9d25-40ec908261b6", "value": 1276416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625142976, "uuid": "56424bfb-d5ce-4d6e-89e5-5f706cd226b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142976, "uuid": "d7f353a7-103a-4548-86c9-76eefd428460", "value": "Documents - V-21-170-090-E04.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868ed634-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150963, "uuid": "df2d45f9-18ed-4202-896c-755e84232966", "comment": "Malware payload", "value": "f3e60fd53500d09997c46b6b82eb32d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150963, "uuid": "e7fa5b38-d4b6-4c42-9e27-7d3d735d15f3", "comment": "Malware payload", "value": "35f0d5e9bd00646846a450f0ad13a340b85ca13390713c40bc8325afbcd237c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150963, "uuid": "aa904cba-3868-4043-9c20-4a6a0e121a82", "comment": "Malware payload", "value": "16dbf1622f8e05d492b3021d2049e2e943c4b54a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150963, "uuid": "9d0f9c9d-48bb-44b0-91f5-3243e0ae092f", "comment": "Malware payload", "value": "4dce0a9f288129eb55eeea318f83a8ec9ee32799bf8983bd30bb3d15d2a9296053a192c80946c6ff116076d41c560cb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150963, "uuid": "01a4e446-ce98-410d-a4e0-7857f6fe899d", "value": "63F2E1353255E2ECE43265F1555447483AB90FF482C3FC03A257A3E7AF584ADE453AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150963, "uuid": "5f81ed85-8c62-43ef-8ebc-3be69fe1ffe7", "value": "768:aHkmWBWfJ1WnzqzmH81AnYgq2XLAqWJIbJsoJgGlzDpxYsB:aHz1OGmH81AYg6IbOoVrY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150963, "uuid": "3a5a2393-3383-45b6-80f4-efb1b243b085", "value": 37264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150963, "uuid": "545c0ffa-4064-4bbe-942c-5177b4964f2c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150963, "uuid": "b75bc866-4e3e-46c4-9ff9-9dfcf80ec743", "value": "f3e60fd53500d09997c46b6b82eb32d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac26331-da8c-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625158272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158272, "uuid": "9a04687c-2aa8-4007-ab2d-9c31354b2dd2", "comment": "Malware payload (DCRat)", "value": "3fb50bcedf4f8abe1467bfa2369a193c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158272, "uuid": "4619d3d5-0d4f-4dca-9b83-99d0ac33ec92", "comment": "Malware payload (DCRat)", "value": "361f1951b0cd38fbba3a745b000d60ffa4d9dd6c3de7483d979df86ee30838bc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158272, "uuid": "3c743bba-d9fb-4792-a7e5-4d3abe1f6e7d", "comment": "Malware payload (DCRat)", "value": "185bc6680a524ea0df3f02dd098900b39ddbafa6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158272, "uuid": "76bde913-32da-44a2-9f6f-7f98ca508d68", "comment": "Malware payload (DCRat)", "value": "033c499215267f676fe0a02b8b0f3f5493483918c7dc4bbae8e34de4210891504118fbaeb5b7457ceb79f9d1162f7330", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158272, "uuid": "953a40ed-d0ef-48c3-a552-2186c5c2ae2b", "value": "87652202FDC188B2D6A119318969BA41653D7A200F25DFDBA3D44E3DE6741E0F7326EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158272, "uuid": "5967b859-862a-4ba5-872d-490f0958a7f6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158272, "uuid": "5de4d456-9a8f-4534-b1d7-b2cf0446ea2a", "value": "24576:p2G/nvxW3WzNX8J7Qy9+do5Clul211X8pWEDBREZmlhnFF+/u7QxAFmLdXvkwGl0:pbA3467FC1Sk1X8u8FF+/ubmZXvkvLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625158272, "uuid": "0cd1c86c-3e0c-4c79-aed7-12419ebee652", "value": 1478868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625158272, "uuid": "1cae88e8-13d3-4d83-9f2f-aa2387f787a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158272, "uuid": "e4638a07-abf8-43c1-b137-d2d80dcf95c3", "value": "3FB50BCEDF4F8ABE1467BFA2369A193C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d868550a-da5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625137357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137357, "uuid": "d02430ae-b77f-42df-a2a9-932b4f97d9a5", "comment": "Malware payload", "value": "ddcabef36d7255e11d0f50de6b13af50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137357, "uuid": "5111ac1e-7322-4d74-b0be-c4e2050d79b2", "comment": "Malware payload", "value": "38490b8b1d3b964760c65e14d568388d262c34bd22ff6c12c07d33ea2d1a1888", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137357, "uuid": "a5745bd9-20fd-4434-93ae-dad939dd2208", "comment": "Malware payload", "value": "ec31da8e09206458e52e964ae3ae9d6d20b4dd84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137357, "uuid": "0b6f17e3-f91f-482e-a4e8-a2cd4c25078f", "comment": "Malware payload", "value": "276eca4b0fab94a1c415940db74aa666615ee1391b522a25dad70a21421acbffa5c3d2ac026a9c21ac0ecdf1b626a681", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137357, "uuid": "2e5cbe45-04da-46b1-99c7-e489188ed036", "value": "72C2E01DDDB79E2AEA2646F601879E15AEEF4374FD281EE1456236C0037F41E2829345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137357, "uuid": "9dc8b01d-de50-4193-a172-80c0b90074d6", "value": "768:win4W+m7jnflBAu/1ja/0tEkVeTp2HP3Xd/EcJd+sK:EWTXdmu/5k063Y98cJHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625137357, "uuid": "b9553cf0-06e8-4f7c-aafc-69ab65814ec8", "value": 26064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625137357, "uuid": "0cde3872-f217-4c69-ad2d-9ac4708b1c1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137357, "uuid": "935d5156-efa4-4aff-8c89-ff4af00ae2a1", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6651d470-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625120844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120844, "uuid": "8acc9c26-5d09-403b-9868-9159045fe728", "comment": "Malware payload (Formbook)", "value": "1cdde3f01f1eaa87f370c6ff7793deb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120844, "uuid": "5b280d00-6766-4ebd-9166-2a243b08a7cc", "comment": "Malware payload (Formbook)", "value": "38539e1921abdc55da699d06a32fb043610cfe8c13eb1004dc8aa508427c6809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120844, "uuid": "37d3efba-bcce-4711-bdd8-d632e8fca2a9", "comment": "Malware payload (Formbook)", "value": "2cb799b39568a9d94604e321ce63fe53c191c2ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120844, "uuid": "54d548ae-0efa-4013-a24e-46711a929323", "comment": "Malware payload (Formbook)", "value": "0cfd27c79c5beb19e78ddbdd7260490882a62b511b2e267aac785f08dce33a15df568924f29108a800dfd98a33d59c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120844, "uuid": "86c84623-e843-446f-bc4a-f9eba29d3e12", "value": "FD45E017F344EA45C8562238CCEFC2B42375EDD67C129B0B2D99BAEE3DB2315C8552A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120844, "uuid": "674b019c-f7fc-44d8-9cb7-b5eef0adafe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120844, "uuid": "db0be769-3d9c-4355-8c16-fd4afe3fddb3", "value": "24576:zYW7SrvaVIbAhzhDMFsskO+5+8U+CATwScq1lhx:asI0hzhDnlhJUJYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120844, "uuid": "0160340a-6653-44e2-85b6-9c7da625ae82", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120844, "uuid": "d02b1678-33d1-47a5-accc-4717e164908a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120844, "uuid": "d26037ee-3f05-4256-96bb-374eb8fd7679", "value": "Documentscanner2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fbedee-da58-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625136017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136017, "uuid": "d22f6d53-b349-4c47-b8ca-6cbcf0adeaeb", "comment": "Malware payload", "value": "bd4fefc85df91dd4a1ea0959f50ee11d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136017, "uuid": "8541d122-9a1f-4063-a8cf-a24861e78ef2", "comment": "Malware payload", "value": "393da31320be78156d5f1352460db20279dba0cc863e8494456f5badb78c652f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136017, "uuid": "6d435405-dba3-4e69-8323-2a8b905cca5e", "comment": "Malware payload", "value": "fb678de95c71e244b9bfa73e36b4a357baadefe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136017, "uuid": "b30124ea-97ae-4012-bca0-3e9c29b1ac84", "comment": "Malware payload", "value": "f2a9f6c38c8986bface62a629d83b1a896024e7b6f3b699ade6def01383285623abc9e8f1ddd8a8c5c97e498eaa04f39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136017, "uuid": "4324cd9b-f48d-4353-b6c7-03b973de3fe6", "value": "3646237313A11189E5E6DC3D9D37BEE471F3422A8E81B47869EBEDC528119E1E713A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136017, "uuid": "8070418c-6b45-4a92-b797-c5a44cef0b03", "value": "7fb05647d0537b5b517720efafc40fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136017, "uuid": "619b3e75-6d10-49c4-aded-1de36adcfc14", "value": "98304:8CzIvx2vxRwD7P1KZdH7yzoRdXwyVRsaH+18IyfksDaZn1FUwIemqUPzsWwYHaK:Cvx26YdLRG+RFH+18I4kHFUwIe5Y4Wt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625136017, "uuid": "ca6e3472-11bb-494a-8727-f5706316ee94", "value": 5690368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625136017, "uuid": "934046d2-9e88-427b-a5e4-cc244645c036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136017, "uuid": "0d43ce1e-1013-4cb7-b71e-bd6955e05d6e", "value": "bd4fefc85df91dd4a1ea0959f50ee11d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd0b553-da78-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625149737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149737, "uuid": "33fd8b76-d983-46d1-a677-4f1fc48b0dbd", "comment": "Malware payload", "value": "d0ff582e2421c372e1a42c1918108457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149737, "uuid": "12d51d07-13dc-4277-8b13-3e01c76c8772", "comment": "Malware payload", "value": "3a222c1cf4a6781bec3be666c9093c809f80be4f1d4760805aba6f6827e1d278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149737, "uuid": "bfeb45e8-4671-453d-acf8-46550b6dad9c", "comment": "Malware payload", "value": "39e9d0a77d2078726df3d4b22add48e79d3061cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149737, "uuid": "08932b30-5b93-4127-a3e6-aadbb5876454", "comment": "Malware payload", "value": "d12b2a363ecba7b39ea6d77d2f9ef57ec7f4ed97cf1c1fcc228942e84a8bcf11c842a9322f7d58da16959e86975fae52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149737, "uuid": "0e8f73ba-e1e1-415d-9e3e-f2e9bd067301", "value": "CF8437E5A5D4FFD3D1BB22712EE4B2004B634B5928109244ABCC751F3B626CE6786F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149737, "uuid": "853a4e74-aa83-4e30-aaae-fee8c2a8cd8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149737, "uuid": "38231eec-7883-4600-8ff2-14d7de584601", "value": "6144:oO0cmapCiV99LQeAkL1/PcLOqD2jdcLi/FoE9t0u0nNkUlsaOjjcHAH2ACBS8:tpFQeAy18KPmTC2u3xBC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625149737, "uuid": "aa731fa0-e964-42fb-a944-71da8b2930bc", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625149737, "uuid": "7da4dac9-2357-4f15-a7c8-e06ffa317636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149737, "uuid": "135165a9-10a5-4512-b35e-8d16d0ff59f0", "value": "d0ff582e2421c372e1a42c1918108457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80509fa-da0f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625104634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625104634, "uuid": "c51ab491-7ae4-4ef4-a464-b1bf46a8e483", "comment": "Malware payload (Mirai)", "value": "5b8508098009726d353fa561b890a1d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625104634, "uuid": "f67402df-dabd-42f0-b3f2-da4b6ba6e188", "comment": "Malware payload (Mirai)", "value": "3a345435c45b4d20c4c40148f05d94224e03f25b134595c3434e430e773b72b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625104634, "uuid": "f9c8331e-5a1f-4c2b-a7b2-7e6ac3804c46", "comment": "Malware payload (Mirai)", "value": "948ae37258b6ed7434f4ff6ad2384fe29bac9a43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625104634, "uuid": "1c6d120f-f79d-4a32-b64c-fac2d4613b20", "comment": "Malware payload (Mirai)", "value": "5deb26969367658e69481eb012280f5cbb94a923206ef435e6343be5ad2e3ba728394844533ed11a28e7e04f4530f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625104634, "uuid": "1a153957-475c-4ed1-b99b-a9d55da37d3b", "value": "EDC2E1A82C9E477CDBD6823B01041556F472E723ABE712E7B2C49A07727380FC2259F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625104634, "uuid": "062bd090-d93e-4ca8-92ab-b84fd060e0c8", "value": "768:v4eKtSxBEibBHnIuHV114M/uvYHZrdt3Co2c:vf88CanRsMmOZrd5Co2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625104634, "uuid": "75f579e7-1b6d-438b-8424-2bbc615fa9a7", "value": 26988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625104634, "uuid": "1c628478-7d88-4d80-b49b-43a4d448d9c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625104634, "uuid": "816d4029-d54c-4642-9e69-eb8350bb7302", "value": "5b8508098009726d353fa561b890a1d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600e5ee6-daaa-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625171085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171085, "uuid": "2690e487-32eb-4846-bab2-912507399dac", "comment": "Malware payload (Mirai)", "value": "a94d33a0b73e80822ee66486e8848496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171085, "uuid": "349719df-82fd-4118-ac35-99e2074baff4", "comment": "Malware payload (Mirai)", "value": "3adeeb8c1ac67dfb905796e18e682cefd2460184edb7dafba34626975b4ebd9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171085, "uuid": "a576cfa7-b0ae-4b72-abce-8b5a17169594", "comment": "Malware payload (Mirai)", "value": "0498d1417d1d4080db2dc24d58550d367ee258e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171085, "uuid": "c783b97f-5054-46c5-9880-0f37addc5463", "comment": "Malware payload (Mirai)", "value": "e98649cde1241ee99c6d1543d95c8f1dcd0e6f97ee0c39514758abf7d3b21bd72685a0e50d9c909218f53e3d64011e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171085, "uuid": "e1c1982a-e4f2-4e95-81c5-4072bb812548", "value": "6FD2E1625A11FEF2C5F10B38FA378EC735761EBAE190308A367844E9E081B044DF8403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171085, "uuid": "1c7132fb-bd59-4ad0-a3ef-b09a3ddd2015", "value": "768:7usHfRavjycYC5HkU82CgLOQcVyaWn4RNS9fMH9q3UEL4T:jRwydCRh8mKQcVblTuMWLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625171085, "uuid": "a3c30f16-d04a-4df2-be13-556715b9004d", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625171085, "uuid": "9fd23ced-30d5-48ef-8013-05d31027f735", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171085, "uuid": "313b0d93-64d7-44a3-9632-74fc6a6c3b4d", "value": "a94d33a0b73e80822ee66486e8848496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a47d80-da46-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625128326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128326, "uuid": "01ba5e0e-3f42-4445-b9cf-3ff179866c1c", "comment": "Malware payload (AgentTesla)", "value": "ac66404b217e9268c155cf994dc143ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128326, "uuid": "1c636489-d847-467e-9982-b55b90b3015c", "comment": "Malware payload (AgentTesla)", "value": "3ae7f36cf03f8c687a74f9595d5839d80a712d97ded308268c86f20db3d397c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128326, "uuid": "75cc531e-0914-4847-b73c-a20a0603edb3", "comment": "Malware payload (AgentTesla)", "value": "0cff5075634b8d07dc15c2caa6fd7a0d561be09e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625128326, "uuid": "cce30caa-bf37-4828-9c48-24a8148f1b6c", "comment": "Malware payload (AgentTesla)", "value": "7721cd2f802eafcea5536dd3595f3c683e685741985dcf9e41ef99cba1200ee489bc5dd4ba890f4f255e810cd7b59314", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128326, "uuid": "2f803a2e-e1a8-4a7d-9bf8-b5a8ba412cc3", "value": "D67433A4119F8272E6484E4D35C0B1895E75FE9230CACC2A63AECA71DF55AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128326, "uuid": "38bfad12-8c2e-4e6e-baa7-449bb4103a33", "value": "3072:9gBrB2BrBOhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHNcjmHC/fhi4txeHry1oziLy:MVcVO3c9dzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625128326, "uuid": "4de32fd9-2243-4719-9d28-b84e1f09ef0d", "value": 342325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625128326, "uuid": "59dcaba1-bb78-4994-a318-b2dcd41fa419", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625128326, "uuid": "3e392f88-58ba-4d6d-b5a6-38a75fb273e8", "value": "Qoutation 01072021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa25552a-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625151157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151157, "uuid": "1fc7e4ae-372a-4dc7-9f80-b1d129976d7b", "comment": "Malware payload", "value": "e19dec9b517a349d0ec6e5a2c3422d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151157, "uuid": "2a396030-4501-418f-8858-4876e2551efc", "comment": "Malware payload", "value": "3c245e6f199b0d579015fc5bc4322710133ef58d61f3df034d862085aecb3a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151157, "uuid": "4e5b4338-bcaf-42df-a8fd-3ad1e0dc30db", "comment": "Malware payload", "value": "bee424ddc7ce146e5ab037e59a6b63b2a1151cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151157, "uuid": "09823b5e-c787-4aa7-b823-aaf490ba30ec", "comment": "Malware payload", "value": "46e8bcd80bb8a7b0c0c84495b66dcf40f56d764cfde4e3b36a0f3342e30a3eed9165538bcc5b9b2d6bfdf955439f4eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151157, "uuid": "e2fafe1e-2766-4591-8a89-baf98e87b40e", "value": "E06412F61B9E98DFCCD2A375D86C87238F04AF2A0580CE76E83178553F1B5EB6945218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151157, "uuid": "7f0839bb-5c22-4446-94a8-df506bf7ef57", "value": "05d3dce2be32df01ca249872dd2cc117", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151157, "uuid": "bf6145d3-792d-4af0-b708-5c9315924274", "value": "6144:naVWdyzOxeA1DfdwX3MmIO9G+RXoq3aNq+dL8LJ3QvWiC7JWxfmIa6JUrUkc:nMROxdDfOnMmX9G+RXowaNq+F8L5Qeih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151157, "uuid": "9a3c17c2-db3a-40a9-8c2c-a278bb1e9c90", "value": 334072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151157, "uuid": "3de957ae-1094-4c14-8a2e-ef0976947c60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151157, "uuid": "aeaf075c-2be0-49a6-bca3-5445261f5caa", "value": "Pedido100293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09ac8d0-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134686, "uuid": "8be95cb7-3a8c-477f-880e-5c7274859305", "comment": "Malware payload (AgentTesla)", "value": "84db6d6d5b5934bb849939080ad4287a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134686, "uuid": "fb6cb03a-5720-4369-87ef-f48c9acee598", "comment": "Malware payload (AgentTesla)", "value": "3cbc16e758d2dd21158d4a2b832b42f53a2acc99763e5f1201eed468ac52403e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134686, "uuid": "488ee781-fddd-41e9-af28-6df295f8f804", "comment": "Malware payload (AgentTesla)", "value": "7079e670eb3d99b090e7658a05137f266b36b287", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134686, "uuid": "c8b50b74-0357-4ec8-8c1e-83736adf7ea8", "comment": "Malware payload (AgentTesla)", "value": "244bd2427dae8c2586d1597ab9f7929c27c82921836e9831897d3a097d0ee51d4cc542925dffff20ad638a52d000d2d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134686, "uuid": "86c99a26-3f79-4560-a3a0-a3fa027d56da", "value": "0E35D01BF7099A45C9942238DCFFC2B41375ED877D128B1B2E987AED3C72312C9516A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134686, "uuid": "30204a74-c864-4278-8f94-92c502343ff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134686, "uuid": "08541422-780a-4a78-8b88-020fce9f4e99", "value": "12288:hHjUyIvbr3Jptm7uhzhMelSKESxB4/vln4kylsKyLykhx:hjUPdSuhzhhoKESg/vFXylsKyOkhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134686, "uuid": "02ff7223-ab74-4f92-a2b5-184b8ad73792", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134686, "uuid": "a4ad9410-1af6-44e6-9277-b9d8c0b256b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134686, "uuid": "8ac306fb-ab80-49fb-9b8d-746694814ff1", "value": "84db6d6d5b5934bb849939080ad4287a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c295e8de-da73-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1625147628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147628, "uuid": "b9ba046d-c754-4e3d-992d-4498c9de324c", "comment": "Malware payload (TrickBot)", "value": "85632f6e4ce7f56a522d0796a6faa327", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147628, "uuid": "38e1d8fd-e5bd-41bd-83c1-4844ba8abf1e", "comment": "Malware payload (TrickBot)", "value": "3e31457cdda7e7efb0798e7b06c4c23251f3a5416bb4355bc2564e99c7d401b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147628, "uuid": "82b78939-2605-4a44-a0df-500f88355385", "comment": "Malware payload (TrickBot)", "value": "bff7507d7431bb52e902c22e558a090190a61e85", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147628, "uuid": "10d65907-490c-434c-8a00-2197a2536490", "comment": "Malware payload (TrickBot)", "value": "8d0e5f8b9d4b69b01e2ee638dd825c0a77bd1d1d720245b5a33ede396d4f575e42660ef7162a5e21891a20cf5b663dab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147628, "uuid": "85d04be4-1901-4079-a945-d55402be3f5f", "value": "9D94E1226641C871D18B11399A7297755EAEBC129BB065CB2FE03EBF6E247C1CF35306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147628, "uuid": "584b6c52-ddb6-4b1d-80ec-afb6902f4b69", "value": "9c7729e7e6125436737710b1ba737d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147628, "uuid": "1ec0a181-a115-4bbf-8f93-2b41fb32200a", "value": "6144:54Gp1gZmFlZKmP4jrc9/5fS9XJqLSYmHiNKhV5C:JrgZm7ZKmP4jrGg9XKg6Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147628, "uuid": "6c3d9e6f-d633-452d-a809-1e4aea819f56", "value": 413311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147628, "uuid": "849196c0-74aa-4723-9451-422487d88a5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147628, "uuid": "f1af7a77-7f63-4962-9283-f30d61c860e7", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c196b2d-dabc-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625178783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178783, "uuid": "f626dddf-3e3b-401d-ae3c-4e7e1a44b617", "comment": "Malware payload (CryptBot)", "value": "88f45447323e843603078ba9a53e2331", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178783, "uuid": "a3b8a005-2add-47c1-a11d-46025e19c02f", "comment": "Malware payload (CryptBot)", "value": "401d56a86e9a68b82996d52f22858ae928d88163e8bacc9b4acee0213c98c682", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178783, "uuid": "78a227b8-5efa-4bac-af42-a9cb99a5582f", "comment": "Malware payload (CryptBot)", "value": "033d906d2f767f547ff73f9441e28ccde0822603", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178783, "uuid": "e9094260-800c-40ff-b592-5bd4bfd592d7", "comment": "Malware payload (CryptBot)", "value": "d2e1ccb9290fc2a31009b8940e1990f0c4ec72451966347b9a087314ae13e73701db005e0272a2e92eb6f57e2808c9d1", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178783, "uuid": "5a0fa3df-5861-469c-b8e1-3bf6f133a79d", "value": "F92633F42454C9B9D2A7F0F27E709704EA75A16B2978AACE3EB0A6B00C181F7671D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178783, "uuid": "354272d4-2155-4123-a9ff-5e58a3e6fb81", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178783, "uuid": "d590c601-09d8-4b09-8ec4-26c4406af2b5", "value": "98304:Jjn7qT1ZS/r5s1kxE6bkqVaPQSkZoU8uOYJUmvYi5sy/jd:Jj0SVs196bpsXG8ujUfy/jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625178783, "uuid": "19503f19-8a15-4234-9707-52cb5701cd5f", "value": 4737038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625178783, "uuid": "0265ff7b-e9dc-4996-8f05-a32fae289c4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178783, "uuid": "b111c597-ba3f-4098-94eb-93d44e0ca4d8", "value": "88F45447323E843603078BA9A53E2331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d7152b-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169315, "uuid": "22f6d390-c6f8-442b-b186-edbb040a8c10", "comment": "Malware payload", "value": "a875112c66da104c35d0eb43385d7094", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169315, "uuid": "5a143cca-0b8b-4112-8816-c2ffc0040593", "comment": "Malware payload", "value": "4122bb06352410a9b4bef4bc2bcf249265c14f1332df4fe1256a1281bd53bf22", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169315, "uuid": "61a52911-0dbb-4bc2-a339-263242400c19", "comment": "Malware payload", "value": "e5cafc60a76cb8cd738d6133ff562f735712542e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169315, "uuid": "30499dc6-a69b-4d20-99e9-3bfb768727d6", "comment": "Malware payload", "value": "a514e762c5b76460e1b9cc5bb3be4fc0996dac29fe5b0ca9f130d9d04abbaaaec016e783829841745fffe3b6f799202a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169315, "uuid": "d6316932-aa90-4e58-996c-7c3ae6a5eeba", "value": "3E2301122D839B76CED3C27B90A4893B7DE986A6A75AAFC402DE36CD871184134326D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169315, "uuid": "0cd6a352-9316-47d0-a44b-d5e287aa0ab4", "value": "ba2471818ca433c66cf74829f7679dbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169315, "uuid": "792c2689-95f1-4011-a468-da6caabdca37", "value": "768:SrpG/odfzNGuBM6zRytsd5ccxfGUZhzxkFXl9U8gNBG+aD9bPSYImSb:Sp5fzNzBVzRy+TfLh9kFXlbg++A9DVSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169315, "uuid": "1ff459ef-09d3-4180-a609-884ea5891a8c", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169315, "uuid": "87d8fb4b-474a-43ca-b99c-a31f9a39ba8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169315, "uuid": "8be34d58-b077-45e6-9d08-ece22ea3f0fe", "value": "4122bb06352410a9b4bef4bc2bcf249265c14f1332df4fe1256a1281bd53bf22.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c799f0-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625120998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120998, "uuid": "ed324c79-3d4c-4342-8fa8-12c572cfffcc", "comment": "Malware payload (AgentTesla)", "value": "c09fa3db9aff3bed3ac0dc27e541447a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120998, "uuid": "9d03802e-1a8d-4723-897c-6642bc55981f", "comment": "Malware payload (AgentTesla)", "value": "4168cb7280d51dff7f076d035d5233f5008af3ea643b8ceb89ccb9db1f9b601b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120998, "uuid": "3ccf66d2-4577-4ba9-ab0d-b56a1a5c7853", "comment": "Malware payload (AgentTesla)", "value": "c08c2860fea7bb4c8676f12ff5e48a8fb31aad9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120998, "uuid": "d704ae29-a51c-472d-b3ed-357ff977d042", "comment": "Malware payload (AgentTesla)", "value": "03487f3ae02281f4f2aa5ab301e2a4a6c9b361297d229820ac29cdb66fef800648bbbbd072d1d7ed79f575273e5ebcf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120998, "uuid": "d9070956-61eb-4f81-b385-d54def473a22", "value": "30D4122829F86266D7F76F7732E47155933DF7326B1ED12A2592030A46C3F40EDA2329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120998, "uuid": "edb09b94-4800-4b81-b67d-83e52fbb6cce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120998, "uuid": "fcc69ff6-e86f-4275-8b19-ff13c46d537d", "value": "12288:uSs9tCtFV5QNs9Nqv8OaGp6k6xDs+LZD27kkF:vs3CtFjFspYx5tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120998, "uuid": "27d57008-597d-4d70-8d17-fcda73208fa0", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120998, "uuid": "83c8c7ac-d800-480a-8c96-e541ef8ede7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120998, "uuid": "22ec69e1-3163-4761-89f2-ea4d0db7032f", "value": "NEW P O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7405b70-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625132550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132550, "uuid": "99dae0a6-7dec-4e44-86e7-f17bdf7dcf10", "comment": "Malware payload (Formbook)", "value": "71d41ee17c63a2f763ec84ae4d0a5319", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132550, "uuid": "a95f9c49-a3d8-472d-bff6-4601bb2debf4", "comment": "Malware payload (Formbook)", "value": "41dc6f104f366a85ae7bdc3c7bf566598dbdfcdcdd995fba68318cdbf5d44459", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132550, "uuid": "a36514c2-3356-4050-ae3f-3fdd5b5859f4", "comment": "Malware payload (Formbook)", "value": "f1955db264e1e834e66be559891c6d97155a7211", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132550, "uuid": "7fa2c944-ab42-4e71-b002-15261f451b91", "comment": "Malware payload (Formbook)", "value": "982aaf50b3efba051287a4e6e7173532d3d62fb9ca766df87bf5f399d45bc0fb361c5ca7891fc5a0ca868a3ef85a9852", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132550, "uuid": "6035d25a-2964-47d5-bd06-3b3acfc7b6bb", "value": "FC5512AB61551B05CCC51E3950324B1AAC336CA93E54064EF944FEB7A0FDEB29B277C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132550, "uuid": "dd5573e8-9d42-4ab1-a2d5-814cd990fb50", "value": "24576:CODLfgHXr52mq3/hhtcCEz0nxC3vVQWi/6mxki4hw1q7LAaMrmj2tExxEF3hi19i:Cy4N2lPv5wQWi/dOi4hww70XrIhxxEFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132550, "uuid": "6c1ae6bf-dc8d-4da0-ae18-d625f114ae92", "value": 1318184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132550, "uuid": "2f3b9e87-c172-47b4-8714-612ef9098f99", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132550, "uuid": "73d5c7cb-e8ca-45f2-be33-4726776afb15", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fe60f8-da3d-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625124357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124357, "uuid": "ffac41ba-92ee-4173-97df-f38bc33766a6", "comment": "Malware payload (NanoCore)", "value": "c0e0c339e6dbbd1d1565de4da39e4925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124357, "uuid": "05fe6d68-c3b3-4669-8d33-88d77d93482e", "comment": "Malware payload (NanoCore)", "value": "42d293cf86f774218bf7751f1001e0a57883a1c7c90c6c1e8803a061094860cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124357, "uuid": "13a8f50b-ccc9-4f52-95e7-84842853870d", "comment": "Malware payload (NanoCore)", "value": "e8a6fb4afb3bd0fb26d7a7508d27f53f817ca071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124357, "uuid": "ff91a622-65b0-4abf-ba0b-04495eececf2", "comment": "Malware payload (NanoCore)", "value": "faff280a3928eaaa95665cb74ce8077678912a456cba45fb8ad1571dc33ea4ebb468a900cb5e2c1319869041137dc54e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124357, "uuid": "c117198d-4a2f-4e9b-bee1-3f56419fceba", "value": "BDE412282EFC2369C677DF3731E4A51692BDB23A751FD15828D2124B48D7780CEE079A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124357, "uuid": "1fb97c02-6543-4f77-8fe1-d6cd2a4f8f30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124357, "uuid": "5779b21a-8828-45c5-87c9-b85bd925afec", "value": "12288:sW09zR5qYiQoisSdBqRVXlqNx+vBQAX1b1zG3hM+ultbtnGc+qGYi:s3F3WbSXmX82SAX1b1zGxM+ultbtnTHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625124357, "uuid": "1b4e01c6-bba7-49bf-9136-e476f2196679", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625124357, "uuid": "b717028e-9fb4-4880-b06f-8c3772d4786c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124357, "uuid": "92502bb2-0e05-4196-84bb-e653ed24c6dc", "value": "c0e0c339e6dbbd1d1565de4da39e4925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addd0796-daa5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169068, "uuid": "7994cffa-4a5c-459a-bc13-e63b3b9824fc", "comment": "Malware payload", "value": "85ea346e74c120c83db7a89531f9d9a1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169068, "uuid": "b681fcf5-c5a7-4567-be69-a2732c9e75e1", "comment": "Malware payload", "value": "42e781f5e9c00d09cb5f7697a7b2fc9b04d77cc7978dcca8098f77d57693ca6c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169068, "uuid": "867ed7ed-c76e-4df7-a226-0fb5e6b5a9ca", "comment": "Malware payload", "value": "df8201f67beb99d7c6094e9d67f3a54c94809dda", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169068, "uuid": "7a0558af-e7ce-4bb1-a50f-0fd517e90317", "comment": "Malware payload", "value": "adb92cb1274f4d9e315c96e9e9cefa8653b922d3ccf5fe86e284bd29108de0b4580d1c345ca090516579cda978c2f5d9", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169068, "uuid": "743aef0c-d444-44d7-98cc-bcfbc20b9b9a", "value": "51738D1776D1D032D0224571AC61A6B29ABFF932AA758047BBD602BE5FB02D09F38357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169068, "uuid": "b6e973cb-18b7-4069-a251-e744804b65b6", "value": "dbc7fd0f55566e806b0ee54052b5af14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169068, "uuid": "69a3722a-ed93-4a75-a323-639cf66993c0", "value": "1536:0A06KO6wRXgX6qXu1/PN/b5VdCkVkJmLm9zNddQZ:w6pzRXgX6qel1tVdCvmLm9zNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169068, "uuid": "14d1008f-aa7a-447c-aba6-4f92cb6f0561", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169068, "uuid": "f5925d78-bdd0-41b7-94a6-fe9f72e3b975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169068, "uuid": "5b96f884-a1da-4838-83d4-f39cf12179ee", "value": "42e781f5e9c00d09cb5f7697a7b2fc9b04d77cc7978dcca8098f77d57693ca6c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f2c031-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625120874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120874, "uuid": "3e030d8e-d8f5-422c-a80d-2a02d0cbe764", "comment": "Malware payload (Formbook)", "value": "cf4451b3972a3a0c80ba775579c60de5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120874, "uuid": "7afd5a0a-03ee-40e6-b7c3-21afaabdf69c", "comment": "Malware payload (Formbook)", "value": "450047405e1508fda3cc27042f05ec5337e69dca04e00e976f490d4bd353e158", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120874, "uuid": "b34ea04a-76c7-4c3d-a199-60980ee28d50", "comment": "Malware payload (Formbook)", "value": "64eb73d2f04f25ee02103e8b6f1b936cd94e0dc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120874, "uuid": "c53270cd-50f0-4e24-bb05-92d61adac394", "comment": "Malware payload (Formbook)", "value": "a2468c376cf31861fb94b1dc2ea3a16f9379774fb2b2219e18be5440b4df3aa78ad527b42ceb2b76d2d0b3bc944a3589", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120874, "uuid": "3a1728fa-6df4-4ba8-9721-e0d5199d39b9", "value": "59C4E05231548D77F2132CB64C1E92E215A77D24205AF62CA5AE3A5F15F231223EFB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120874, "uuid": "b979bc2d-5958-47b9-84c3-5bf379a7f8fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120874, "uuid": "86330e20-2015-408c-a80b-a9e14178d214", "value": "12288:+EFVzMFtKmacwJzmL6jBVXkiUkuyu+BC6zrcndad1Hf2jL8DP:7atkVPzXkrcd1HEcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120874, "uuid": "ccdd89a9-7bbd-4d46-9e22-ff489c754c6b", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120874, "uuid": "424d9699-01bd-4854-9c1e-ce8dcea7de28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120874, "uuid": "c17e74e0-630e-415f-a689-56e3ca0dbdbe", "value": "cf4451b3972a3a0c80ba775579c60de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add3446d-da7d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625151888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151888, "uuid": "d75769a7-af92-45b5-8b5f-dc06c9fb833c", "comment": "Malware payload", "value": "74a001ee605f8d9151186b9a65f75099", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151888, "uuid": "aa726966-a0f3-4cc6-b4b7-78127580d4ad", "comment": "Malware payload", "value": "451be5bcae1bd2461151a50b76c56c97405079398f4cf8913b7f599cb03e3311", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151888, "uuid": "e9693d01-7d4a-41ff-9e84-65818fd1a1c7", "comment": "Malware payload", "value": "ff6d0c6bcb466f7767ac9490e9f0f7b60a2ab7b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151888, "uuid": "8171fb44-4823-4dfa-bf79-e767c9f3f09b", "comment": "Malware payload", "value": "e5f1b73b63e612c2fe33728d3e0c18e6cc4b0477c6e6c032738b453e1bd7f276a76bd210085db37b192d3f42aae87ca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151888, "uuid": "6906a190-bfe6-4fa0-aa5f-f9fd1c7cc56e", "value": "BCF2E173A05C49D0FBFE69FC0984AFD9039447E29AA34F53932966588CE06C3952F8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151888, "uuid": "0a4cbd3d-4cc5-4e1d-8c1a-7b60352d0af6", "value": "768:XOOz8lPPpQDMIfsvpmhA4SHr6tB56GSwBr8n74puV14sh4uVcqgw02TWXR:eOaZcIRmmFHeL9rw74mX4u+qgw0cWXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151888, "uuid": "a8e38b16-1051-47d7-8a53-51b8ffe934c3", "value": 35184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151888, "uuid": "06219491-a1d1-49aa-9910-3a4fd40e4bbc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151888, "uuid": "59ab5c5a-de82-4d4c-bf72-d42bdc72f5d6", "value": "74a001ee605f8d9151186b9a65f75099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a406cf7a-da2e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625117942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117942, "uuid": "f7ef4f27-efb9-455b-b2a7-aebe8d77c79e", "comment": "Malware payload (AgentTesla)", "value": "aa98d531ce212240609e4c8f7d67618e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117942, "uuid": "f679cca6-b5e1-4de1-9ca9-0bd72fd007b2", "comment": "Malware payload (AgentTesla)", "value": "454632ee1aa7b7ceb476c32bdfe1b27b054ffa0d8888c848cfd68db6c2bc4127", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117942, "uuid": "facd7a70-44f0-4638-8899-4dbe209fa551", "comment": "Malware payload (AgentTesla)", "value": "feeaaec61886c57a71d96fe6002f02f954728e91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117942, "uuid": "80460ca2-0530-47af-8642-75c68e317fe8", "comment": "Malware payload (AgentTesla)", "value": "69cd80df9058ba90531fd64ae2a8dcd978366884dd475d7b3183455ad5c8d2eb91d3f5b2721ba8f79d578c91ce9fdf18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117942, "uuid": "33242347-bffd-4e6a-88a6-9a661d6e85af", "value": "15E433A645A8D7F92CFA4A95BACE37D353124D83C31093E064635FFE84B9664BE9C043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117942, "uuid": "d454c559-a3d5-4f60-b033-c7995c1b16a4", "value": "12288:X3Jl6OBv4xCLKQwQ04dvE9DEg+cg/yua7xYsLFTtEuMFSfcwncwz61SbI:pl6Kvg0KQwAdvE9DEgXg/36JLFTtEuMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625117942, "uuid": "d8b4f789-10c6-4b79-9901-1bdc2e3df4c2", "value": 716978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625117942, "uuid": "bac0ff33-819c-460c-8e06-a2fd3642fb4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117942, "uuid": "93538e7d-c87a-479c-b137-3a58098ee1dc", "value": "NEW P O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb808009-da78-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1625149764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149764, "uuid": "03f139ee-1bd6-49e1-b9c7-4d47a5ab0693", "comment": "Malware payload (LimeRAT)", "value": "ad7fab95d903b025ebd5a36a8d7e06a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149764, "uuid": "ce23364a-5d52-4478-96b9-ff6052d36f83", "comment": "Malware payload (LimeRAT)", "value": "4617466868abd96c612df835281b02512cba8e21b72be5eaaf817be02996c897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149764, "uuid": "9e344d80-3510-438d-9bb1-3dda430aa745", "comment": "Malware payload (LimeRAT)", "value": "66faf0fe2a065f5c6c1701fe9c52e3f2ef677a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149764, "uuid": "7f8cb805-e8c2-4880-8022-c60ef32bc3d8", "comment": "Malware payload (LimeRAT)", "value": "835ffcfc8d0def2285bf19306dccf9d840404c2c98d2d2db247f75d2122ccaa0eb779460adbcb3884cb37e4833ea8b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149764, "uuid": "8ee2593e-dc39-48bf-ba80-6435fbd22dbe", "value": "67F429D45E9A702ED0BE6F7C719050FD93AB6E231A8E97EA12F3F9C64733141C4A0295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149764, "uuid": "789bbcac-3d97-44f1-87ae-d29a424ad267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149764, "uuid": "874c0406-7152-49de-9ad4-191ff860e95b", "value": "12288:YpClBbX5Ty5syL0CR8gotz/S31L/5C9RJl7ICfLc:UaUxLPigotulL/I9RACfLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625149764, "uuid": "a60e25c2-2bd5-47cb-a09a-01822f989ab9", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625149764, "uuid": "55de234c-6861-4e18-accb-92f80feae2d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149764, "uuid": "98e3f845-71ff-4092-9fe7-3fad5a115af9", "value": "ad7fab95d903b025ebd5a36a8d7e06a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55a9552-da56-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625135124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135124, "uuid": "fa4afc87-6dd1-4a40-8807-6e6148b71e84", "comment": "Malware payload (AgentTesla)", "value": "ba14c131aec75dc05000625a987eb13e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135124, "uuid": "08fb5d94-5071-44c7-8fa3-ba9d88c34e7c", "comment": "Malware payload (AgentTesla)", "value": "46f0e45dbbf592ca7ed929b193254ece1cc22c3719888b8aafc32685dcd64f5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135124, "uuid": "35325ebe-e0ee-48d6-8213-07b62e5f3573", "comment": "Malware payload (AgentTesla)", "value": "e9d8dadcf12189203176149e65ef5312afffcadf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135124, "uuid": "7ae3cd00-9e60-4d5e-8d7a-f56a34eddcf7", "comment": "Malware payload (AgentTesla)", "value": "3cd1035b22339cf2416baa45d72ca19bb10332e026c00be69197940e1211d4fa509ad504cac832fb9a80555efb9973ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135124, "uuid": "63786dc2-0a83-4ec3-a841-d7a79a23bc19", "value": "1745E00BF6099B45C8541238CCEFC2741375EDDB78138B1B2A997BED3CB2622CD556A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135124, "uuid": "635deb10-bcd2-4473-a74b-1ca3b1b734be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135124, "uuid": "e27814c0-13b1-4efc-99ac-fced41078131", "value": "24576:0mhzhKWZXXiNSVCPFMMVjR4bkzVLa4hx:/hzhvZXXdArjR4ozVLph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625135124, "uuid": "5a179a36-6d2c-45bb-b028-aa354cb6ba3c", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625135124, "uuid": "cd62800c-4a6f-40b4-9bfd-f4f206d7797a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135124, "uuid": "ed710328-abf9-4ece-88f0-a66afd16d650", "value": "RFQ 18757_PDF_________.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54bf59c-da70-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625146425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146425, "uuid": "222f3bd0-d047-467d-9a17-23e1e39e3dc2", "comment": "Malware payload (Loki)", "value": "5a947780dcd651e5755f82fa543358f9", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146425, "uuid": "0a6d0320-d678-478c-8451-c1ae8c348b1f", "comment": "Malware payload (Loki)", "value": "4739ef574445961378419770302f19c3d1e5812169127a6151558cd14335695b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146425, "uuid": "2c010efe-d587-40e1-919d-c5f4c538dc52", "comment": "Malware payload (Loki)", "value": "7d34e79f1c422002f456075d23e6261e763ef882", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146425, "uuid": "4e715d46-252c-4eed-8edf-01a2a591a592", "comment": "Malware payload (Loki)", "value": "27116d30521e877018c17b5580bb1c52d4ea205e7912e2316c7029f72e9876a575fc3ee342a6d60343a61977bd85da91", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146425, "uuid": "9ebcf3de-0386-4670-81cc-20bd8e51d8c7", "value": "17457C1C2EA94035E4FA5FBD86A06182576DAE2F2F03D91C24B6FED53733641C9EC129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146425, "uuid": "198f37d4-89d5-435f-98e6-57188358b082", "value": "12288:rJTuBbX5Tyo2m5CUqHV5eb4zzqP2R+1Y+HSWwcHY7:VKR2m5jyOsEK0Sk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146425, "uuid": "48b655ad-a430-427b-b5db-becb3731fcd3", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146425, "uuid": "e1d2dd2b-ab0c-4146-bef6-74ca928715fd", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146425, "uuid": "e0736c09-cfbd-4839-be5e-6ab1ba5e58c4", "value": "PO#01072021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c3b6a3-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625120864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120864, "uuid": "918063e9-a4df-4bf5-becf-8294705cd75e", "comment": "Malware payload (AgentTesla)", "value": "862c13e11a4e51ebc28f3cbf9675869a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120864, "uuid": "99a5ec81-4e52-4bea-9c8e-75fd5af59159", "comment": "Malware payload (AgentTesla)", "value": "47e6fd93cc7d879c970280e4bae5c2bad2ee63e4c9838a453c56dc5202a98bdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120864, "uuid": "6d816336-577e-4813-889b-cb6b39299d65", "comment": "Malware payload (AgentTesla)", "value": "bf469aa334afffec5d38ecb002b698f985f367ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120864, "uuid": "138b3ecc-798a-4df5-88df-42efe251350e", "comment": "Malware payload (AgentTesla)", "value": "2110511ed137786d6bc088b552a788f26e11436f52143f4cd990490298064aee4da4d7b5ee04251bba01d879d7625fb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120864, "uuid": "afe551bb-d682-4b95-817f-2362b0068e6b", "value": "9445D00BF605DA46C8952238DCEFC27413B5DD867D12CB0B2A997AEE3CB2611CD553E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120864, "uuid": "b333b603-114c-40bf-92ed-3fdd4113dd12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120864, "uuid": "b918a8aa-772b-49f7-b514-021cc2b1ade9", "value": "12288:snr+s3QW8E2RhzhLSfnnOk+uw5e2tR0OFJYM/mOU44V4g9SQxYMVd2dehh:W789hzhLWIuea8jOj5SpMV+ehh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120864, "uuid": "a11dbcd6-4d06-42b8-b562-525dcc6e51b9", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120864, "uuid": "d153b2a1-9e6b-4913-8907-ee759314bb27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120864, "uuid": "07f53bba-b14e-424d-9144-2fb76c4844ae", "value": "f634s6d8rGB5Xms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce4dba5-da72-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625147055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147055, "uuid": "8a11d359-c5f4-4829-92bb-547d2580fec0", "comment": "Malware payload", "value": "01fbb9c7bd621f84f3c4f21bafe8ee85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147055, "uuid": "8fb34bea-5cd6-4bad-a90f-317faca58837", "comment": "Malware payload", "value": "47ef818469048011bdb7b569f7d81d2c7c2a0c371ce01441b7072a0ed15fd477", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147055, "uuid": "9c20e5d2-4c6f-4db2-a69c-44af4b17da2a", "comment": "Malware payload", "value": "1eaabb50a9c20afac43c4849540d6a5cb6c28504", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147055, "uuid": "776434bd-fff5-403c-8e3c-181f7f332f76", "comment": "Malware payload", "value": "27ae91a7b9598207a61cc56d5cd6ab1a8ef8e81f6835ccd1546ce75520ce897364520f4d5424e95e0b2ec2a6da38fa38", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147055, "uuid": "3c056a57-0e58-444d-ba5d-f854e9656c3d", "value": "6F22C6FAA446D80FF4BC89796253A7F80FD990D45494C2735EB242EFEA70F842989307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147055, "uuid": "610fd325-e4ac-489b-bdaf-ddc279152301", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147055, "uuid": "8eecd6a6-c359-491d-a1ac-5b603f926470", "value": "96:f8Ye9qqvlZ4PxDXIKU4qDdqNMjYZlYCStQQMLd94P0oyg2kOYQ1CWRxM4jsdRx:fOv04KUT4cY/gtAvNrsWXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147055, "uuid": "73fab24f-c6f1-4d76-b721-bbdb9f094211", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147055, "uuid": "3b5c0174-89e9-4c7d-926b-30ece3290c4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147055, "uuid": "90c8f5f0-1a21-4bd9-a3e3-49936a416f34", "value": "SecuriteInfo.com.W32.AIDetect.malware1.496.15544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12b9cdc-da56-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1625135143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135143, "uuid": "34c150d8-0ec7-44fa-9016-6a8a5d3f9a58", "comment": "Malware payload (AZORult)", "value": "bd9e5d5843fa83ecfd17a430b7314320", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135143, "uuid": "176543cf-ee03-496f-9853-557e395fc3b9", "comment": "Malware payload (AZORult)", "value": "48312562116e0e98923cbb512b3d70a7fd4d4d8fdfde7d0e706b3d2f35c248df", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135143, "uuid": "75eb6dea-380b-4cce-ba16-777dabca4ebc", "comment": "Malware payload (AZORult)", "value": "a6fd95f10e084ba5a50e533fa84ec5b05dabe14d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135143, "uuid": "273ca2cb-ab0f-401e-b304-89d62ad29c43", "comment": "Malware payload (AZORult)", "value": "c393ee7d228f476b7eabdf39832c806541b28c343afd7496c9ea1a9780e18210939d84d68258c6656dcf932e213d6aad", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135143, "uuid": "04fd5b6e-3c79-4502-b82c-2cd56f5b1ea8", "value": "F3B3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135143, "uuid": "af3d6cb8-7f85-4d7b-86b8-6c584896e404", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135143, "uuid": "9ecedae1-1795-4088-af20-b4eb78ec04d3", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/Wxg/:Zzx7ZApszolIo7lf/ipT/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625135143, "uuid": "74d61c3d-638a-44a5-9924-603a739118e2", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625135143, "uuid": "48dac62b-4653-4498-8380-b3a852b3a0b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135143, "uuid": "8a9cd473-c3c2-454a-9d68-ebb362d89f3d", "value": "BD9E5D5843FA83ECFD17A430B7314320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bc7f35-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169264, "uuid": "db4c834e-b75e-4a9f-89de-249ceafc0a1f", "comment": "Malware payload", "value": "3ecfc67294923acdf6bd018a73f6c590", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169264, "uuid": "61fd21af-e526-45b6-8a7e-de8816bc6ded", "comment": "Malware payload", "value": "489fca69a622195328302e64e29b6183feac90826dce198432d603202ca4d216", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169264, "uuid": "1410c2ff-df22-4c38-a43f-90e315b2facb", "comment": "Malware payload", "value": "3557d162828baab78f2a7af36651a3f46d16c1cb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169264, "uuid": "c6401c2a-944a-4c50-8391-1d991d9d7a85", "comment": "Malware payload", "value": "4359df764c4d7a682a0e20456c3a31ac1a4021d0c02d8b2814b4138cde6eb95b6614aa46f4e8496b7e560ec0110975f6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169264, "uuid": "f850741a-5c68-40ac-a198-3125bfa67a26", "value": "DB638E13B5E1D032D02254B1AD66D6F28AAFF97259758047BBD912BE5FB02C09F38317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169264, "uuid": "3dd4ffe6-439d-46bf-9aaf-1458f1c04032", "value": "a6afa5b03e3f460fa6ef1066cf588231", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169264, "uuid": "fd91b9b1-245f-4225-9ca6-8ca3ceaec2d8", "value": "1536:9qjGid2Q39MSs5RfVaWM+A9ukkP2Gq/f9ts:Fidv39MSsL/M+AoP2Gq/f9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169264, "uuid": "4d618252-5436-4375-abe8-de7d306678e8", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169264, "uuid": "a613c9c1-2908-4878-861a-402ba3e35dbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169264, "uuid": "8bb2c12e-bafa-4068-a59e-0b38f53eb169", "value": "489fca69a622195328302e64e29b6183feac90826dce198432d603202ca4d216.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88819dab-da34-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625120472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120472, "uuid": "23e7ac36-c441-4baf-a45f-f993b5abce4e", "comment": "Malware payload (Formbook)", "value": "76a265a20e8788bb3798312d8ebb3638", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120472, "uuid": "005077e8-bda3-41a5-846a-edff63aaf18f", "comment": "Malware payload (Formbook)", "value": "497a977375495ac590ee1ca2d037bb06e25ace568747f8b9b5e1593a8d447865", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120472, "uuid": "11802502-05dc-4494-b04c-60e44116f22e", "comment": "Malware payload (Formbook)", "value": "bba9e2bac838fb289fcbb754b5546efa5f83b2c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120472, "uuid": "2d01e4f7-2543-4923-91b5-d6368e5c13fc", "comment": "Malware payload (Formbook)", "value": "5eb92a96accf1229ffd0565f2ade4c7c2624a2602f9d62c24a4c13793eecda7a19d0245acadc498834c5aace14c5d0fb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120472, "uuid": "017b805d-ff36-4cb8-bce2-9252fc4c4d75", "value": "0B8586DB786291C2C38BCAF09D6AB2CC962EF4E50CC856450815C7F92C5A6DBC70FD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120472, "uuid": "94f42169-44b8-4b41-8e0f-380fc8538e99", "value": "1536:UrjVejp3iiiiiiiiiGViiQibFr3ndbLuYib2GrjdUGbFr3ndbLuYiiiXiyiiib2P:lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120472, "uuid": "ff55f62d-fc80-4fba-8599-2c32ba86943e", "value": 1858519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120472, "uuid": "5803b1d8-2458-4566-9907-b9eacdba4fa4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120472, "uuid": "106bdf01-b04a-493b-b8c4-05c055fdc565", "value": "RFQ 55140 ER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf677a8-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625121070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121070, "uuid": "61443065-fcda-4e05-bfcc-bde483e39ee4", "comment": "Malware payload (RedLineStealer)", "value": "24b5d1d1a42a84011f59c885899efe37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121070, "uuid": "d525a3b2-4720-4703-8e73-0a27d0dfc331", "comment": "Malware payload (RedLineStealer)", "value": "49a5f3ffaf0821cbe31c9a7b10a18e3b55c2193535115c22c79dfef4238f29fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121070, "uuid": "5aa9c108-2421-4328-bfb9-fed45dc4ea88", "comment": "Malware payload (RedLineStealer)", "value": "96b2d50273a5b0608525538796951166bb3c1d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121070, "uuid": "e046edfc-114e-434f-8098-d021eb7eb201", "comment": "Malware payload (RedLineStealer)", "value": "f512de962ae1fd9aaa4a4408b3cf512ba05706547bb373a230ab7538d33fec04f9cca03fdc0e8fdb451781cf2b9cf217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121070, "uuid": "680ccb6c-c0a3-48c2-a3e4-868d06eb1e90", "value": "CEE402913080C0B3C6964170215EDB60AAAEAC3056B74587E7E52EBF7F232D556FA337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121070, "uuid": "b4b7da58-ad98-48ea-b313-c7946fddf8b2", "value": "fe051b2c4e04dc43ff91d31fb9184c89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121070, "uuid": "00b166f1-2676-4d4e-91ff-8f3986fe36a1", "value": "12288:Rzlnt6zkHIYf8clVG7UkmaA6+PMw5np7/DKjo6FW6gAiR0vy:RzlIzkHzfc7UkuHPMwzmo6A67iR0vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121070, "uuid": "90e9d18f-0cef-4c51-839b-e50bbf658b8d", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121070, "uuid": "b61f03e9-b91d-4143-9a38-144e57405f4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121070, "uuid": "7277fe27-55c5-46ae-a0cb-378ad402204c", "value": "24b5d1d1a42a84011f59c885899efe37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779745e4-da4e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625131611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131611, "uuid": "3885b755-21db-4456-98a0-1be74d7fc224", "comment": "Malware payload (AgentTesla)", "value": "91e19793d621a7151e14bb8001bd400f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131611, "uuid": "b2d08fc3-9b2e-476d-92eb-2e6df85656ed", "comment": "Malware payload (AgentTesla)", "value": "4a8f832dad98a98642890cfddb2efa7b599705fc170fbcca69c92dfc4240fc3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131611, "uuid": "4ebdb77c-1430-49bf-9630-483c0b271bb9", "comment": "Malware payload (AgentTesla)", "value": "7223b7514e14bd0d29253bd00917689f50b25fb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131611, "uuid": "e42e0b3a-ad7d-4b21-ac49-752487599987", "comment": "Malware payload (AgentTesla)", "value": "8ccf34d2d51171f8316496f71bb5023258ee229d8b1ffbf84569715be5d4b51409a17c11e9a25c027f80e4b57bac97a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131611, "uuid": "f2b776f8-a20c-4a93-82ea-bf49102be10d", "value": "62D4238A1E1547E81DE0DBD33521E5D3683BB202E13F02ECF66A1791D3D356EE686887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131611, "uuid": "a00a1f7f-df7c-4dc5-a39d-423d6b762b76", "value": "12288:C1FuygLMDgZU41pE4q/IalB8cg9nSpuOWGCy8xEcN7aO/OJlc46o:C1Fuyk8R4842IalBR2S/8PNT/OI4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625131611, "uuid": "6d966e1d-ef40-420a-a4c7-6410d3cdd676", "value": 630222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625131611, "uuid": "dd137a14-3cce-4453-bd8c-e1c4b72bb93b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131611, "uuid": "0b52fe0d-9c20-47ad-8313-d10044e52878", "value": "DHL INVOICE SHIPPING DOCUMENTS.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdcb80b-da71-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625146791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146791, "uuid": "46950228-b5f0-4b98-bc62-06ed5acec721", "comment": "Malware payload", "value": "af9d8a4a7211cadaabf225025c12a5cf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146791, "uuid": "059e05b4-5551-424a-83d1-ee9d6a34ca92", "comment": "Malware payload", "value": "4ce847f952281650f09b8255a7f909285f77a5d5801cce22419fb47da30db7e6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146791, "uuid": "7086b483-31e1-445b-9d11-606bd8cefeab", "comment": "Malware payload", "value": "6d9a8bece607925083e0a888d13dfc3ea72bcfe6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146791, "uuid": "cc059cc9-3e41-4e1b-8ceb-ba4fde5a6701", "comment": "Malware payload", "value": "1497bbf24edda234576fae4e6951c17d8d7658b89bfa1c0d097a6fded8686b51b16b671257025355c91f167e4a301a11", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146791, "uuid": "c2affc3e-bf20-42e0-91f5-f5115fe311cd", "value": "8AB423EEF97AEC60C5679B6C1DB719212CA7ECD7CFE11E1A01456032CEA48871870C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146791, "uuid": "db8e9901-7846-4638-90f1-ba95e7b699cc", "value": "12288:UCeziVRRYMnuqOiPoB6+celF4gnUTbrUjOSCN12p38:UCk6n7ToBLqgn9Ojb2p38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146791, "uuid": "78c77f1d-4ff2-4ad4-9382-50f069ed9291", "value": 500330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146791, "uuid": "b557288c-14bb-469a-b770-c049fe2b9ef3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146791, "uuid": "ade9c679-8c2e-4c73-a338-83841f01b23e", "value": "NEW ORDER 010.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec70116-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (XpertRAT)", "timestamp": 1625121100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121100, "uuid": "d459206f-6026-423a-bd2d-eda161d9a826", "comment": "Malware payload (XpertRAT)", "value": "173e540463300babea87380df68d79c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121100, "uuid": "b7409f92-31b2-4ce7-9bc5-0e2d957604c9", "comment": "Malware payload (XpertRAT)", "value": "51297f05449c2fe207a4635e0d1123c137bfdfd97157e09b00af119733952197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121100, "uuid": "ffbe9120-044d-48dd-8a27-d60faa9fd517", "comment": "Malware payload (XpertRAT)", "value": "2743c5503618c05afa9cea47b04d4965c1539d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121100, "uuid": "94eb1898-916d-4358-811f-1f34ae71b256", "comment": "Malware payload (XpertRAT)", "value": "228e980e61e3f99b7466de43059e447d848450895386cfeb0a9d3e09dbbb5c66fe041924122238cc8a5bc59cba3414d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121100, "uuid": "a6d29a7d-8e24-467c-afac-fdbe96e21f4b", "value": "57157CAC3254359EC567C6BACAA8AC74EA613C66531BC107909309DFAE0DB87DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121100, "uuid": "b4c444c2-fde5-4805-b02b-8f44f219782c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121100, "uuid": "d678b79f-5b4e-452a-9127-04376f4b3978", "value": "12288:j4LnjcHhu/5WhuSSI0vYy/Wn0XCi8f2P5ITwdD3JjB0nsR7DZ5u3v6kSVhLAp+J5:ucHhuxWQSZSs4B7q0D3r0IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121100, "uuid": "477642e0-daf1-4e10-8b4d-1fbefda37c49", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121100, "uuid": "a154d6f6-c83f-4724-bc2c-4961b5c21c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121100, "uuid": "14b0d6bf-343e-4ab8-83b7-a2ea4f4dd670", "value": "173e540463300babea87380df68d79c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675ca242-da3b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625123423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123423, "uuid": "0ea318af-811b-4cac-86da-2c0372e16059", "comment": "Malware payload (SnakeKeylogger)", "value": "2cf8352baf625c4a3298f85e1682263f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123423, "uuid": "76cf080b-da68-4b9d-ac14-91b9b2e298d9", "comment": "Malware payload (SnakeKeylogger)", "value": "51e8729128774cc96e269d638fccb14225f5cb2a662046fa0a1dc3799cc9e378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123423, "uuid": "00fa9b3b-4535-4fc6-b742-33370f50006c", "comment": "Malware payload (SnakeKeylogger)", "value": "ca2dc504c03a5f64927b1a0bcaef2e05f29a243b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625123423, "uuid": "ef081b1c-aaf0-4749-aabf-f0f17e0d63e7", "comment": "Malware payload (SnakeKeylogger)", "value": "ebbb259c2b3c2da460fdff311f66c631011e5d91dff22e5c6322f1046580ee91f5b8409cac6c35def49b75f37c4e9fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123423, "uuid": "1a540f6e-74de-40dd-b9d3-8f5b23a27d4c", "value": "6D35D10BF3089A45C8952638DCFFC2741375ED8A7C12CB0B2A997AEE3D72751DD512A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123423, "uuid": "dd13a61a-c07c-4520-b280-bac304553a4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123423, "uuid": "6297ae46-f0d5-4d90-b7f3-349b04b4c90b", "value": "12288:qIq2zu0wpwhzhtBLN1lyJYGbNw0/n3YgMFohR:Zzu06whzhvLRWFNZBUohR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625123423, "uuid": "324d9a39-bb1e-411b-993c-aba4a8a311df", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625123423, "uuid": "29fd82f0-ca28-45e6-8161-96ff271a7672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625123423, "uuid": "a539b967-345f-4bfc-92ef-4bac747cbea7", "value": "PO#ruSfhd95M1H3Y8F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e883d8d-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625133340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133340, "uuid": "08c12dd9-92ad-4ba1-832a-701bd2f5c6af", "comment": "Malware payload (AgentTesla)", "value": "3d6cf7a1fed97f0fbb978a60ffa26f56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133340, "uuid": "704fc2c6-af82-44cc-9a56-8339873781c9", "comment": "Malware payload (AgentTesla)", "value": "525e3d916bb14eeb8b678488d2d01c4f74dcf35ec84c1a4b4e56131a33364650", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133340, "uuid": "0e0a18b5-c6d0-4fa1-bce5-37467eac3603", "comment": "Malware payload (AgentTesla)", "value": "b6093634843a83bd6bff53f8f3c623ea2f58ffc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133340, "uuid": "557601bf-50b1-4478-8f80-48eb1d3fc43f", "comment": "Malware payload (AgentTesla)", "value": "72eef7d7422a5dbf0f7dc69639a25e9c30e9431a901c2941f1ccc52d7db5e955f183a2cfffaa1cbe00a4fd64fe54edbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133340, "uuid": "9da1e678-9840-427c-a369-02dd59b0b3a5", "value": "6845233026E84556D3779A3363F1328AD23EB7353A0AD22916F7079A4993F40CEE257D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133340, "uuid": "bed55e00-bd0b-4748-b7de-bff8e43ed662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133340, "uuid": "930cdb40-f73b-4f81-a264-bab543d2458c", "value": "24576:gpULTrW2+FLzx20pbT/Q8p59vODWZ2hsB7Mj5dTYeXMA94l1Ef4wooj:gpZ2ELzx2EPQVD3hsB7MjroA94lk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133340, "uuid": "8ddecd57-e741-49c1-8d0f-1c4d1a9cc8e0", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133340, "uuid": "9602c033-beb6-4059-8674-9620bf874cdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133340, "uuid": "145f0d1c-845d-4934-b1ad-9621908726fa", "value": "3d6cf7a1fed97f0fbb978a60ffa26f56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35502212-da8d-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625158558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158558, "uuid": "39b6f633-b986-4b6d-b19f-b7cc49a45c6e", "comment": "Malware payload (DCRat)", "value": "23fdbd675538daaa57f857fe20980dfe", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158558, "uuid": "27f76b9d-205c-4fc8-8c2b-e96af5f9ae92", "comment": "Malware payload (DCRat)", "value": "52a51d51c3a9c467da6f76833f58f3f0163e6dc28edb58d21c3aef9b18f95dc4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158558, "uuid": "4b8fc081-cce2-49c6-93d6-111d21c6afcf", "comment": "Malware payload (DCRat)", "value": "9168dbb79f8251c0ede7ba7a19b5f939c28282ae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158558, "uuid": "58e58f3c-d78e-468f-bbfa-344adec4a472", "comment": "Malware payload (DCRat)", "value": "bfce4705c5d82640f675fbbe9b3e22465f17a10c0bc8e2a1b62938e0aac7558f412d178a4eabd8a0a32c0db56743ca2c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158558, "uuid": "55e80943-39a6-4379-8d18-82b4849be935", "value": "060549A23658CD10C069063BD9EF45580FB8EE01B662DB1B7E9F33AC65613A77D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158558, "uuid": "8a86c2f0-589b-4dcc-913a-f03f489173b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158558, "uuid": "0bedcc75-2ff5-42fa-966a-385eb7a03c22", "value": "12288:M/nHhxnY/TMuTeMDvDaDPr5jvplV+haTzvTbtHPjtqn:MPBxYfKguLr5jhPdLfJt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625158558, "uuid": "2aff1092-9352-4141-86cd-887a232dec56", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625158558, "uuid": "547a057c-32c7-4298-8bac-b0003e88c4f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158558, "uuid": "03a29ccf-cd2a-43a3-aa22-4814f2222c8d", "value": "23FDBD675538DAAA57F857FE20980DFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1b92d8-daa5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169119, "uuid": "ac54b765-f7e1-4472-921d-fbebfef44bf8", "comment": "Malware payload", "value": "33f42e9678ee91369d11ef344bbd5a0d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169119, "uuid": "241c9d53-3c65-4241-884c-b29e51c62685", "comment": "Malware payload", "value": "52a53e7e250fa9faa823d26421ca8af42ac40c27bac1d5af65b452c8987cda72", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169119, "uuid": "4bbe8c8e-dcb4-44c6-98af-aac73d50e6bc", "comment": "Malware payload", "value": "8b8a5ed2f2921d355d82e342595b1e73f5ed2560", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169119, "uuid": "2859bc6f-d2ce-42ff-94a8-05d59c5d302c", "comment": "Malware payload", "value": "4c2f88f8400ee82be24be3707d4dda77aada45c144e6461e1376de48f40383cbed1671e36b9e29e854f9cd38d9093101", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169119, "uuid": "4dce75ff-46bc-4f68-ae46-d9c4be48ae3a", "value": "5EA35B20F1E4D4B2D02711B17AA9ABA7457EFC30677001DBF7584B792EA11F18A3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169119, "uuid": "2217a49a-c96b-4e09-90a1-26a46608a6be", "value": "bcab4085380a1e9f81941ffd62f1af43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169119, "uuid": "b18f4955-be16-468f-baef-ec4ad9f73598", "value": "1536:mmCm+jTqRp45XcSyKVszCDgbAafUKPpIrjvRr2SmbvK/kouz/OLQVug+TD:alj20szCD6sjlKJvhzWcVug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169119, "uuid": "a31238f3-7ee4-4efe-a811-f8fc6af76b85", "value": 97872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169119, "uuid": "e846cb94-34bc-4fb3-b0fa-d9b7475fab61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169119, "uuid": "53ce3056-da63-4d54-8e52-14e0bfc661fc", "value": "52a53e7e250fa9faa823d26421ca8af42ac40c27bac1d5af65b452c8987cda72.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc447b1-da8b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625157931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157931, "uuid": "972fac29-7238-4c94-a5bf-409b28401254", "comment": "Malware payload", "value": "8d31b19c81964bbfe7c57a5884ace895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157931, "uuid": "7dfb24ba-9b00-40b4-9c26-bf0a865cb18f", "comment": "Malware payload", "value": "54ff8bf201c18be4c5685d5e80669d1aa817063c9a4a10d6a880c460fd0adf93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157931, "uuid": "ca038eaa-2597-4d87-bddc-b8edf1e8ebf9", "comment": "Malware payload", "value": "6007cad5ee65a188ea810b769dda1ba72110d51b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625157931, "uuid": "f5a93055-8eb8-435a-b979-58ee9fb4716f", "comment": "Malware payload", "value": "fc59f47b11a742dfb9bb3be1f9b2911a1bc27c1ab6b3b117d55d149544bad53b0bdece8906feaaf7d3e03279783cf2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157931, "uuid": "a32aae92-7897-4515-a3d4-d030a585647d", "value": "EBF3AF82EB854D57E419B87642B3D64913E3CFB81E07B6072EC8ADBD60DD3D72E98046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157931, "uuid": "f7cdbfa3-a21e-4ecf-a49f-25264863c860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157931, "uuid": "05fdcf4a-7a90-482b-8acd-d0970aa743ef", "value": "3072:s3P1XoZYSOFi6qpESnOAzZfub63WXYmMcJC6Eh+BJVSM8c/j2:WXqFzZGb6GXY8n98cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625157931, "uuid": "cafa54a5-b6f2-4a27-862c-d937695df30d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625157931, "uuid": "d7143bb0-fdc9-4aba-9387-cedf9bd8b5c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625157931, "uuid": "3db7f526-6da0-4552-aa80-fedf8bdb0700", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d189a81-da4e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625131620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131620, "uuid": "5e56166d-a826-4884-b3e8-d802128416ae", "comment": "Malware payload (AgentTesla)", "value": "634e81e28a07d484b6878bdb54ce1a2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131620, "uuid": "fd765d02-8225-4444-97e9-4b9c820fcbb2", "comment": "Malware payload (AgentTesla)", "value": "5572f40539d254d11380be025633d97f0a2883a131dc625f8e4dac61c99a8a53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131620, "uuid": "00673c61-5439-4899-b3aa-2c6188e965ad", "comment": "Malware payload (AgentTesla)", "value": "38367623d49e21d840c974ffe8f7ed248c390d28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131620, "uuid": "919b37f3-6cdb-4f0e-abbe-2276a92fd0e1", "comment": "Malware payload (AgentTesla)", "value": "07594ed7e8e2900e7f11e10921187d9b2fe6980e9d8246c59f012e33133288030dc81d364bf4270a0117763be9d91e45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131620, "uuid": "e3c84dbd-1c76-4de0-8f69-f6a8b52c64bb", "value": "5745D11AF604D905C9A41638DCFFC27403B5DD8B7C62CB0B29987AEE3DB2752CD526A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131620, "uuid": "f1f0528a-1745-4f26-9014-bf197f5de2cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131620, "uuid": "dacf475f-f49c-452f-9261-b27f997105f7", "value": "12288:gw9ULfC+R14NhzhcF4kNJlQcivjceOseEDAZtwcT84logar7:Z9ULf1KhzhcF4kNQoeOvdgcofr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625131620, "uuid": "2f03707f-c4c3-40aa-ae8c-38d71348fab9", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625131620, "uuid": "b78fbadf-09ad-4650-bcdb-f5a7567b8db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131620, "uuid": "99b21340-28fa-42b7-a59c-41e48625d3ae", "value": "DHL INVOICE SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea470f63-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625133521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133521, "uuid": "d1635296-6e74-4af0-ba36-4defbed54ea7", "comment": "Malware payload (NanoCore)", "value": "26482a938a779487eeea3b7fe613ed35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133521, "uuid": "b08a0aec-16b7-4ee3-a51f-9e25e3a42000", "comment": "Malware payload (NanoCore)", "value": "5843b2cf0911e1e3ee1ad03e232c2d9f44a0c48806ff62eb0af25ade8695b3b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133521, "uuid": "877ecdbd-bb10-4449-82b0-56c84fe3533e", "comment": "Malware payload (NanoCore)", "value": "d87f15c381134b191e42f9637b9504e1ebe79b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133521, "uuid": "b2805991-9457-4e6d-afd0-d9f15383e1a5", "comment": "Malware payload (NanoCore)", "value": "d30300bd03c2ec3cf2a5b2d80a734d376baf9e0aea709dba7c6b22d3014f5fb74bf166900bc3f83e63f11c25c6480b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133521, "uuid": "2d4a30f5-761a-4d7c-87c6-71d944d3627c", "value": "D6351202B7D189B3D57229316E397B119D7E7E700F349A0EB3D4586DAF726806224BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133521, "uuid": "8ac0b50b-cd38-4600-b0b3-da3c30f8cfa4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133521, "uuid": "88e270e2-e2d2-49cd-9563-f13f6df68699", "value": "24576:BAOcZpJGmgHyTZYdKIBZ+gD0yAN2VaP7Lx9t7IyJr1:b7mgyYwIBZ++g2EXXtcyJr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133521, "uuid": "f25ebdc5-bc9e-4bff-b617-af9c20e906b6", "value": 1158006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133521, "uuid": "1de54de2-b2cd-412a-810f-66a4573a0333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133521, "uuid": "0bd1acec-63c5-4356-a61f-82c316f819df", "value": "26482a938a779487eeea3b7fe613ed35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed522b8-da30-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625118765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118765, "uuid": "db32fb2f-2a41-42c5-8972-48fdf478e8af", "comment": "Malware payload", "value": "699407eeac35b3081acc02e3dfcb61a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118765, "uuid": "c017f20a-3de6-4e27-afd5-ff6ab842bd02", "comment": "Malware payload", "value": "5902b8c496ca86604d98ed08bf0f5185e7d27fe276bb5f0090f4b24139dfa0de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118765, "uuid": "18915fbd-9adb-4cba-9522-c402ad005e74", "comment": "Malware payload", "value": "c4411f826002cbffea4ac2c1d3ae4bcb7f2c943e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118765, "uuid": "9b4e1fe2-c14d-463b-ac25-6e36492a053d", "comment": "Malware payload", "value": "a0d56c1238664f9f4a8760ab9962ae0710707b8ee20bc89de114d7e8f92c9a3a5d341cd643e977d2964fc6928aef4897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118765, "uuid": "49812e56-2c30-410f-82ee-d132bd450d26", "value": "AEB35B03BAD54471E8A20A3659718A11463FBC628B7599477BC83F9D7EB02C09E71BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118765, "uuid": "fc8ed050-b3cf-4126-abe9-58e352ea4452", "value": "4db85bf845f78d3968401d3dd78f378d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118765, "uuid": "79b68175-2197-463c-b65d-0ed33c429edd", "value": "1536:zNFcp+i+GcYdJ6sWjcdaKGSnr0QSASz3nYY86qvE:Hc+UdJlaKGSrQbz3nYY8DvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118765, "uuid": "77e6bdda-dc21-447f-b8bf-908926ad081b", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118765, "uuid": "656ba19d-19a0-4033-8b8f-edb407c81f4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118765, "uuid": "02542a89-e631-4d20-8c5a-9ef0c5bb5af9", "value": "699407eeac35b3081acc02e3dfcb61a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3300b04-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625132543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132543, "uuid": "fe736fc3-52e3-4e72-af23-06f903d3ce47", "comment": "Malware payload (AgentTesla)", "value": "768e4e2a96ee4b88675c98ff4a211de8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132543, "uuid": "31e1dd48-9e68-4071-9227-557473590a69", "comment": "Malware payload (AgentTesla)", "value": "590c7a30601a170954eecdddd699ba3159e21a9d6521522ff2aa976def0bd498", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132543, "uuid": "05ea54a7-b3ea-4610-aba5-fd26aa5fd7f8", "comment": "Malware payload (AgentTesla)", "value": "a148530e2eb1e3f0bec055f57b0c43d22f40b5f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132543, "uuid": "e29cc660-1ea1-4c47-b23e-fb6928c78270", "comment": "Malware payload (AgentTesla)", "value": "2b2a3a2f1420cdccbd9657c60418a74e35532eae89540392b4166dad55bc52a8305b49da10ed2b1f44aa73142e6d670a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132543, "uuid": "094ef2d1-a85c-4517-8380-91fa7b282a14", "value": "7745123BBBA71C13D7938636F47DA14078EA7F67250E2046230BAD0AF47212D36B559B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132543, "uuid": "7f8474b5-8a8f-414b-92a4-98893eed1f82", "value": "24576:FK+NZ7cw5d2/5ahhzNSPG+qfHXKX5FbQ0tsg:vNp3AIBgO+mXKJug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132543, "uuid": "f243f426-250b-4b9f-ab33-bfab35b22b76", "value": 1168248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132543, "uuid": "fae80ef8-5cb7-419c-b210-90d6acd53fa1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132543, "uuid": "47729f8a-10dc-4935-acd9-2d73fc54c427", "value": "PO HDT01-07.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebabfe69-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138248, "uuid": "761fb81c-fe15-41cd-8768-633c636c4c2d", "comment": "Malware payload", "value": "463935875af3e7435216e38fdd5ee2ff", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138248, "uuid": "d8234264-2e56-403e-b063-82ff93f7be91", "comment": "Malware payload", "value": "5911f11a27fdd9ab31f7f1709916777204375bb24c6300ae80dc0b823c9b4bc9", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138248, "uuid": "b22a42d8-4062-4278-9b2f-917912ad6077", "comment": "Malware payload", "value": "bdd233523504fbbe1e456d00b87a84a09be4dca9", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138248, "uuid": "11fa42d5-d937-4709-b8bf-3367b7ed6d05", "comment": "Malware payload", "value": "479b16c58b97540e9c601b209d6b29f6f4809191de665f291368c78f4558e250dac91d0b22b4b2750f6470ef29fa7160", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138248, "uuid": "524182bd-ebc7-4c5f-b9e8-928634b44828", "value": "7021D3522AF82016F7B36E80AFF894A4EA36BCE01C09D82E0195064E01B1961DC71FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138248, "uuid": "3259b808-9f4c-41cb-952b-ff238104e067", "value": "24:QChVOessAN6h72esMAN6hYAFeSLesMAN6hemiLZErrER+lSyy3chmrrEREfyy34:tH4UhrIUhYAUhIUhe9AQIliMhYQKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138248, "uuid": "f3a688e5-9b7d-4682-80a5-ffb0bc68ee3f", "value": 1250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138248, "uuid": "c7866a50-edeb-4315-b04c-c71ef0332933", "value": "text/x-ms-regedit", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138248, "uuid": "c8122941-1ae7-4450-9cc5-09dd8c1b5cf0", "value": "Clean.reg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d206ce9-da54-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134197, "uuid": "b8570f41-dda6-4433-83b3-4b4c690cee02", "comment": "Malware payload (AgentTesla)", "value": "baf4f3f3eeeec9b127321aff996b9ccf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134197, "uuid": "f3bd39e2-5449-40cf-b7a8-f2646e0fe60c", "comment": "Malware payload (AgentTesla)", "value": "5a3fa956c8c6f4c56393717e712e7ce7a9876274388257361b4ce4196c190330", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134197, "uuid": "98aa2d4f-c1b2-4f7f-93c0-3c7d78e7eaba", "comment": "Malware payload (AgentTesla)", "value": "fb61f2442f18939e2e87577b6b06e44fe38f434c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134197, "uuid": "0dbbaf50-6091-42c0-ac10-e1fd8e7b8e64", "comment": "Malware payload (AgentTesla)", "value": "a769a00bb6b67214066ba2e43dc15c0aae7b0b07be4dc5b4acfc4d79c4972c2c636ec5f2de9454874ff5b94affea5a43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134197, "uuid": "99bab38a-088d-42da-ac7c-613024e63246", "value": "55E49E241DE95025E4BA5FBD86A0E57253ADEE232F13D95C24F23EC73733642C9E052A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134197, "uuid": "512aaaa2-b29f-4565-be95-ed233c57579d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134197, "uuid": "8bd22e0b-a59a-4c14-8d5d-0fa658edfbb0", "value": "12288:e7FCBbX5TyKe0vx53mIn1ABH52geDgXzAG/Xb08u6q:A0z9vrmI1ABZ2gSyzAG/Xxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134197, "uuid": "47a31f28-f340-42f8-b9d3-74c0ed4dcec7", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134197, "uuid": "10b2d09e-6877-49ca-971f-2862630f4671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134197, "uuid": "cb0a3ee3-f5ff-44d7-8431-324482e92c24", "value": "Zam\u00f3wienie-017.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7468477-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625118833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118833, "uuid": "41cd3bba-fa21-48e6-9d1d-c3946b19a602", "comment": "Malware payload (AgentTesla)", "value": "890dcc321d7cf36347ceffc283235f82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118833, "uuid": "d99894c5-45da-4d31-8811-47ef08632b07", "comment": "Malware payload (AgentTesla)", "value": "5a81904eb31f3d6a09a3843d2504bba6b4702c5dc3700c8a47c47cded68b7347", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118833, "uuid": "b4878a4c-5672-40a9-87ac-1bb0d159cd33", "comment": "Malware payload (AgentTesla)", "value": "caf391f669a5251640ad2b2c3fbbcc8d97549095", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118833, "uuid": "0c019982-d3a2-46ff-a4ca-d2249bdfbe2e", "comment": "Malware payload (AgentTesla)", "value": "59308c77d832eba1605867e2c58ecf2b07f859a2d80ed636fcf01cc41822dd432707ad56d26ad6ad480244757ffdd622", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118833, "uuid": "a5577a3a-d4fc-422b-882c-f52d5e16d16b", "value": "B37433A4119F8272E6488E4D35C0B1895E75FE9230CACC2963AECA71DF55AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118833, "uuid": "e5100cf5-0066-4bce-8471-6cc6278594e2", "value": "3072:9tBrB2BrBYhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHU8Cu1FDUn4VONjP+1MWzPDW:ZVcVYK8FdzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118833, "uuid": "e2c32dc2-af76-46e7-b9ba-3058f0cf1e75", "value": 342900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118833, "uuid": "0e470985-789a-4692-82eb-894473886041", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118833, "uuid": "c9037904-4a66-4a63-9355-6056ae4bcb2d", "value": "new order (2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439ffee3-da59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625136248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136248, "uuid": "39fce676-ecde-4a19-bd87-06cbf2a0c7e0", "comment": "Malware payload", "value": "c0de5b33ab30d3257451f2aff84d4e51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136248, "uuid": "10305457-dc22-4a26-91a7-7c3eee7bc7f0", "comment": "Malware payload", "value": "5ac7fc154a948a26d0b7469dda7495f712cb15d055692e6cd989c07c92fee9f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136248, "uuid": "400939eb-0472-4148-8529-41595444bb84", "comment": "Malware payload", "value": "80107375712e8796c6e686d2e7250446aa14d10e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136248, "uuid": "cfd5e57e-0e31-4aa3-ab49-284683b092e8", "comment": "Malware payload", "value": "4d402e188348cb863baf2506e7b3bcd2668cbf744fdbf6417bdd52d05eba18dc37807574dd501b9b7111521379f2af61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136248, "uuid": "0df9b048-3451-4868-85a2-f7bf9b16ae17", "value": "A546236312570182C1F5C839D137BFE539F746AA8F02E8B8A5B7E9C125369D5E313A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136248, "uuid": "40074644-99df-4de8-83ab-f3f482fd82ac", "value": "7fb05647d0537b5b517720efafc40fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136248, "uuid": "e837feed-41e2-4639-991b-908fb8324c5a", "value": "98304:BhAvjJHXMQtJPpe7gM9vJR4YWUH1NUzqRYzczRBV7XYRhhY812kCU3ItR:BhQJHXMQvPWzLR4YfH1NEAY49BBeY814", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625136248, "uuid": "115d082f-e2fb-4637-aeb0-604fd5ec7a46", "value": 5691904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625136248, "uuid": "2232b935-a215-4474-be9a-6050e61c60b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136248, "uuid": "06e072e4-9c4d-45d0-a419-4458fcc33766", "value": "c0de5b33ab30d3257451f2aff84d4e51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8ff9ab-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625133448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133448, "uuid": "47173be4-8922-447b-b523-e621c978d73c", "comment": "Malware payload (AgentTesla)", "value": "5a84987e2893be74662a7624c837a308", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133448, "uuid": "22cd15b3-09d0-4e9c-9cdf-84673c9324e9", "comment": "Malware payload (AgentTesla)", "value": "5b2041b106b2a1867e2bcc981e84794ff680939d4977293cbb4ed5a6a7ea9cbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133448, "uuid": "dfe850db-883b-40cf-bf3e-99499a6a7e65", "comment": "Malware payload (AgentTesla)", "value": "7d3010d008cf0c7526dbcee621f1f4ef0fee656e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133448, "uuid": "f67905a8-0aec-47ff-a9ba-6cf340c2d127", "comment": "Malware payload (AgentTesla)", "value": "7ddb6cdb667e10f98506c16c9ee7d2ea755bdcb20a7af6977b976366629722f28381d1afdf8c3cf61ab8f618ab0e66f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133448, "uuid": "e7e56986-c22f-4c2a-85e5-41d38afa6164", "value": "EAA4351230D8D08ED7AE7530643513827B76E975FB56A0FCEC4EA5B84AB5ECC4C9068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133448, "uuid": "7e1af5b5-9d4c-475a-a7a2-26645c9b9dc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133448, "uuid": "23ee8281-1fa8-4146-9111-75886fbc4795", "value": "12288:nEFVzMF1lqk1wAm8aGhbDjrYi9x/OK+IA1/vf:sa1lqCwu3jkmOK/6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133448, "uuid": "e7fe0e69-5a00-4580-a3dd-e55bbfd0538e", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133448, "uuid": "5f95c579-54d5-44b5-b011-de9d76c1fa86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133448, "uuid": "64a1b1c0-635d-4065-aadf-9d7fe4c8bbaf", "value": "5a84987e2893be74662a7624c837a308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de981d40-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139515, "uuid": "75f38400-84ac-4bfe-b3f5-dd578e89cea7", "comment": "Malware payload (AgentTesla)", "value": "dce1ff31a8e6fe0039721599e36abe67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139515, "uuid": "628d08be-0127-4dbd-8fc0-e8316d814fbc", "comment": "Malware payload (AgentTesla)", "value": "5b293ca70449d8da04fc704635e04b266290b5591ca49ef4a29e7ae1d656640c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139515, "uuid": "120dd359-a45a-46c3-ab9a-7034704db498", "comment": "Malware payload (AgentTesla)", "value": "11c63a1e472798d730e53f3c46f9129c266d1b4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139515, "uuid": "ac065f9a-3ef5-4b8e-8ddb-ee8f3a1801cc", "comment": "Malware payload (AgentTesla)", "value": "55fe9c43b344df79177977c9e113cffd2dbfc49fad9ce07be858f604d5d85f25c49d88646339907a2ffb74a01ff2851a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139515, "uuid": "360c93af-2cb3-4dee-a725-5e2edc7c4a17", "value": "0B05F4132ED4C52DF0F94E7D46F811527F5BEE921A0B8EDA14F733AD06A2542F8A091B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139515, "uuid": "02232032-5334-4e4f-ac30-059e40074aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139515, "uuid": "02d35cbf-a78f-498c-b62c-1fac8623b711", "value": "12288:ASI6ABbX5TyH2YgvLRzZQ630Zzw/TJRc7Iuurw6+:mzyfgDRW630Z8rJRiIu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139515, "uuid": "0ea84cae-5e9b-4e36-8e04-d90b4f64d8a0", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139515, "uuid": "c930f3da-40ce-48cb-ba7a-158afd637183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139515, "uuid": "4e54cf23-0a16-483e-891c-9c207e1d3974", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79b85a2-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625121035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121035, "uuid": "079a9f20-4388-4dcf-b300-a91e325bdde1", "comment": "Malware payload (Formbook)", "value": "251562b9a01a39aabaa6e90b388db3de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121035, "uuid": "90372a22-ff7c-41fc-9bd9-c199f5b3b3a2", "comment": "Malware payload (Formbook)", "value": "5bac5e555b8504bcd9e0cfc48e89c6ab0f9c3f1faa30996a4341893a911ee613", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121035, "uuid": "df74a28d-3efa-4072-962c-7e20331a33de", "comment": "Malware payload (Formbook)", "value": "c3019da03ed849719f274a6281dac68e7965b263", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121035, "uuid": "c3a90fe9-4959-4bc1-b0fd-a6db2523b0a5", "comment": "Malware payload (Formbook)", "value": "4fc3007cfb2b8e3342d910cd4e823d4f7c4882f36fdf93f148ed8635c093c746c84479fbb1b4cb4757a9acfa198bd1aa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121035, "uuid": "7cc8c606-52d4-4c38-92e1-c181d0a2fff0", "value": "C41412B5E7B99597C28CA19F610980EBEE8C7C9BD0D168F8D008C7BFE1664364E1458E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121035, "uuid": "90c36596-a485-489d-9052-e1a7c87c7f3f", "value": "3072:AT+mzY8O6A+zQHZvTZQxeiwFkSxq5756PPYgo5UCVrjhrq5EjLvOFO:y+jCASQHZvtQrOkN5sHSaCVrjhrqKjjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121035, "uuid": "242b0b63-6d1d-4590-b2b8-d59b0c67d224", "value": 196545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121035, "uuid": "8264f685-d671-4b18-a253-e2b5dbdb9fda", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121035, "uuid": "9b264561-c1f1-42fd-851c-ef3d014244a6", "value": "Incorrect Pi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49e5e2d-da2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625118023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118023, "uuid": "a910f996-26b1-4376-ae86-528fd66bf18e", "comment": "Malware payload", "value": "79a82795e93ac0ede240ed34dbf7d708", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118023, "uuid": "e93d30fc-d945-42b4-a38d-471f38ffe075", "comment": "Malware payload", "value": "5d013fc9a0d2e1a0956b4bc7f5ccb321346b028a50c7974905f0db8e1f91e6ed", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118023, "uuid": "414cf112-ad13-4008-a1a9-33ff437e8fcc", "comment": "Malware payload", "value": "6fefe7e8e904aed80d8e5c6d4a2a82ea6e8c3340", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118023, "uuid": "f1f9dcde-37a3-4e3c-8f10-25b4602b0c41", "comment": "Malware payload", "value": "051607d12b355c2ff55591d6ed5b88f05eaa1a905371941e4c176549377a46c1aa3274bbbaf311bd404be9debc779808", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118023, "uuid": "c3b7442e-3a3d-4bcc-aeca-7d29ade00a6d", "value": "244512FCE2F95BB0DA5840771A1D26A3EC3E1C20E65AB5C88F35B068D0F682F5571D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118023, "uuid": "5d76caec-8505-4954-8c5a-e620ed193daa", "value": "24576:YrFRT3ESiEJB4OGGaiFU4FTy2670WW1i3p/xnr7n23/mob6T:YrXt4O/FUMZ6gWZ3NpWvmoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118023, "uuid": "b0b75325-fea2-4669-be8e-b8e00d1d5dff", "value": 1191992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118023, "uuid": "6b2c70f4-dff6-49f8-92b4-25d8aa6d86df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118023, "uuid": "132e4cc0-ead5-4b87-908b-41fd2b82f764", "value": "LK1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ae4ff2-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134663, "uuid": "99fd9ad3-bc3e-433b-bc78-daf937741ba9", "comment": "Malware payload (AgentTesla)", "value": "d46423f6dd4836ad292e54d3583bd4ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134663, "uuid": "9cd39065-a557-46c1-b9ae-58226e1edb64", "comment": "Malware payload (AgentTesla)", "value": "5df0e93a537d205277f9b73229d1ef19d2ca3403bba3dd9a80d2b772b961ddfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134663, "uuid": "e28e6817-ac1b-44c5-bd25-43b833337dd8", "comment": "Malware payload (AgentTesla)", "value": "66d79bd6c877878d825b9a3f409b22cd1ee927b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134663, "uuid": "1642e981-e423-4670-8fba-f5301c1d0539", "comment": "Malware payload (AgentTesla)", "value": "80661630c911b93156f16db610053c40037f4c430484c781fe2e6824fe7e75ed8e3cee88d2e390fef7540185de5ca637", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134663, "uuid": "9770bdab-c048-4408-9664-95ef78df4de3", "value": "0945E107F645AA56C8951538DCEFC2B413B5EDC67C22CB0B2E997AED3CB2312CC516A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134663, "uuid": "5d38d4ee-3986-4a8f-beb9-28294f33bc1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134663, "uuid": "f36ca76c-bc5a-4921-a95c-cd1bf1cfcfb0", "value": "24576:zBi9UhzhGQOx/3v+9Yz8BcAHBfdwGtgGlIkhJ:zUUhzhGQOxv+ezLADwGtgGlbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134663, "uuid": "05f84111-aa1d-4be6-9fc1-2b813845ffea", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134663, "uuid": "05ee01cb-522c-43cd-bd7f-5b183c58cc8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134663, "uuid": "afcd7f71-6ca7-4d9f-a55d-0f814f457aaf", "value": "d46423f6dd4836ad292e54d3583bd4ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4dc6a1-da02-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625098839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625098839, "uuid": "dddd6be2-b887-4aba-bf46-e762dae768b2", "comment": "Malware payload (FickerStealer)", "value": "7a314129215b5e6ef9840e1d77ef6755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625098839, "uuid": "25cf60bf-466c-49d4-96e5-472b620b8523", "comment": "Malware payload (FickerStealer)", "value": "5eb75f7a60533e8ada7004d9310da9cbc15d03235d6778e370c48555a3a6ea92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625098839, "uuid": "4827aca1-05e1-4d08-a32d-99ae4150853e", "comment": "Malware payload (FickerStealer)", "value": "43c916bab9055a590b2ce0914074730bc7dcdb59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625098839, "uuid": "4e8b2b43-6115-4522-9500-08b62fb90a1f", "comment": "Malware payload (FickerStealer)", "value": "410029249e4b9057a35c635d1f42a24596cd4aba36405d9fd56a640d8000f9e8d393145aa227dd322fddca10c51c7214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625098839, "uuid": "e56883d2-6321-4afc-ade8-1ba9873c4481", "value": "9E84AE00AAA1C035F5B312F88A7593BD953E7EB06B3050CB52D5EAEE1A346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625098839, "uuid": "a95b762e-7b4b-4d89-afc4-429e34314cb3", "value": "4a891687ee9846e9d6ffccd45a4930df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625098839, "uuid": "9811e4ec-1f20-4b83-8d17-530b2b17d95e", "value": "6144:ScuTN+VA0jc8O4G2DGGNWyV0KCH8A5kpCs3cdK/dJnZVkfxkE:yN+VA0jbZDGGNWPdCBsdmjCfxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625098839, "uuid": "89015806-23b1-46c6-bc1d-9c277f233466", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625098839, "uuid": "086f1bef-8320-49ae-94ed-cd31b62b3309", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625098839, "uuid": "c32b6185-110e-4a02-8d88-2223c159bbca", "value": "7A314129215B5E6EF9840E1D77EF6755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e5e340-da62-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625140257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140257, "uuid": "7f224857-b42d-42fa-b077-ba8ae96e0603", "comment": "Malware payload (FickerStealer)", "value": "c933615cf82bf793c662cee520aa0091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140257, "uuid": "755f9744-0907-4f81-9654-01dd0faa5dbf", "comment": "Malware payload (FickerStealer)", "value": "5ee314a1b864135945e39b2f0e3d3e10ae603256e0e152a159650f2ad142fcca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140257, "uuid": "e5e36f30-e0ee-40df-a5dc-966825135cc3", "comment": "Malware payload (FickerStealer)", "value": "9785eca850cf33289e1386b38ba52948f4cca1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140257, "uuid": "7e8bbb82-0a4a-4124-b22b-cf75848078d5", "comment": "Malware payload (FickerStealer)", "value": "65755f6c0a87d4935f09f3172a9b761c1bc040233e2fdd95ed62d74096071be63b350d3438d37fbf2c91f3e02509466e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140257, "uuid": "dfa3e9f0-3ce7-45e5-9ae5-2147c8c221ae", "value": "423633086096E2BDC853C9B4A3E8956764EFF7731CE685CB36A4BF44A9031D6E01C3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140257, "uuid": "8d708ce9-bc43-4419-a5bc-75b3cb2927b5", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140257, "uuid": "b99475b1-c1a7-4a48-87dd-68d69a280092", "value": "98304:JGswTTOqwaqWB0K6jWWABJFsZKwwVCJaBDmD9Td2veAQgPBdq7tX:JGswTTPw3sBJwK1mpTd2veAQEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625140257, "uuid": "7bacfb71-49d6-4acc-b3ce-224da3c8e3bb", "value": 5202082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625140257, "uuid": "f94dc0ea-b7dc-49d4-b820-0eeed9ff73fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140257, "uuid": "37817541-4995-4edf-82d4-80ed393d5e45", "value": "C933615CF82BF793C662CEE520AA0091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85e2c5a-da68-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625142967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142967, "uuid": "b1854ad9-62a8-4fe8-bf21-ba48a8b4802f", "comment": "Malware payload (Loki)", "value": "ba39ed8b6f645c0554f563b947be0993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142967, "uuid": "eea9d6bf-947f-47d2-b4dc-48c3826e4d70", "comment": "Malware payload (Loki)", "value": "5f9a8a691de4c14763bfaf0e9229f04c1167572138d8b73f508d49addf0036b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142967, "uuid": "8b390ae0-666e-4651-9df5-3fad177a9699", "comment": "Malware payload (Loki)", "value": "ecb95f31bb703ebba76790829b082d1daeedc3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142967, "uuid": "098df45a-01bb-44ae-9e9f-4fbe615f9f59", "comment": "Malware payload (Loki)", "value": "2614d4e8caae9fbe10209740f6b53a9f3ef6c8da066e423c84a3916213e412eaefae44db19fc55ee3ce43a2be5a5bc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142967, "uuid": "044218d5-4455-4b74-947a-fb90f2214532", "value": "1035D00BF704AA51C9592238DCEFC2B41375ED9678268B0B3D997AED3CB2315CD512E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142967, "uuid": "8794f504-8d99-462a-897a-3b6147a36a53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142967, "uuid": "ae341fdf-9649-4dd6-a5e7-f1964114184b", "value": "12288:/oDYo8BIP503OGhRXhzh6A0yuqNiJtEV3h2RNYAqFzdwP68ni579li6hi:/W50phzh63yuqz3hssF4GZli6hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625142967, "uuid": "3da0860d-3476-4d0f-8486-5356ceb91a37", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625142967, "uuid": "08ede252-99a2-4be9-9568-6dcfe087c9ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142967, "uuid": "1e51b5c6-d574-45b3-8bef-5bbf05e414c5", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0a8d8e-da79-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150275, "uuid": "c4967404-b389-4ee6-a92d-f33f834543dd", "comment": "Malware payload", "value": "d54260950af9e1ee49beaa697ad81858", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150275, "uuid": "eaadaef5-ef09-494f-8318-3ca7c554e665", "comment": "Malware payload", "value": "5f9e7cd21a11f7fdecd24d8725d6bfb27fb1297bd884ad18f703fc1c8b203e1b", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150275, "uuid": "e3cac042-a9b4-488f-a99b-7c83301d92fb", "comment": "Malware payload", "value": "76350cf7b0232cf55ece0b3181fe2825c17c023f", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150275, "uuid": "a5f8dab6-98cd-4a7b-a47d-142e251494e5", "comment": "Malware payload", "value": "658e842c43c416e98efccd001df0b31d7355d4911a0ed8dbfcb23c1725238c1e67e0e47e6c7e3b8117f08a31660fc8d2", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150275, "uuid": "1cb92039-f63c-42ec-a711-85c14da4d3e1", "value": "A2A423BE7DC0178DB65B015D104D793024A2F65B0A4B5C121EBFB1B7A6BE0D8E12DE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150275, "uuid": "10d23e20-978a-46a3-8a1f-d460b9bd064e", "value": "12288:82IlwKhTkbnA8dU09Iu2YdtxtjEdhfnGqZFs:QlwKVkbA8dNht/Edhuqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150275, "uuid": "ff88870f-f42d-4083-863b-06de257eea75", "value": 488928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150275, "uuid": "af10feef-cf74-4ddf-b627-0a9d580d9d74", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150275, "uuid": "d505f184-2bd8-4405-b160-1d726ade86be", "value": "infjgd7371.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eef38fa-da33-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625119919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119919, "uuid": "b7c4a846-efd9-4e2b-aa9b-3305aae5f5e3", "comment": "Malware payload (AgentTesla)", "value": "412ac4cc715154005ba87bd65f9c90e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119919, "uuid": "de262507-0308-466b-9a74-fa390b46d24c", "comment": "Malware payload (AgentTesla)", "value": "62a92f05c0c46b08df2a5a225912f93c502a359c7f4d468f3293da049c827ade", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119919, "uuid": "8969aebc-c0b3-4d1a-b772-af09696aeabc", "comment": "Malware payload (AgentTesla)", "value": "57d3b93d6d54eabbf92dcdad934db601609c8b8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119919, "uuid": "ba23c5dd-f48d-4d56-aab3-e54453085464", "comment": "Malware payload (AgentTesla)", "value": "84fce3317a304b311045ddba689caa8b300b1d19b756e317ae388150803f564517d2ebea9f6f998c93444025d71add71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119919, "uuid": "5157cec5-5094-438c-a74f-aa5c61ae469b", "value": "89D423F6C0CCE364EA64F9B7670F63F61952118234EB4EE819C46216FA40ACD6D4EB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119919, "uuid": "6eec1fe2-4f79-45c5-82ba-cc1c1bb81d87", "value": "12288:mwcK9w3DHf7QO4YSsTLfb3WVoW4ZdlkW/wAvtDHYBoBfHVPeFRa8:mhwwTj2YSs/fb3c7ikW/Ft7DPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625119919, "uuid": "25ef33f3-16d1-4c96-bce5-c08859e27721", "value": 611403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625119919, "uuid": "d7a303ce-5112-45c0-910a-62811a27fa8f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119919, "uuid": "d767961a-0bff-4b5c-b4e9-753f416c5c9c", "value": "UPDATED S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bb72c8-daa8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170447, "uuid": "13b3b936-72f6-4d24-a063-8822845b0c2e", "comment": "Malware payload (Mirai)", "value": "b91c3d08e99c28781e7e9161f19196bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170447, "uuid": "7392f3f1-5c16-49e6-9eaa-74f0f4e1bcbb", "comment": "Malware payload (Mirai)", "value": "6358aae63375094567629e6d753e3c31f27b4d7b13fd594aaceff0b0278348ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170447, "uuid": "d6f0f7e4-5a52-4faa-a6bf-33051d87f6a5", "comment": "Malware payload (Mirai)", "value": "65ce000195e6c92b93977332258cc5ddd85a56c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170447, "uuid": "b965b1ac-7044-4e07-9110-904e189af604", "comment": "Malware payload (Mirai)", "value": "8fd4e5f64f447fa97163cb1e119460d31488506e927c5eb0be98bfd6150ebb20378f9eeb468757067780ae0d8fa59cab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170447, "uuid": "bff1aa59-cc9d-44a7-965d-2cac308c7efe", "value": "5FB2D09173216474CAA41F31CD68C1EDB16B2589F3FE22232A190575B68758B37F8A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170447, "uuid": "0039d55d-c6a3-41f5-a97e-a19ceaf68a96", "value": "768:qwBA1NjQwcThlYlYXoKrEas4ccUcfh7s3Uozy:qwBA1NcwcThuuXosq4czcfEzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170447, "uuid": "a8567753-7895-4671-8493-18f0b7857a9a", "value": 25000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170447, "uuid": "236f5f5b-0987-452d-b574-cda28c145859", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170447, "uuid": "caa17360-ab1a-42a2-84b7-3d0e4ac07d0b", "value": "b91c3d08e99c28781e7e9161f19196bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292d83b7-daae-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625172711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172711, "uuid": "14b07982-9940-45c9-8866-a95f72ef94cf", "comment": "Malware payload (Mirai)", "value": "1ea87a95c4333622eb988cab37c54f99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172711, "uuid": "1e5f2099-d4f3-4bdf-88e6-9be2e6d4e5b3", "comment": "Malware payload (Mirai)", "value": "63db31b325befa37286aa6ef1c3e13fda3e38cd37b7a6c43e39d337f80c3efc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172711, "uuid": "5748f988-e8d3-44c6-bf56-c6d9e21a376c", "comment": "Malware payload (Mirai)", "value": "a474ceb524f1c08daec37cce3e7051868b380d7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172711, "uuid": "6073507a-cdbe-462a-bb04-1ac66d74e60e", "comment": "Malware payload (Mirai)", "value": "ab19d62aaeb8567553e40fec316fc589d240cfa98daf6171f1656b43178afe31a0f84629dbe5b4ef79c785224ae3c214", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172711, "uuid": "94d0f2af-2acd-4ec6-b744-ad50da519c67", "value": "4F735B24A9792E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF2465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172711, "uuid": "971bfa39-4769-44c9-b98e-d01a8102de93", "value": "1536:SbHmkTSo3BOIqS5aq+Dc035R9QuEk6vNy2KjfaFVY:omcjaq+Dcc5J+vNojfiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625172711, "uuid": "0b56954c-f1c0-4dd8-a19d-6a78d0c41e30", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625172711, "uuid": "ccc8c50b-2d41-4a19-be6d-c0f1002405c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172711, "uuid": "5da22b41-e658-4d7a-ad9d-986d6051bf20", "value": "1ea87a95c4333622eb988cab37c54f99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375c0a17-da69-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625143100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143100, "uuid": "12d3ceb3-55a9-405d-8c65-29207af96da1", "comment": "Malware payload (AsyncRAT)", "value": "df6922e11bb3bcef662789ad970ad6a1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143100, "uuid": "33d67167-4ebf-4f18-ae8c-ecfe96a026cd", "comment": "Malware payload (AsyncRAT)", "value": "6476d20efbafc2f125919f44a3e70e27e70812f68963c7c3e31f1ce7afe414d0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143100, "uuid": "841e3369-6371-4d76-a3df-fe8054d68d7d", "comment": "Malware payload (AsyncRAT)", "value": "84d2aef996d056042afba2b9b850a5d0b1eaf70a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143100, "uuid": "c8b95d20-7ad6-4d08-91f6-72e8e9d980ec", "comment": "Malware payload (AsyncRAT)", "value": "db89ca8c435880db5e2c97746d6c18c661afb23c624862ca578dd7009ddacc9c92fa67c51e1819bdebf685e9a891318e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143100, "uuid": "0c1980bc-91a2-4073-abd5-8fcb1d78d946", "value": "11E4056EA150B08BD805BCB049B9976A66352C7805C49E07BEB0AB0D29737F37CB571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143100, "uuid": "8e928857-2558-4fda-bd01-56ee060586c8", "value": "41999ec9d2bb54af1616c904a0650895", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143100, "uuid": "eea64269-cd29-4634-b6f0-39d3a16fb7e3", "value": "12288:BvYQ66KSyqoati7wbGJ0wvgp2ksCsd39JKixuFUskanIp3h:BQQ66X+aQ7wbGJ0wvgp2ksCsd39JKix7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625143100, "uuid": "a5738cfb-c8a6-435b-9ac7-ad65a3f61aa1", "value": 711080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625143100, "uuid": "235ea59a-ee35-47ef-93a4-305e9ec50f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143100, "uuid": "8f2ecc8b-03ca-40f5-b49e-f0cba76cae70", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f77f0a9-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1625120860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120860, "uuid": "0150ea66-10c4-40a1-b078-7277e4a3454c", "comment": "Malware payload (Pony)", "value": "90613aad4231a93b72f43587b568e338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120860, "uuid": "0536b6c3-14a7-48d0-b7c5-da45b6c9b839", "comment": "Malware payload (Pony)", "value": "64fe753151b9031725f678753f28e119f65e4b7b8664a1c69aefba2f72473355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120860, "uuid": "172ef5a4-833c-4f55-8992-3023d237f967", "comment": "Malware payload (Pony)", "value": "369a97a1a1354c7171cf6ae7597fa23892ea8b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120860, "uuid": "fc0894b8-fd05-408b-953b-002e0fc322f5", "comment": "Malware payload (Pony)", "value": "20f5f838b88916bf4e7ddd12db70b7e2434aad193eb98b26d3bb234db104344ed4cf23ec95d67d0c52074f0783154e77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120860, "uuid": "0ca1f79d-63ec-4e8c-b294-c2849fe84116", "value": "C1B412283AFD5279D3B39FB739E422418B7EB635351AD05934D1068F4A93B81CDE2728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120860, "uuid": "7fe6612a-6f9a-4f12-a19e-a8c2677162a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120860, "uuid": "fe823a15-94fc-48dc-80d3-43b64df0bdcf", "value": "12288:U9HCAQ3JQHmv25DZoaPbJeJsQDFxHG2LEDqz:yCF363xZpbIjDWYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120860, "uuid": "f7ade9b7-6a37-4701-accb-9b3074e11907", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120860, "uuid": "d22ff773-84ed-45c3-be66-1fd6c55df716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120860, "uuid": "b9ddd64b-9c77-4daa-9eee-3266b306570a", "value": "Scan001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4c8c08-da73-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625147698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147698, "uuid": "cda754e6-ebcb-4289-8062-53176bc91994", "comment": "Malware payload (RemcosRAT)", "value": "0d61bce4fa608e01b8e55cbed76a130a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147698, "uuid": "c31a7ba3-73d9-4fdb-ac7f-0673f20abfe5", "comment": "Malware payload (RemcosRAT)", "value": "657cf5b353228351f20b758886ed20ea09b2f2ad0740ab826e8ffdf2df8ab947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147698, "uuid": "93f1422a-1f30-4380-812f-e881238bdfea", "comment": "Malware payload (RemcosRAT)", "value": "8c822c24d17c01ac47f9bf85bd1c3b9e177d57d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147698, "uuid": "64c775cd-f67b-4173-a921-76c51227b9b6", "comment": "Malware payload (RemcosRAT)", "value": "370f671373b8cdec9174f7c8b1db66400c58db01510431f4e8043d8fd798ff23639de41860542f2de2a70c76cf69ccab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147698, "uuid": "276008b6-44bc-46ba-b8a0-938b080b7ed2", "value": "188437E595D4FFD7D0BB22712EE4B6004B230B5928148244AFCC651F3B626DE2796F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147698, "uuid": "ba8bddd8-a7cd-4779-8be7-163a1f338a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147698, "uuid": "6c5240d1-42c3-4502-a34b-cb2aeb853590", "value": "6144:UAx0cmapCiV99L5pJprt16jA2kP06A87xB3NEUNTqYFaNEfWJ7sP:TFpFHjrp/Pd5NB+YwN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147698, "uuid": "09174dd1-b4c1-46a1-8214-52b1fdcc7795", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147698, "uuid": "d1d5412c-bcbf-48f7-8bd3-985d422936dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147698, "uuid": "3a3aaab9-b0c6-418f-8994-cda4cb164275", "value": "0d61bce4fa608e01b8e55cbed76a130a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b664ac2-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625139268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139268, "uuid": "4d78e256-ef77-44d1-85c3-bd9b56dea627", "comment": "Malware payload (Formbook)", "value": "0dec1c0b17fcdb432bf02d60b2ddd9f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139268, "uuid": "9665bbc9-3dba-4577-b7c5-ab4a1d3f61ae", "comment": "Malware payload (Formbook)", "value": "660b2eb5749963f118e49c2f7f3b253b1563a9f99063ba29122f2b6bb72cb6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139268, "uuid": "f308c64c-4e19-409a-b1fe-24096f8571a6", "comment": "Malware payload (Formbook)", "value": "3978f00bcf50b3ccf2fac6dc25d47338d4382175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139268, "uuid": "3e4fcdc9-fadf-4225-8421-a8af285b2878", "comment": "Malware payload (Formbook)", "value": "b5756260327d1996708f9ecb32a2a1dc0bd545be5536785852760f3170cd900682024a7771dd60e45959e5da23c3b1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139268, "uuid": "e0131fde-2de2-4294-a3ff-56344485572b", "value": "F5F48DE271C1D436D16639387C3B9A65792AFF45AD043D0A3BE83F4C4E39680BD2A197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139268, "uuid": "d1b6c497-d6d9-4af4-b403-50a26a7c932f", "value": "49872ca347743de3342dae48ab6a2426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139268, "uuid": "7c655791-5371-4d2d-8cc9-a85c06dcff8c", "value": "12288:3/GRJUeqFZCVHtc67SJFBoy7PoAMkANkLkU46Xc:3eRJsFQHGKSacRsN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139268, "uuid": "c4f4add0-96da-4169-a2bd-8271145361b1", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139268, "uuid": "905b517f-499a-41ec-a74c-8d4b49d0bcfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139268, "uuid": "3167f782-c16a-4804-a112-e227a81c577d", "value": "BH87874_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe399c81-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625151164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151164, "uuid": "05e6eb5f-0803-4783-8743-b99b78b72fbd", "comment": "Malware payload", "value": "57f4151075d16c6e03adfad834cb431f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151164, "uuid": "6b6afb11-46f1-43cf-a2c0-a139e4a7f336", "comment": "Malware payload", "value": "666bd31fa831cecf0e5483fdb9d0886daa8d7d98015ad4ceac3d7911e22af209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151164, "uuid": "2967b3d3-a8b5-4d2d-9ec7-2f1ad093e334", "comment": "Malware payload", "value": "20cbe41efa47f12d77ebc0bcc2d5fbc35c633a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151164, "uuid": "12f4e2bf-6dee-4fae-829f-c6db8e29da31", "comment": "Malware payload", "value": "84bc20d5d99df51a27e19c78ad490e7981094c60cf4a7ca8c721ce77d3e1e804cbc51aff03bf9929e995e9c6d30a609f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151164, "uuid": "df06aeda-93f2-4d4c-9fb3-3f2af5f52587", "value": "16B4122836ED56A5D2779F7AAAF12245C77DB32BBD1ED01D24A2034E0483B81CED1739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151164, "uuid": "d1731d4f-3383-4394-b5dc-17893cf610b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151164, "uuid": "6f0acb87-f619-425c-be3a-19092fd8a78b", "value": "12288:ixfZUUu8ybkhh33wlT9spoqfon2CrWHlwIi:iWvVQz3gV5q9C2lwIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151164, "uuid": "49fb9c92-f4cf-4514-b784-b8f0def7ec44", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151164, "uuid": "fc3ff56e-9c67-4d02-b9cd-07de3e04dd1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151164, "uuid": "72239a0c-b62a-4262-a8fe-86e525e51361", "value": "ETYPO210701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f422a9-da70-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1625146182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146182, "uuid": "5d2c3a7f-569a-4ec4-8c86-f2875374921a", "comment": "Malware payload (LimeRAT)", "value": "b97310e2ecc75a1ac5b7cf34503d1509", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146182, "uuid": "79dc335b-b810-4bec-8aed-abf3d690e972", "comment": "Malware payload (LimeRAT)", "value": "673d9ec17f2437917846f5ce799f30399d0739c9dd3e28d3d44b80b5f91de54f", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146182, "uuid": "8237dcde-e814-44d1-82a8-25b62a5f15e7", "comment": "Malware payload (LimeRAT)", "value": "b34bd40fd5717e01cf5ba7cbe2bf8d5d8331783a", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146182, "uuid": "9c37c31c-416a-4a5c-8fac-bac1035039e8", "comment": "Malware payload (LimeRAT)", "value": "06f2029a512b37aa501dcfe9e53343b021517bcd1a75cf8bfc711e30b836466e1c17751d03c464a359a96fa39a86914c", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146182, "uuid": "e2eebd0b-f907-4a3f-8ca2-5eceab271cb9", "value": "194512CDE3F91911C0E625F2049B4636AAE0FEB2B425FC491F1CB1D4F235A748E953A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146182, "uuid": "c3618dd4-b8da-4074-ba90-8874fcee5763", "value": "24576:Q3/Tod3tLMU1QU4g6lFw1Yx3sFrkStbOfbVaQe7C8w2JSSbD845wHz0gF:Q3ANMU1zh6luNmTfkQQCJ6S08+wHz0gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146182, "uuid": "953b3c26-f40d-4257-bc3f-ae1910825fdb", "value": 1236216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146182, "uuid": "225bcec6-079f-498f-ad25-eb06224b4dca", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146182, "uuid": "ae07c402-a92c-4edf-87cc-94e5e36d6886", "value": "DECL G50 EURL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053b4703-da7c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625151176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151176, "uuid": "5fd1f61b-3778-40a4-b03a-673f118be730", "comment": "Malware payload (RemcosRAT)", "value": "4784e99510212d885dc41e7dbca7cb0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151176, "uuid": "e10e0f37-03d9-4dc7-9e91-59a173a27eff", "comment": "Malware payload (RemcosRAT)", "value": "67ad9e8efba0a4c87098f6dfa675de65232d3458c98157642d7301b795771ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151176, "uuid": "f95ebe21-579f-4446-b92b-697aaf29a1f5", "comment": "Malware payload (RemcosRAT)", "value": "bbba64c4e67207fe18e36ad04443ee08880082af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151176, "uuid": "8bd0bbe0-a2d3-4339-895d-45031cf48c1c", "comment": "Malware payload (RemcosRAT)", "value": "529ffe7f1ba3f07cf0216f1853005168d31398febcf6e5683b1c9bd0f7fa8a091dda726ac580006f26e1dad993003f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151176, "uuid": "23720da9-6bbf-4939-9daf-ae2b45325960", "value": "D9551202B6E188B2D5B314351A39BB116A3E7D700F299B5FA7D00D6DDF32A41A521FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151176, "uuid": "256301da-67a8-480b-9940-e103b99de5e5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151176, "uuid": "740f57c6-926b-411c-914a-8c6fd68b48d6", "value": "24576:BAOcZpJHoQl8PrXjxphJbr9ihlQT7EyJr3Ju3:bUxGDTnghMgyJr3JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151176, "uuid": "8a8e2fb4-7006-4dff-a48d-49f52d2523db", "value": 1309231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151176, "uuid": "97e3e9d0-e01d-4a54-8f8f-855bb6d3636e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151176, "uuid": "1ad854de-1ca9-448e-8761-774827d321bb", "value": "FATURA.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56b7038-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625133540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133540, "uuid": "946c47b3-adcf-4893-b701-2cdef2251e31", "comment": "Malware payload (AgentTesla)", "value": "b42f9388e999242190cef57690ae4929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133540, "uuid": "e51847c5-6e1d-4113-b75c-003f96f36b28", "comment": "Malware payload (AgentTesla)", "value": "6830905eba294273b6b4dd27f4e8670d4c05013d85e88df7db1b99d42619f0f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133540, "uuid": "778a6760-dd1a-433d-8e97-fe45e5f6ca7a", "comment": "Malware payload (AgentTesla)", "value": "2d786f9cf40f6194a35530b503d0c04621eec558", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133540, "uuid": "60ed3dea-bb54-4f51-ad30-1197feb64de1", "comment": "Malware payload (AgentTesla)", "value": "31693d3da9136e14498685bee2ccf2f6a4bde608af3a27228c6a17fb94fbab44bb100188a1c6234737f7b70e505ffe12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133540, "uuid": "3990730f-ad90-4f4d-a9c9-136f500244c6", "value": "EED4122829FD1366E2B78F3BA5F464A2D23D7716391AD44820D147DB4D83B40DEE0F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133540, "uuid": "c4254974-ce3a-46fd-bee6-e316c4f1e45d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133540, "uuid": "080806b0-d871-4957-838c-9b4b396d33e1", "value": "12288:ObIoulxU8P2P35SPk+Xb00fD8U3WjypuwEEfEFb67nz:VhlxU8skpXb0078U33HH6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133540, "uuid": "2b8279a7-922b-4f8e-8321-e8e767eacd94", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133540, "uuid": "39df65ef-5129-427a-b492-ebdcf434a745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133540, "uuid": "71bc1148-d7d5-480d-815d-53c72b9c5e96", "value": "b42f9388e999242190cef57690ae4929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f178088e-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138258, "uuid": "ab6f39a5-e008-4862-aa29-0b61e9bd28a8", "comment": "Malware payload", "value": "deab42d91409428a4f7c1cefbbdcf467", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138258, "uuid": "7252dd52-6e44-4952-9101-3ca825d947a2", "comment": "Malware payload", "value": "6a0ae9d4f52540b8350ef88ceec2fea4e59e517b0f559182aa97e886328cb4d1", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138258, "uuid": "ca4251a5-0ad8-4195-a633-007dd7725e6f", "comment": "Malware payload", "value": "7667453ec29ce6dd725b7abbf87b969d053a2f5d", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138258, "uuid": "4f3ae630-bb6b-469c-8710-d8233c9121b9", "comment": "Malware payload", "value": "a6317411d9aee8e05bba60d1233098216484bd6f1fc136654985202762219024eb9edff768a79ceb86b6e281e8305536", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138258, "uuid": "d24d214d-1c92-4d33-8f53-7808f932b423", "value": "7AE0656D4447C73A2B4807578F2411E863B351DB120C1340F92A9D9B5504BFE4BC4B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138258, "uuid": "f18de22e-43f1-4370-b536-7fb634277516", "value": "6:+1L8W53Z+1lFoAyzyFEQRFvdjhFvAjhFvXhFvkhFdQyL6XSbn:HW53Z+++iQjv5TvmTvXTvkTWR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138258, "uuid": "e6edec15-39a8-4947-995b-c593f9ece878", "value": 413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138258, "uuid": "4b8afa2d-a0d3-4fe5-bb7e-9a91bb3a4eee", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138258, "uuid": "ab2ecef4-bb2c-459d-85aa-33889a3735e3", "value": "if.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632b75bb-da4f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625132006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132006, "uuid": "d22f471d-db04-4452-90a8-4367edeedee0", "comment": "Malware payload (SnakeKeylogger)", "value": "efcc35fd090adcb50be73642fbebb80b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132006, "uuid": "c288626e-f283-4848-b20a-8c1ecef0103b", "comment": "Malware payload (SnakeKeylogger)", "value": "6b8319a10c24a79aaf8ff125ba566e01c9f5cbbd5c2c5d7686760a838bc2fcb2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132006, "uuid": "cc2d487a-f171-4f37-9348-a52458f09e2c", "comment": "Malware payload (SnakeKeylogger)", "value": "7f61ebde51cc5baad19b1606ac26d772ee1e74ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132006, "uuid": "2b86a1d7-6d80-475c-bb60-bd38a18a96a3", "comment": "Malware payload (SnakeKeylogger)", "value": "ceecfccddd9dbbd932cfe8091e62c85dcfa312ebca723fbaf99fe232b5b19551fdae4d06168c7601399d6e37f868c45c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132006, "uuid": "a9a110fc-6b5f-48de-81dd-9b296daf0422", "value": "9794DAE4008F4272E7458A4D3680B1896E36FE9230CACC7963AECA75DF65AF55FC4583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132006, "uuid": "d0fc311d-c252-47e6-9191-22565117d532", "value": "3072:9qcVLwBrB2BrB8hK6C5Oj4BUJZTTfPavDOz79Wzj/i4qH1lXueyd9nIn4xkV57/7:RLGVcV8dWdzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132006, "uuid": "15419daf-dec7-41bb-a91d-fd2808e65c1c", "value": 418433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132006, "uuid": "94fd70ad-0526-449a-b42f-56483050d56b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132006, "uuid": "05829eab-d9c6-46d1-b434-6e7f680de67d", "value": "Purchase New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5613fb7-da73-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625147660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147660, "uuid": "5f0dc98d-a423-4fc9-ad8f-2a451ec94ce8", "comment": "Malware payload (AgentTesla)", "value": "fc1338a2df6adadb17c28a7e71b53805", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147660, "uuid": "950d7903-c4f5-46ec-ac97-a3a1afc82456", "comment": "Malware payload (AgentTesla)", "value": "6bd9139f731b6d71de6ea95806a86fd5a73525c444a8a64089ee70326994d2d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147660, "uuid": "597b94ef-3e0d-4a31-b36b-85ae3db85ce4", "comment": "Malware payload (AgentTesla)", "value": "a36bcb803ceb4693f5ad6c28da5152a821ef88fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147660, "uuid": "dc2b6854-ef23-4ed9-8217-2f622991f0a1", "comment": "Malware payload (AgentTesla)", "value": "d756643803f76f5dd26264e81ef5348c22bab6709de8edf7598b0dcbdc7222463625a868f3b92527586d5dde55b5ba2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147660, "uuid": "c5f1ae9e-b4c1-4b17-8676-d99f9c54ed57", "value": "53A447E695D4FFD6D1BB22312EE5B2004B635B6928049604AFCC751F3B226DF2392B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147660, "uuid": "5c685b66-4444-4b9d-bd99-745b7f4ca922", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147660, "uuid": "e8f6ffb2-cc2d-487d-bd51-f73261835190", "value": "6144:f0cmapCiV99L1McDtQea4g85tzPOHzD5fplwA0jE23Wm2hnxJJvnNAJg9I:HpF3ZVqHRXwxE23WmQxnAAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147660, "uuid": "60b361b1-0fc6-4b19-bb5c-baea015f1587", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147660, "uuid": "bb002cec-2719-4fe0-bfbb-f9603158d17f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147660, "uuid": "782fb9fe-f325-4ddf-9998-50e0aa2455bb", "value": "fc1338a2df6adadb17c28a7e71b53805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdee8c36-da6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625143782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143782, "uuid": "31465b61-61c9-4e95-8e51-4c477197bd96", "comment": "Malware payload (Formbook)", "value": "738775afbcb59b72b1249294363e76a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143782, "uuid": "6361bb31-1c4b-4001-9cb2-12e90b6d6edb", "comment": "Malware payload (Formbook)", "value": "6dcacc0999d412f1ec9c51ba728eadd0fa56a226e2486d283015845604d68e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143782, "uuid": "646ac264-f2e1-4f19-a4ef-9c409c1af23c", "comment": "Malware payload (Formbook)", "value": "5c2872bbafea5aa5f298df9e88649448e9157061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143782, "uuid": "56e18456-db38-4ac9-8b06-30b64564e223", "comment": "Malware payload (Formbook)", "value": "61cd18e4bc41d2cfe15f8696b275b0e8a8729702cd94c5a9185425ee3d488e85c7bf9e9b8a964275bcfea3346cb45fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143782, "uuid": "eb74567f-cc64-4dae-89da-7e16146f7508", "value": "4024124AE393CEEBCFD149B0287A52805FD442041275AF4FB7289FBDF231A61641D6B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143782, "uuid": "3bea7390-1ff7-4a99-a97b-d5ce82dc8cc9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143782, "uuid": "90b68f76-b0f8-49b2-9855-f55be090060e", "value": "6144:xqjIbAHgAuM4XtaAnlf/EX1hiRBSo/z84:YvruM4XMAluOjpI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625143782, "uuid": "571bbded-1de6-454a-a982-6b8ab45d7b3a", "value": 226354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625143782, "uuid": "e402ecc0-c327-449c-89b9-36a6ca3d339a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143782, "uuid": "5b55d349-1cd7-48b8-a364-66527c086765", "value": "SecuriteInfo.com.Zum.Androm.1.30395.11586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537a44b3-da87-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625156032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156032, "uuid": "0f9869e7-3da0-4a8f-a568-8fde5f51d105", "comment": "Malware payload (FickerStealer)", "value": "392fc3d980b07be74eb27eb133ac48ae", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156032, "uuid": "165a1f50-0e1a-47ec-b45c-a80fbba5b400", "comment": "Malware payload (FickerStealer)", "value": "6de957c6676bdc847586662208a81e09971fbe1257a7557348d67621e63a8e5f", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156032, "uuid": "939f56c7-10d2-49cf-bf54-1cd6061a769e", "comment": "Malware payload (FickerStealer)", "value": "4dd586156f768e02068d015f5fc3a65ce02b1406", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156032, "uuid": "2be25830-a3b5-4172-b633-442a2d4d423e", "comment": "Malware payload (FickerStealer)", "value": "e0ec3c74f5c9e8290e0b76b920663276587d8ed62781b47c54ba68ce290c0399b7868c5f4206d1f0ca07ee45b218e815", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156032, "uuid": "c5ce0d57-5e57-40d1-92e6-bb486d803746", "value": "0C35C022F691C837D13766799D6B92AC5829BE107D24AC4B3BD43F0C6F387817A27193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156032, "uuid": "389006bd-0eba-436d-8836-2a2242ec43f1", "value": "24576:7EIZ4wA74D4SQKxZcy8gthDWEwZ+V7w5lesFUst:7+wJD4QZh/qEOsMFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625156032, "uuid": "f9d66e57-1a1b-4dfc-a966-5bbb655d8dc0", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625156032, "uuid": "ee091cea-6bc7-4ce0-aec6-ac702748e49d", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156032, "uuid": "eb9ba7fa-6490-4aea-a67c-6b22dc8b4fbb", "value": "0701_1866962341645.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d52b79-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625132568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132568, "uuid": "1bf3d1e5-36ad-4451-a036-7777f8b713f9", "comment": "Malware payload (Loki)", "value": "240081a190a3d14b7d7ffc2c13205d27", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132568, "uuid": "801f2273-faed-4bf1-9eea-a77308895e6f", "comment": "Malware payload (Loki)", "value": "6e51866d95b28105b218d2f8a0a488afae17af44e8428e29cd4d3e9955e55fe1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132568, "uuid": "5bf7987a-cd9c-4632-bac2-eaf8e2f0181d", "comment": "Malware payload (Loki)", "value": "681cd0fe130965c2fb798e092f027e86088df7e4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132568, "uuid": "e78b471b-9dc1-417d-9d9d-d6de8169fa8c", "comment": "Malware payload (Loki)", "value": "a617dcf3f700644ab59b4113f972e280f6a46168aa5caa707bdf4c02ac01ab1eaf385ace05ed08950da7e1339c737a0e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132568, "uuid": "e3532ffa-18f7-4c48-b38d-4818123fee0e", "value": "E35512D876D5A36BE88B4975E6CBA15821253D00F326D7B936CD334334FC621CAB2768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132568, "uuid": "97bf88d5-7187-4583-baac-7f7fe850f6bd", "value": "24576:9/2GwVQugdtxI38YIeSjOFHWMTO/jeGwYEkd3SURKrqBZNJL:9QGdtu8YIeSjOFY/fwgd3SU2oNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132568, "uuid": "f4c589a7-cd64-447a-93be-d45721b08593", "value": 1291816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132568, "uuid": "d6bf6069-5245-466c-a35b-1da4be004c3f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132568, "uuid": "fa11090d-957c-4463-bbe8-add5b91031ee", "value": "swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1233ea13-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139172, "uuid": "1e88ecf6-dc1d-4718-8097-79ffefb99f4f", "comment": "Malware payload (AgentTesla)", "value": "956a108084e6e22cfb01a06962f4275d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139172, "uuid": "c899d44c-df8e-45f1-880e-7294644aabad", "comment": "Malware payload (AgentTesla)", "value": "6e8eccdea8e3265fe6c45c15bab86334c7335250996039adc86ad6f019684903", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139172, "uuid": "2ccff07f-c124-4662-bd1b-4cb3ce89bf1f", "comment": "Malware payload (AgentTesla)", "value": "0d4e79ea9f11647df4f220cf382dec376e28a090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139172, "uuid": "33442abc-47f9-423a-8ee8-ba4c1216dcc0", "comment": "Malware payload (AgentTesla)", "value": "857ade47bb67f656044a24a2fff2b98c54c28c3da5645f1f2b5c9bdbccd6fd1b2c6167609d5a5348e420cce68e83d789", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139172, "uuid": "25c1bb82-4561-4d31-a63c-fce5b06f72ad", "value": "A045D007F6099A45C8991635CCEFC2741376ED8B7C62CB0F2E997ADE3DB2311C8516A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139172, "uuid": "7eb37892-9aea-45f2-b7b9-1659a6882a7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139172, "uuid": "8f8737de-1db2-4843-8bdb-156ff4808a35", "value": "24576:krTGmG3WU2hzhrylgF6WyTpv/l+/cKqMt/3qwwz:krPwWhzhr4y6JtnkkEa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139172, "uuid": "4c43a89f-c23f-4fa3-869e-03c28c7ee948", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139172, "uuid": "e4c148ed-7eb7-43ba-bc0c-cc90dda30828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139172, "uuid": "17a11aad-dde7-4e8d-9419-4c399581a046", "value": "quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4e7bf4-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625151131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151131, "uuid": "61121721-131b-49e1-bee3-76e9ef18b1ae", "comment": "Malware payload", "value": "79895f6689105d28816a0f9819a7c319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151131, "uuid": "76438a81-461d-4378-a1fa-65bf0a8feb8b", "comment": "Malware payload", "value": "6f56e2921121d8013895cf883d382c22103da8cee4f057169b822b7a1615d4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151131, "uuid": "c6254ed8-85f3-4739-8520-0893ef09948c", "comment": "Malware payload", "value": "06aed1098e841b5145f0494051a9214295e80253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151131, "uuid": "abc6d380-2dd8-40d3-a8c3-68e2153b38ab", "comment": "Malware payload", "value": "e3436d2ea2ef3edabb215710a645e7224d82dd232237238187c02990a61b3a6ccd8aacf2c10d79842eab574a6ac9cbea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151131, "uuid": "44f4ed0b-7d81-4788-9b5e-cbaeb925cf3f", "value": "65C2E40037FC9B26F5BA6BF95E7100104BBAB516A422EB1E1CC170DA1A72F444BA1F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151131, "uuid": "c94fc3b9-b1f2-4cfc-a21d-bfe1ca46a530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151131, "uuid": "c9ff7637-7129-4a20-afc7-5b5df1a9d213", "value": "384:lWv6mGtu5t3G1kG/0vw10dbwXYgYUwlFTpE9iYShVmgaUVwLm8EHLYTfi:oZGt2tqp10db/RaMkgaUVwLm8cETK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151131, "uuid": "a33f3cf1-bca0-4f02-81c8-88a9ddc2d668", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151131, "uuid": "059e0edc-cc89-4b7d-9613-17e457d09ae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151131, "uuid": "f0a73cdb-299f-4796-bdfe-5933aecbd1fc", "value": "PRODUCT ORDER 80028923 400927360118727 2304848486400812.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5352ab83-da12-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625105780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625105780, "uuid": "717edde9-b9a4-4e42-87db-a456baa1ed24", "comment": "Malware payload (AsyncRAT)", "value": "d99d9c6058b7930918860c4c203755ed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625105780, "uuid": "c0c8febc-3e2d-4b99-b764-543d79033ee1", "comment": "Malware payload (AsyncRAT)", "value": "6ffa008d9c18433dfb729075105f7837874da4b96d22c7718f360558f9aeaa0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625105780, "uuid": "52fdbe69-30c4-451d-bab3-3023d22781ce", "comment": "Malware payload (AsyncRAT)", "value": "1442319f9bade3eaa042ae9a9c04578be61fc402", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625105780, "uuid": "cac49c87-5b36-47f5-bbba-2ff881c4919e", "comment": "Malware payload (AsyncRAT)", "value": "73a44f89b47326ec3908cd87e0cb2f6ae52afde684a89dd19d0ed19232fa20e1893d2a8ad851a5c20719e490164af5f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625105780, "uuid": "8bf93dd6-b2af-4d9f-a74a-f142b6e01cad", "value": "31942240769DEA37D9AB5BF648A781100BB3E06B1222E7FC2DCC97D01679712919BF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625105780, "uuid": "31a82613-c77f-4442-ae8e-e0f8b3ccb1b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625105780, "uuid": "8b5a2158-a4fb-43b8-acac-a05baaf74d87", "value": "12288:kkT0EFVzMFqQSvw7D2LKKGEY1Y0uq4OCc/Ht:kkThaq6IK9EnhOCc/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625105780, "uuid": "77e61675-1ad1-45ce-9244-55ab45bbbeff", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625105780, "uuid": "6fbd697c-3905-4278-afd0-88e2118f7945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625105780, "uuid": "1f86d11e-5e57-4a42-bae7-6bfcf9c1f1b5", "value": "PO# 6042089404900 & PAYMENT DETAILSpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a295c0-daa5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169024, "uuid": "e06c0333-8931-46c2-bda3-0e5265df2a6c", "comment": "Malware payload", "value": "3562bf97997c54d74f58d4c1ad84fcea", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169024, "uuid": "d68f8c9c-4ceb-4d5d-8443-d83573f4a6ff", "comment": "Malware payload", "value": "6ffe81c2883c298a65477ba2bc7ba1063315ad6b26f0188e3361d0fa924575ae", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169024, "uuid": "918f35d3-485e-497d-98a3-3d0b77aa5013", "comment": "Malware payload", "value": "5a08e5bce797142c6d46675a6c070e503e987dd7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169024, "uuid": "17b07d71-ab34-4413-b98a-aa351014ebc6", "comment": "Malware payload", "value": "527114689cb15a7668d31826459a7a30311ab1a41ce877f07583fbd5163101ab27bfaeb871484edafe8dab67d76a2e51", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169024, "uuid": "ba1d8ed4-105c-4302-a5a3-0897cbd82c34", "value": "F4639D1375E1D072D02245B1AC25E6B28AAFFD725A754047BBD912BE6FB02D08F38357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169024, "uuid": "12686f10-4a2c-459d-bee0-ca1363aa7061", "value": "a6afa5b03e3f460fa6ef1066cf588231", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169024, "uuid": "23b1ce0b-da84-4804-b26b-efed782edb5c", "value": "1536:2eI1nbPFWt/ydMfvRRZhlZtkkT2onal/5f90cb:E1bdWt/yShhlZ12oalxf9nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169024, "uuid": "2e19fc46-d4da-4d01-8705-b629c7664008", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169024, "uuid": "91405cfd-5af5-430d-92df-beeef06ebf6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169024, "uuid": "262c71fb-6f11-425a-aa33-af2a07e39b56", "value": "6ffe81c2883c298a65477ba2bc7ba1063315ad6b26f0188e3361d0fa924575ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437d8fd2-daa7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169749, "uuid": "9eabaab1-2c57-4389-894d-43643dab006e", "comment": "Malware payload", "value": "51ce1318c71a5a1ab1ed2314390d08c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169749, "uuid": "f0958682-de0d-4e1a-82b4-73a7b7bc7d84", "comment": "Malware payload", "value": "704cea9cf2bcfaf5eb8e072ec299125703ff291d1223db387365079758e366bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169749, "uuid": "2a98496d-2970-4b2f-a2ec-ee65b81f668d", "comment": "Malware payload", "value": "51bf74f04bedf54d7c68f00727b9a359031162a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169749, "uuid": "71fac7c8-baee-4492-88de-94c313180011", "comment": "Malware payload", "value": "c2205fcc01d5a5ccd4539918d88c77eb061094cf4bb5b8d667ce409ae128d78faa38689d74d2f4d69c808cf16d6e54f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169749, "uuid": "b6239226-81d8-49d7-8f23-161cd84e0bf3", "value": "43D41299F150E0F7DE6444745C2699D3C7BBAD3DD9B02B0272E4BB9F3932A53822B841", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169749, "uuid": "da02a18f-a0d5-49f8-92e6-2c1e5cfd2348", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169749, "uuid": "6762ac89-d164-43d3-a25d-6540b701c9d9", "value": "12288:mbvuvDWFDyB98SEbe6PGSe9scMCvXesF/m/Uc6yPLX:EvuvA+sB1cMaesF/mMePLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169749, "uuid": "7315f9bf-74b0-4646-b98f-69b70925428a", "value": 617854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169749, "uuid": "18c2ef37-125a-481c-8955-1dee639cdeab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169749, "uuid": "c69f7beb-f747-48e5-b8e8-90254525e2c3", "value": "51ce1318c71a5a1ab1ed2314390d08c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d5bb95-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139317, "uuid": "703a44f6-c41f-4bde-8750-5886a66d922e", "comment": "Malware payload (AgentTesla)", "value": "01763d22ba6b4666bace678661736aa8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139317, "uuid": "ce118c2a-9c68-42ee-8e98-ced9005e1048", "comment": "Malware payload (AgentTesla)", "value": "71fd63bae4cdf372d6a451850a966e026ec87445abf9d802bfc8ea8f8c35c529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139317, "uuid": "95d9b77e-ecdd-4b22-bb2f-23b20638b9cf", "comment": "Malware payload (AgentTesla)", "value": "f538629c61aaed03f031a726f4b0f71f4e243425", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139317, "uuid": "322ed317-ac78-4b9e-a497-9de3f7e67394", "comment": "Malware payload (AgentTesla)", "value": "8d0ec511c5f1bf993b965d2ccfd3e305599e00ac41b8fad49b51105987ae32d1671c90a943ba2e98a6725188237e59e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139317, "uuid": "d8710765-7348-4db3-a426-e5701f99f004", "value": "5EF48C241DE94035F9F94FBD8AE060B257AEBE232F23985924F23EC13733641D9A156D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139317, "uuid": "f5587fc3-d170-46ea-8371-d3d718301ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139317, "uuid": "7425cec7-16d7-4130-b9ee-9e36a803e0cc", "value": "12288:v5CeBbX5Ty0+KYKS+JYXlM2l4B2JQvAcuz81kzZGI062:BhB+yEO2eB2SvA61eZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139317, "uuid": "53857d82-e7e4-4a60-b23f-364ffc841696", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139317, "uuid": "477a11e0-72c2-46e7-8fda-66c31ce17b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139317, "uuid": "e28ed4b5-cecc-47c7-bc5a-2a9bb3cbfb86", "value": "NEW INQUIRY 20210701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668d6354-da2d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625117409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117409, "uuid": "72a51ca9-3444-448f-93aa-08fadf345cbe", "comment": "Malware payload (AgentTesla)", "value": "8c67e4e16e3374afa838585502c92b28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117409, "uuid": "27446692-f517-460d-b3e3-bfb17c6fbfa0", "comment": "Malware payload (AgentTesla)", "value": "722352b1657ddae61244396933ce047e78b81be798def74276677e345c364a77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117409, "uuid": "cf717499-3bbe-459c-bf22-d9e45b094dd9", "comment": "Malware payload (AgentTesla)", "value": "dccacb9cd1647db853ce99f447a339473d289aca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117409, "uuid": "b7813ffe-0c5f-4915-bf84-7b9cc72f17ba", "comment": "Malware payload (AgentTesla)", "value": "b92d6dfe7e59b165ee4199e8d59ef035496f009d5e40278da12f8bc2477a46a395c150cc7a05ff8e52e2e8e95ebabcc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117409, "uuid": "47bc80d1-2b9a-47f6-945d-9c241bceb51a", "value": "28F401382ABFC819F87E4BB945E17080DB7B7A712732D60D245911490F13B51CEA2BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117409, "uuid": "2bcdf86c-72aa-4a0c-a296-e4a781685bee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117409, "uuid": "7cbad950-c110-40f5-b18f-51f9c265f6f4", "value": "12288:yYq4pLnSGIK4A5FxZ7cRE4SA2mrlSCf7LOjDsqVczKMIbO58QX7:Q4ZN/EKH5mrlEluKM08N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625117409, "uuid": "998642c6-f1ce-45cb-b376-441cf3060bfd", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625117409, "uuid": "4f7b7839-7bb2-415d-80a8-e6d6d8e8d38b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117409, "uuid": "04539a13-5e95-4e84-9dfe-f2b6774ce513", "value": "UPDATED S O A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20782b8e-da0e-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1625103977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625103977, "uuid": "e8ee463e-78fe-4785-8db6-a11f4ebd86b5", "comment": "Malware payload (NetSupport)", "value": "9292cd5fed975aad2bcb1cc73c4eefe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625103977, "uuid": "337b7253-b718-45c3-a9ac-308cd39cf571", "comment": "Malware payload (NetSupport)", "value": "725f81ee466371300ed43441bc35239089dd5283b8831193699b091fb2ad928c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625103977, "uuid": "2a4633b7-4591-4c7b-9884-29551caa86f6", "comment": "Malware payload (NetSupport)", "value": "8680641a985d92a5a91c5b55a03858577bc39be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625103977, "uuid": "fb08ba3a-a6f6-4788-a0de-1fd14157d6c3", "comment": "Malware payload (NetSupport)", "value": "a0afed531860ceb5d77862a9d2a54b0438d1a3d9d9d1c98ae4399c1f246e6ccf8368c29f72cdb13c6222ceaf718484cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625103977, "uuid": "2949a4c4-c755-4fb3-a5bb-38d42e76b615", "value": "66851203B293C072D49901B505658BB64F3A7C319775D0F7AFD13AAA9D703E29B3638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625103977, "uuid": "8628ae39-d0d3-41de-95e8-f20c8b762f7e", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625103977, "uuid": "d7059652-dc8d-43aa-84a1-800554c591b0", "value": "49152:WC2lJmXbj5DIwbQea1LPEyK7r385JD3d6cIWho:WzlkbFDVrQMyOr3S3d6cLho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625103977, "uuid": "ab2266bf-6c5f-4e93-b768-5ec84432c9d5", "value": 1829181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625103977, "uuid": "e799edc2-0b41-45e2-9cc6-50eecb0b1ff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625103977, "uuid": "f1e066b5-2f7c-4a13-b717-d5768f61c63e", "value": "9292CD5FED975AAD2BCB1CC73C4EEFE0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c60f8c-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150957, "uuid": "c7885a1a-c087-441e-88c7-95075a9dc736", "comment": "Malware payload", "value": "94f284d01c6c4b83974183008beb97ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150957, "uuid": "590b45d5-5ae2-40d8-b2fc-c52e561989dc", "comment": "Malware payload", "value": "72f6c6bfd10361e2b010e235bcd72110583b5deaec42f878a2e9c8f748f2e553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150957, "uuid": "5bfc9259-f41a-48d7-b3e1-6d69a288704c", "comment": "Malware payload", "value": "53abe8b1da7ca2c56c9356ba2fad5815998056d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150957, "uuid": "6952e5df-3c33-43f2-b6b2-11304d15e46d", "comment": "Malware payload", "value": "475e03b530013f07ba1c1834e7fccfa2e18d88b9ad4b31695295d10750c8b64ac851723a1af89ef42ff8387e760f5ed7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150957, "uuid": "f36d0724-85fd-49ab-bea4-f7ac2eb182b7", "value": "3603E1DFE8683CC8E65D4D3E969C14A9FC8CB182824EC658A7F54C9DD94FE067A0D40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150957, "uuid": "06b1e1ba-ea28-4929-9511-1614fcf820a0", "value": "768:8di2CrRvrGAH5rvSePYhWxmQ8q+ZiJhJEdt4nXilCi96YXzqulz1UWRhE:mi2QxGAH57TuM1FiUe6GzquzvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150957, "uuid": "05fc5b22-811f-44f8-b4b7-413b05f2828b", "value": 38028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150957, "uuid": "ec365413-0073-4fa6-aacf-639507640586", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150957, "uuid": "74cd9a5c-6bbd-47b4-b2bc-062bdf6d86e9", "value": "94f284d01c6c4b83974183008beb97ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d920e7-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625132492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132492, "uuid": "00a37a54-14f3-4043-bba9-496ea2b9987f", "comment": "Malware payload (AgentTesla)", "value": "63f8d8a94a6d3e402c0e3b62db34b6a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132492, "uuid": "16a6f7fc-e4d5-468e-98ac-0e93db0b7250", "comment": "Malware payload (AgentTesla)", "value": "7338e83f1b611c1a38d335302e31d8b36c39f934f11efdccbb8ad3c0616b5cae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132492, "uuid": "314fd334-6cc2-4f76-88c2-4e7bb309231e", "comment": "Malware payload (AgentTesla)", "value": "3890cc93684a43044dd0586ecb550a26c415b743", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132492, "uuid": "ceda4337-4ca2-455b-a9c7-b8f34ea49087", "comment": "Malware payload (AgentTesla)", "value": "2257dbfc3995f4d399c84dc21632b8a4104eb467d95b164fc1cdc00de1df01f918b16ddaee2c189498888965294c4651", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132492, "uuid": "9e5db8ee-4b61-4693-88ae-10df5cc890e4", "value": "78A1A53852AD2ED7EE4358B2E1B4BE9202F7F22B59CB0A90322DF5F0170F2505521645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132492, "uuid": "6856eb24-7ded-4630-9ea4-d83afd66cb66", "value": "96:CX6QDCb/LhT8tYEl/Pm8vLkiSIkvyeNvaXaxpRe3i8afP4y:w6d/LrQljjg1Saxje3iH4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132492, "uuid": "e05c5577-daff-42d2-8af2-3fbe227ebba0", "value": 4850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132492, "uuid": "9fc375c9-77ef-4817-a2f8-6c3730e09939", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132492, "uuid": "97862522-6aa1-47ea-97e8-4cc7b6b5e748", "value": "Specifications.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f68785-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625120841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120841, "uuid": "3ef76e89-b86d-4385-b6c1-948d91a7eb52", "comment": "Malware payload (Formbook)", "value": "7cc2c3ea3bce329eb9f31f36e24ffcf9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120841, "uuid": "db0a49be-d18c-4ad3-8b2f-cc05dbd8befc", "comment": "Malware payload (Formbook)", "value": "764fa32bea940317cac43cb18365056eeec420673281f3585d3068e5e249c82d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120841, "uuid": "b083e9a0-21d0-4dd3-90d6-035df76071ac", "comment": "Malware payload (Formbook)", "value": "ea35a4c13c0874e3801954b2d4a3fa1a2f233024", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120841, "uuid": "f6428f6a-f400-4a2c-818d-1957ae686757", "comment": "Malware payload (Formbook)", "value": "99dfd71c24bdd6b790237c4bdd63397d2bc0614b172d0d50c5a6a4a9af3a3a9b647a9c2c50d1ec8d4eafce5e65fe4d12", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120841, "uuid": "3c97f54c-f406-48bf-a33d-b4daf0eaee67", "value": "D3141275E7B99597C28CA19F610D80EBED8C7C9BD0D168F8D008C7BFE1664364E1458E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120841, "uuid": "67c4669c-9d08-4392-8a78-d5819de3ff67", "value": "3072:rT+mzY8O6A+zQHZvTZQxeiwFkSxq5756PPYgo5UCVrjhrq5EjLvOFT:/+jCASQHZvtQrOkN5sHSaCVrjhrqKjjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120841, "uuid": "3055bba3-d53d-4489-81b1-e9f892d85357", "value": 196535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120841, "uuid": "7810b1fe-d3c8-4264-aa7f-38a89c6011c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120841, "uuid": "5f83fa8e-3368-4ead-86fb-9916308dd1ef", "value": "7723421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153b81c2-da06-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkComet)", "timestamp": 1625100522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625100522, "uuid": "c35eafe7-7963-4aa4-9460-97ff0cf4e215", "comment": "Malware payload (DarkComet)", "value": "88da3cb41ad9eaa9824b64be954e4ca5", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625100522, "uuid": "c8704fe2-e370-4da4-9894-31a452fcdbab", "comment": "Malware payload (DarkComet)", "value": "77dddb8e258184f22bbbf1d17a3e9f121528da1cd431ca26c44a870218ee0184", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625100522, "uuid": "81e24d88-003f-474b-8d66-dd2621fb89dc", "comment": "Malware payload (DarkComet)", "value": "fcef830a7f6861bef97be986d0e4b3a02a1ef27c", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625100522, "uuid": "780a592b-e0ee-46f5-9a03-7079a5db5496", "comment": "Malware payload (DarkComet)", "value": "d0a91a5840ec5fe9a2417100ac834fcd10a70b6a8f41da02cbd3738dc964fa876b7b33bcb7ff93cea1954df256341864", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625100522, "uuid": "3b673df4-7d2d-44a4-b17b-2c730a6f93bf", "value": "92950123E5A0E14ED846807058BAE3797A18BD7910459E53F3C09F0E36B25E3B9F5B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625100522, "uuid": "69a0d5c9-e79b-4184-948c-4bc58e81bd3a", "value": "41999ec9d2bb54af1616c904a0650895", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625100522, "uuid": "ea5b5e1b-572e-410e-b7a8-c1b53e97e339", "value": "49152:q66X+aEubmOe/Wx/cxteQqibGyeM0jZF4:qfX+5une/K/OttqiROQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625100522, "uuid": "3e9c7817-e4b8-484e-8f47-4e3c6ef96fd1", "value": 2037763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625100522, "uuid": "8c26a674-1010-4066-a344-90ef1df64523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625100522, "uuid": "21244368-cb3d-4319-a23e-f32b764f19f1", "value": "SecuriteInfo.com.__vbaHresultCheckObj.29967.23164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311af1d5-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169288, "uuid": "2fe21a09-0d5f-4973-b65a-a96dbd003bd9", "comment": "Malware payload", "value": "5ea42089cf91464b9c0c42292c18ba4c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169288, "uuid": "81f36115-047c-4d15-b120-5ec449870242", "comment": "Malware payload", "value": "784cf7d224974f7e2c43cf10580c42a2521556608a5dd4a11247d09a77f5c8df", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169288, "uuid": "bb358cbd-3351-4a43-97af-82998740b42e", "comment": "Malware payload", "value": "88927e4d9a6a1ce5e656c599c0b0f462af97ba57", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169288, "uuid": "8d75db48-75f0-4893-a593-a632b953ecbf", "comment": "Malware payload", "value": "522cf21c774afe01be46eca13558120809634439a9210d22b6f2fbd878e7d2bfdc2f7091443cf23998247fd4113664ae", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169288, "uuid": "aaebb7b5-2ad8-4d75-9e5f-7699448e98fe", "value": "4A837C13F1D4E073E0235131A9A6B77348AFB63399390247F789467E6EE50E09E29793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169288, "uuid": "9a15d700-0515-487b-8563-221f33df9e3d", "value": "4d4d03b1080112a8681ab2abc89c0a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169288, "uuid": "77845bb5-3e25-4d80-b67f-cda134592cd7", "value": "1536:eEUg65D/PzIWNg1bW4z1dmS8kU1pQpEuYVD:eEW53RNg1jcSMpQpvYVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169288, "uuid": "0288ce5e-4b75-45e6-84d0-5f413b0c3a33", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169288, "uuid": "7ff5c79e-3f05-4fc0-a07b-8dadf09b857e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169288, "uuid": "11878ee6-5da2-4200-9d21-32b338c52bee", "value": "784cf7d224974f7e2c43cf10580c42a2521556608a5dd4a11247d09a77f5c8df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c1d5f0-da4f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625131868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131868, "uuid": "a84e17cc-ad31-4042-9173-f9336bf807ba", "comment": "Malware payload (AgentTesla)", "value": "126f3325cc10d8f1789d078d20f86277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131868, "uuid": "5fc62808-2c43-49fc-8c7e-940440155ede", "comment": "Malware payload (AgentTesla)", "value": "788c6cb2d98c6b7a40318a4293bdf24001940fe44a750f37fc30733739efffc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131868, "uuid": "e0475128-9fdd-4179-9b78-f90e897345b1", "comment": "Malware payload (AgentTesla)", "value": "a8c39fc1bce82ad5c5445e1d15cada289592a01d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131868, "uuid": "7b597a63-f31c-4cf0-916a-9fc5cc3dd5be", "comment": "Malware payload (AgentTesla)", "value": "d35f177b1759992fec311ac082b23822c263d37d62a8b6dc42476e1da4f1a1571b2a7918b96c41aeb8844c7fa0df9f2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131868, "uuid": "ebdc1ea9-a9fa-477d-b9fc-faca16ec46a9", "value": "1FD412287FFC475AC273AF3D59E12102C73EA63A791AC41D25D60A8F0697BC0CE92671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131868, "uuid": "b23155cb-2450-4cb5-a71b-a29a0e7efef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131868, "uuid": "fc2e06c4-56c1-4bd5-ac0e-d755ffdee3d1", "value": "12288:E206uI07rop+mQl4p8CP0hCfOjwMUnI2/ZsPmVMjXPKrzci/n9Q8K:g6afoUFM0hCfO2nnhsPL+n9Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625131868, "uuid": "db96336a-7d75-4473-83c6-05030119f344", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625131868, "uuid": "fd33da8d-be96-43eb-9093-c9738cea0f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131868, "uuid": "0bedaa07-d2a3-46ce-abb3-40f4ef7cbd1c", "value": "126f3325cc10d8f1789d078d20f86277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06e25b6-daa5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169180, "uuid": "ee2c7edb-bd59-4548-b741-fc0fc4520343", "comment": "Malware payload", "value": "5a91ccabd2b12ac56ba5170cf9ff8343", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169180, "uuid": "1193d9c0-733b-4344-bd86-98b0b28dd9d5", "comment": "Malware payload", "value": "78e7c41458e1ddf336f0d2e9625abbdc0b3e86db18aee7377af5711bc927da35", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169180, "uuid": "75d96135-8f4c-44a2-83d4-96572ed660c5", "comment": "Malware payload", "value": "24ffb24a73e68e6f5c23ab090f9ce5ac5dd41a8e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169180, "uuid": "28294548-e380-4eaf-9df8-0dfd81c4b8e2", "comment": "Malware payload", "value": "b56d47db5b9a6123b2765344611dde57120af9ae40d475db5262bde976463d5c3a37d7c0df9fa78cd3e0e4ab949e167e", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169180, "uuid": "4f8ff521-f1ca-47e0-8566-0f2ddf402500", "value": "4A935B20F1E4D4B2D02711B17AA9ABA7457EFC30677001DBF7584B792EA11F18A3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169180, "uuid": "c1097d6c-d2a6-41a9-937c-60dacfc31c39", "value": "bcab4085380a1e9f81941ffd62f1af43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169180, "uuid": "40a9e5c7-ae26-4bf7-a349-69e8a6400d75", "value": "1536:mmCm+jTqRp45XcSyKVszCDgbAafUKPpIrjvRr2SmbvK/kouz/OLQVug+TD:alj20szCD6sjlKJvhzWcVug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169180, "uuid": "ebdc575e-795b-4734-a7a9-7b4404795ea8", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169180, "uuid": "7554b480-2852-4a4a-9d6a-34338d28a7eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169180, "uuid": "fd999317-942d-4679-8860-df850776b8c4", "value": "78e7c41458e1ddf336f0d2e9625abbdc0b3e86db18aee7377af5711bc927da35.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113f44f2-da56-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625134875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134875, "uuid": "ad24c8f7-8af4-4443-afd4-4b04b2c07950", "comment": "Malware payload (SnakeKeylogger)", "value": "e59690d0dfe13f1bb6cd6b5a51832070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134875, "uuid": "15ace2b8-0807-4080-bba6-4d3965299c57", "comment": "Malware payload (SnakeKeylogger)", "value": "790f0af1ab6f93fa126688c3fde6655be666994b4dc5db719d31ac8a2648019e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134875, "uuid": "b98912d8-dfbf-406b-beac-a1a00513f2a3", "comment": "Malware payload (SnakeKeylogger)", "value": "f63d492f2db386aebe9f79bfb2c726c02b79868e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134875, "uuid": "386854d4-c0d3-4e5d-9bc4-6679a084c993", "comment": "Malware payload (SnakeKeylogger)", "value": "d0ca3002f990864c38e095c01b5475a62b916dfd11d31905e9b8fdb8183c10df1af1914fc1d5f9f4f684bb55a43f8c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134875, "uuid": "b3f7ed91-09e4-43a8-842f-a5418fa361f1", "value": "95057C3D597E123B81FDC3999BC98D1FF884952730217E7898DB43A5470AA8379D223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134875, "uuid": "eb38b2ad-b55a-4391-8acb-13b700b244df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134875, "uuid": "db9d4162-905b-45e9-bfe8-4f11da950aff", "value": "3072:glSqfUfxfsdpgre42u1vFxpuuHd7ez3mpou0vy7wITfBsbzQg7IzIcuLmhtcOoWQ:XqAxqpl4dvOusfuWZINswgcst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134875, "uuid": "3079004f-a508-4ce7-8bd4-e9b10f1ce864", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134875, "uuid": "a5063838-ece3-4790-bbe9-a33ac2e03c10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134875, "uuid": "7f2974b8-4933-4f0d-80fa-b858c6a4733d", "value": "e59690d0dfe13f1bb6cd6b5a51832070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559c6abb-daa8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625170209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170209, "uuid": "8d245c4c-5fc8-4500-bac2-d3049eeea76c", "comment": "Malware payload", "value": "6278d50da6d398cec9f1d53f66df6523", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170209, "uuid": "c1000231-1091-4b5d-b90b-cfdbde52f80d", "comment": "Malware payload", "value": "79884015c62283faf473df2a8f7d704e9fc96f5efbfea82dce7c8be87ef02455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170209, "uuid": "bf0bb448-c8d1-459c-900d-5ec046136793", "comment": "Malware payload", "value": "a55c685b8d947dcc2c7aa3fbe2e57750bc80d416", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170209, "uuid": "bddb9440-f714-417e-b820-2363d6e1abd9", "comment": "Malware payload", "value": "f0ad28d508514ec76de4a3c9a95752f0bd4aded7f0f3bd22a5f8e84d8a416bf2a3b6da2fd91c6b60c1cda8748ebebd44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170209, "uuid": "8f5c07e5-490c-47f1-94f8-4f03a2b615d7", "value": "E0D47C242AF84A29F0BA9F7E95B4550547FDF713AF13C95C3CB512CA0713A42CAB172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170209, "uuid": "d45aedb0-a6ef-4c0b-9e64-0bf50760f0fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170209, "uuid": "9d568ee8-291c-4039-afb5-af58f7dc6a32", "value": "12288:/G+AIfBbX5TyXOXd83lxyfUhpd1zYTK+Y6DuUh2P:iIf5d837hhETjfno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170209, "uuid": "ca39e036-2724-4873-8d32-149cf34d2f5a", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170209, "uuid": "f5285e33-128d-47e2-b30f-53edb718b1a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170209, "uuid": "187c6ce7-829a-46b5-a79a-edf09ea5e41e", "value": "6278d50da6d398cec9f1d53f66df6523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e7be23-daa5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169048, "uuid": "ea60bcb3-f9ff-4469-b141-0579ce5cd53b", "comment": "Malware payload", "value": "ef3383809fdf5a895b42e02bf06f5aa3", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169048, "uuid": "4e9ef9de-92c7-41e9-8b73-6b96e152bfb1", "comment": "Malware payload", "value": "7bd75383dfab3948ce06a7f533870946934c87fb1c7b8035b69b4f2a166bd5b0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169048, "uuid": "193a3d4e-762e-4020-9999-161e0099a858", "comment": "Malware payload", "value": "42bab3bc85c72864592a8ca3ae2351399e0efde1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169048, "uuid": "002df516-c09f-4592-9548-19e4cd7aabf0", "comment": "Malware payload", "value": "a05d9f893e3823b93d025bd87af0cc71618e78606e5d03fe6d394717db89bfd7ee447f44e829aee005e7a927b35c979b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169048, "uuid": "be37fc63-924e-4ab7-96bd-6fdd458e0577", "value": "D0436D173599C032D4621A70AD2597638A7F7873B6B4804ABB8D12BE5FF06E09F34367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169048, "uuid": "8dd39060-88db-47b3-839c-934d0e405e5c", "value": "e42b4e3a14363948ae56748906541ec0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169048, "uuid": "ad405673-c9d5-4f99-80b2-d6a0fc36bdc1", "value": "768:Bw/Eyz5vFhC9Lh6g5dWHkP9n0Ieh59FJR0hoBuuEkkqM9tuTEDNnjMBp8DCS:qs45th4kHCuIDoBuxkbqjonNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169048, "uuid": "aed83e44-bd0b-4f4c-a7db-2869f460c2dc", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169048, "uuid": "3cd61891-82d8-4b62-a7dd-ff8a0c89395d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169048, "uuid": "2fdd4230-5cbb-430c-abc5-672f38be55ac", "value": "7bd75383dfab3948ce06a7f533870946934c87fb1c7b8035b69b4f2a166bd5b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67412043-da4c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625130724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130724, "uuid": "3647f5f7-a541-409e-a4c9-d0c843420c93", "comment": "Malware payload (GuLoader)", "value": "dd7fb85e7e42d74bd74974b190bdf9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130724, "uuid": "48537961-5688-464c-a97e-77d1de2c1ea3", "comment": "Malware payload (GuLoader)", "value": "7c47eedf8c18095e0fb65270b835f8c5a6751363156545ab5ff2130e9b357319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130724, "uuid": "2159d801-3185-41fc-a376-5221d51bbbc3", "comment": "Malware payload (GuLoader)", "value": "2bc84d7f515427209807da720ee8011bb202ef72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625130724, "uuid": "c9eadb75-6bd3-4b8a-b4af-a5c682e16490", "comment": "Malware payload (GuLoader)", "value": "8029ce950582deaa8c242e36fcafab4a5f505d0f57e7eed5f206733aab5ba1ccd6ceb29f3b6c4d399f54b30ee72febc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130724, "uuid": "aa02c14e-0fb6-471e-8a63-94a4a926979f", "value": "1A04F89DEB8E9B22E0BFC6F365958D3027A0247428535227F7C5EE1F13B71F09628259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130724, "uuid": "3092d8d9-2ca9-4db6-8daf-0c5a5c7b3aa9", "value": "112f2cd5fb1ecc9213e5e97dd6318dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130724, "uuid": "09257628-26e1-4cf0-bc94-6e0111feac5f", "value": "1536:La3r558/f4B5wXHnnb/fppIcg5hy3J9rz1JVmj0vhZ5eR4GlP/ivbcOgqYui6e8Y:yBcnrfkXa9sj0RiXivZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625130724, "uuid": "d3f47549-7675-4e1e-96c9-c5672895b508", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625130724, "uuid": "2db92a87-cd2d-4adf-90ba-084c250a8ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625130724, "uuid": "5ffbe431-df55-4349-b1e0-e80f6ec24db1", "value": "Oferta Urgenta Pentru Firma RULMENTI SA Barlad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a69dab9-da46-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625127992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625127992, "uuid": "b77bd5f2-b673-4090-bf56-2823e7588ab3", "comment": "Malware payload (Loki)", "value": "f1e712d502a4f228cdcfc6f5f994240d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625127992, "uuid": "3a16aaa6-ee2b-4deb-95b4-83ea1cad4fa6", "comment": "Malware payload (Loki)", "value": "7ec6c06ce36ba89c2b9123531436f361380a435f6c1a6374820525aad6ea4d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625127992, "uuid": "1e07c73d-2a3b-492f-90b3-138497a0fe9e", "comment": "Malware payload (Loki)", "value": "279e05f2c52f25cc2102fd5f7420e3a7e425d31d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625127992, "uuid": "d88f4533-7fa3-49c1-ab4f-598491789978", "comment": "Malware payload (Loki)", "value": "e99ecba0635d4484beddac66d5d83198f37d07b5b701728163df7d5c0db6a819940337c7657e0491fc18a04ce98b2553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625127992, "uuid": "e200e540-249a-4030-8e57-93b7c7b2e0ca", "value": "4FE46C202AE846A9F0BA9F7D99B4311557FDFA13AB13CD5C3CB511C90723A41CAB172E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625127992, "uuid": "ebbc42b1-5abe-4b54-9abb-f44dd628324b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625127992, "uuid": "cd65ee9f-b951-43d4-b877-8f714eafdc55", "value": "12288:tTWKFBbX5TyJE649FYbsswnQ89Tspp0aleI9kDJQz9:BWKFPPhIpp0ale8kFQz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625127992, "uuid": "3654c2ec-f314-4d1a-8c36-5ee1761cbccb", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625127992, "uuid": "0c598553-b314-4855-a763-f61e681984d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625127992, "uuid": "d2d53487-f41d-426f-94a3-d6ddb0ea07de", "value": "payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d096bdf6-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625133478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133478, "uuid": "40bcc00e-b977-4a8b-a193-4f85ddb27714", "comment": "Malware payload (AgentTesla)", "value": "73cf62a8c064a3b926ef00c6cbe5c826", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133478, "uuid": "a7773013-00ba-4066-b911-70adea4055fa", "comment": "Malware payload (AgentTesla)", "value": "7f5317db38274cf24a600614903b20d7ba53342ec68b83c8740adc4104b06112", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133478, "uuid": "d7956dab-c868-4c6a-ac03-ad2daed34d72", "comment": "Malware payload (AgentTesla)", "value": "e61669be509a67e464edf8a7d6ab49025bfb5467", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133478, "uuid": "878e6b6f-1c4b-42a0-8337-9e681ffbd42a", "comment": "Malware payload (AgentTesla)", "value": "331312d9583319f7b5cd24e3ea6bc9496ebe58619f28d23ab2465e92129f1b1b4f08eea03865a5317fc8efcd1f98a7a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133478, "uuid": "a5c4ecd7-b977-44b2-ad20-dd0867c813aa", "value": "4ED412247BFC0165E7339E3625F16056E67D763B7A2AE11D35C212CE49C3B80CEC26A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133478, "uuid": "7ce7d6e2-063c-4750-99a4-cf126bb1967c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133478, "uuid": "70d690e7-12eb-479f-b1da-f26275e155fc", "value": "12288:VFXKsXMXL2+7qquxDHhASHMBCvxH9QSXI4/kkMUu:rTgVqq+D5HMBCpH9Q2I4sXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133478, "uuid": "b9717dbe-5d9f-47c5-93ef-80a3d1ba8533", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133478, "uuid": "07e5ef73-9e93-40bd-a0c2-cb90704ee5d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133478, "uuid": "202a1309-43b4-4889-8e9a-4cdd9111d473", "value": "73cf62a8c064a3b926ef00c6cbe5c826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f05f7a-da75-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625148300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148300, "uuid": "b6e7360c-852e-498a-a0bb-a0db1fa83f2c", "comment": "Malware payload", "value": "ad3b8f414dcd5afe8d83b5bddf6521c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148300, "uuid": "4f62612d-aa0b-4287-a60d-03ef1b6c9008", "comment": "Malware payload", "value": "801f97186cb468177bed9920869c3a6a4e4d2d23d1122ed90bdeba4bb73fa323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148300, "uuid": "1de360fb-33c9-4a0b-9686-887e83443a24", "comment": "Malware payload", "value": "a9babbe85679099335ee03ca09923c2a7795b71d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148300, "uuid": "05f9912b-6001-4d0a-a9d3-2cdfd2a5a56d", "comment": "Malware payload", "value": "13f39af79dcd40f84e178f7bf0150bf63050a2249679a7898136897eb2189af3994b38f72146f736baf987c80f556f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148300, "uuid": "57ee18ca-8667-4234-9dce-5d347f350a4d", "value": "5EE2E11250A207C8E9EA7078485FBE1A0E39771E445549F7DED4736B88A2E707639733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148300, "uuid": "016831aa-94c7-4108-a674-9f45ff93e7d0", "value": "768:tyIuM3LXhwY2Xylm9lohk1pzgbo/YK3Zvux5RNlFmSnnbcuyD7Uryqx:wm3LRZSyOCC8UQKJc5RN3nouy8mqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625148300, "uuid": "cc2fb015-628f-4e14-b0e3-d3c45433701d", "value": 34108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625148300, "uuid": "82717f98-f4da-4573-9ca1-dccac98dc10d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148300, "uuid": "5259814e-e305-40f0-b756-0ea39767036a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a732b941-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139422, "uuid": "b8f12a13-09fe-4112-b38a-97ddee927584", "comment": "Malware payload (AgentTesla)", "value": "273bfd2df2829bf0d9b39f3de118545e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139422, "uuid": "d82d5381-154d-4827-ab4a-146fed03645d", "comment": "Malware payload (AgentTesla)", "value": "8021387cea98e2352141f29c718c10d9db4b8c00a8fdda42473195df136061eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139422, "uuid": "bbabaf75-c872-462c-958c-d96bffee77ad", "comment": "Malware payload (AgentTesla)", "value": "561de45e30859fe0c21a9a318df2c60dc26d87b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139422, "uuid": "3f30228f-4a1e-4b3a-873b-9413e173ce7f", "comment": "Malware payload (AgentTesla)", "value": "d4464dfb1e095396f3528bcabb0d44567ef258612d86879c4e5c496b0621fd1362f2a6193e2ad24aa472d551e5b6359c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139422, "uuid": "0faac128-38f7-4bb5-90c1-a0507e9bb5ef", "value": "4435DF0BF6449A55C8942638DCEFC2B41375EDD77C128B0B2A997AED3CB2616CD413E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139422, "uuid": "f48b77c2-fd2c-4d59-a042-4ab874d39a4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139422, "uuid": "f355bb52-315f-4fb3-bf6d-419d19a22809", "value": "24576:pWTe+PTghzhw0iIW0xFNorgXGjYL/Qh5:STbghzhw32KMWjph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139422, "uuid": "d5a4decc-50d7-480f-b3f4-60c8fdc716f5", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139422, "uuid": "71e268df-ad88-4eeb-99ad-a09209e4dc4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139422, "uuid": "c0722069-a8f5-4f11-8b22-c536584602c5", "value": "Scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5f359b-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625120725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120725, "uuid": "53192a83-c11a-49fd-a353-06bff2a49131", "comment": "Malware payload (Formbook)", "value": "95a7098ca555bbc3f3baddd05ba23c02", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120725, "uuid": "40ee11fb-cb84-4a86-a00a-d759cb407ad5", "comment": "Malware payload (Formbook)", "value": "80326c5be85d28affdb409613eafd17b0a85e36ada365faab617295794f34d33", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120725, "uuid": "2bf2db9c-af72-461a-952a-6df2479b938e", "comment": "Malware payload (Formbook)", "value": "58888ac46f52cf4738c8cc640ee14859372ce584", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120725, "uuid": "562da9c1-d2dd-4f2d-985c-2c65ad0e5144", "comment": "Malware payload (Formbook)", "value": "efd5c35f530aaacae78c9533257b0c04be3d73c1d6d1edac5284c0c006d98b51dc1312dfec61bd20c5f9cf6f9ed072d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120725, "uuid": "30202780-af6b-4968-94a2-8a71e110cad3", "value": "E6F1E33F86A37DC763E671F71409F7720198862FA6178AFB78C916B67224119CC23874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120725, "uuid": "9602a8a0-fcae-45f4-b65c-c2e689456a30", "value": "24:mABVleonx3BMHysgOLvuMiH7t6t1QsAx84l:mC0+x6HzLvuMiHMQTxZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120725, "uuid": "3f847afc-9466-4402-8513-9631b4727efb", "value": 7816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120725, "uuid": "e22fc1c1-13e9-49c7-9885-60b68b72442a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120725, "uuid": "c41f9fed-e8ec-4dad-bcd5-fca0282a37b2", "value": "PO2855074.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7fa31a-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625118790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118790, "uuid": "323e15ce-2329-4b62-9a93-e0f1d8eb455c", "comment": "Malware payload (AgentTesla)", "value": "4cd61a9bb641864934b651e803748177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118790, "uuid": "91a7480f-40a0-4908-980a-c053eb441285", "comment": "Malware payload (AgentTesla)", "value": "807acd7e5546ab647bcff1c1efd2a7bc5e9cd122d576873501e87ba945038f63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118790, "uuid": "3322681f-eb87-4419-807c-1d7094e9193a", "comment": "Malware payload (AgentTesla)", "value": "63638c72d9e5431fe781200ab8e5456f84de0c32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118790, "uuid": "9f0fd427-8100-4697-b697-9c3d3bd85ae6", "comment": "Malware payload (AgentTesla)", "value": "0eba75ff964c07c6836de6cfe313287eded3a470670d19f87fdfe4ab7337cfb4ea6468145fe349c1afa5eb43b6c5680f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118790, "uuid": "a94108db-f8cc-44fe-a852-da0a8b2f9989", "value": "CD35D01BF704AA41C4A82234DCEFC27413B5EDD76C228B0B2E997ADE3C72715DD456A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118790, "uuid": "d1b258ec-b6ef-4e08-a887-7b7e300d6cf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118790, "uuid": "83c00bcc-05b2-4035-9fc2-f2f2c738d158", "value": "12288:Rd9wSAsJ9yYhzhbh9JmXzbJ5fx7Q0a+m3x5LdQpvAM75/ha:twFYhzhsjPOD53xFdK4g/ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118790, "uuid": "af58cc34-026c-4742-a148-386edfb2c8e7", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118790, "uuid": "56b74e4b-410c-491f-bb09-cfe608f64158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118790, "uuid": "33d591ec-f176-4567-bde8-f6f3440ffd15", "value": "PO4592345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792bdf4a-da71-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625146646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146646, "uuid": "c9e3a7b8-35a6-497d-84f2-09edea59fb45", "comment": "Malware payload (AgentTesla)", "value": "395db038763e2172675694d317b2d7a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146646, "uuid": "43a61b44-cca8-4dd4-a87a-b66ef6730498", "comment": "Malware payload (AgentTesla)", "value": "81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146646, "uuid": "68f6cd81-bb56-4a8f-bc91-4958193a67b8", "comment": "Malware payload (AgentTesla)", "value": "04e3fb7fab96b7711baa671a7dbb913b66d2be71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146646, "uuid": "f33a49e1-6e6a-4e52-b930-7975aae757d1", "comment": "Malware payload (AgentTesla)", "value": "4c5330b91496f9223fe0f6e29f60b4485b0e96af7788ec120f381ed8e4727e10d8483335072fb19abb1281b1b02bd92b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146646, "uuid": "aa8d3b36-5da4-4ec4-9b55-a61fccda5fb1", "value": "3AF48D241DA94025F9F94FBD8AE060B257AEBE232F139C5D24F23EC13733681D9A156D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146646, "uuid": "707eaaa2-4be4-4a59-952f-0489eba0e6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146646, "uuid": "93f5ca22-87ce-4ad1-b662-93f27af3c74a", "value": "12288:EQmE0SBbX5TyLCFC2IXw8gl7tG+6ZdwajbxZfYha52:9HqCFLLl7t56ZSajbLfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146646, "uuid": "bc768ca9-d2df-4fad-ab04-1a0bd61e9f28", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146646, "uuid": "ff0290b3-d5ed-4f7e-aadd-fe4753249b73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146646, "uuid": "c478064c-0793-4899-8d7f-848873189ec6", "value": "RFQ No49958 Led Farm Pty. Ltd New Order.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827f6df4-da08-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625101564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625101564, "uuid": "55eb59d1-8744-49a3-8435-066e9dba896e", "comment": "Malware payload (RedLineStealer)", "value": "942724e5cbe8f58f2d96abb183a065ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625101564, "uuid": "24f59e2a-fed7-4684-89bd-9eff3d2e1dc3", "comment": "Malware payload (RedLineStealer)", "value": "83be09271b4ef2cba877418b5c73fb0a2c13e64b067f25704c0f3f444037f2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625101564, "uuid": "7c58be9d-b578-4b35-9b02-ef567dee1d83", "comment": "Malware payload (RedLineStealer)", "value": "c58bbe091e48fa33267fcffbcb5bd88f07e4aa66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625101564, "uuid": "1bd06899-ebb9-4fb4-867c-15ec2989669a", "comment": "Malware payload (RedLineStealer)", "value": "109299e9aa81c9f67741486128e0220b064c5c480f0c3531782f19b0837f8a437f368600acd301b52f5e0883e9b5af1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625101564, "uuid": "1e5210f7-2c17-43dd-b07c-e1667127dc66", "value": "183623332F6ACDCAC371B97D0588F37549D9478D3C6BA29202B24226F606D8F5D9E8D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625101564, "uuid": "b8e91534-051a-488a-a7b0-fb5349b7737f", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625101564, "uuid": "1f8a9aa8-ac05-45a9-aa2f-86a3265f043f", "value": "98304:XlJEuzYp3PqGpK5Z99cjRHMB3ii63OUV3Ge5/Gt9K7g9UJUMqp47:XTZYpf+m1sByA1eiEsuQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625101564, "uuid": "c5abe0fb-4fed-4afc-a536-7d988b4abf08", "value": 4870527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625101564, "uuid": "a4896a30-0545-4311-86db-82c04c98e6ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625101564, "uuid": "5631a70d-d891-43af-b26e-09cc50d33e7a", "value": "942724E5CBE8F58F2D96ABB183A065AC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbb8829-da7a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150680, "uuid": "f2e0e6bf-8622-4b36-a74e-4bba1a136653", "comment": "Malware payload", "value": "62d11af3555113e47cd3cfa0a0f85264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150680, "uuid": "68fbefb2-451c-4271-ad24-d5ee82eff20d", "comment": "Malware payload", "value": "849be7c6aebeb532bacdc646117767d9e84f2dc6536229a57be0ab7a8dbe2980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150680, "uuid": "062df5a8-6291-4985-a0cf-79b010c3b325", "comment": "Malware payload", "value": "7cdff10587e80a4a96080f818ee5f8462c73bc59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150680, "uuid": "9afbd21d-18dc-4946-bf3a-7f5b0c6b20b3", "comment": "Malware payload", "value": "ae640d19477210789d26166e2653d5bd07fb64c0a53195fb4a67f72cbebe9a6301eca0fe13f79653697b21aa8877ce7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150680, "uuid": "c054db5f-dc99-4267-833f-d0d05ba89c97", "value": "0BE2F1A3E2C54380C7FD2479846FFC1A0D58B30DA5AE4AB7A784377386A1F4920ACB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150680, "uuid": "5f052ad0-d11a-4b74-b6fa-5c175c652308", "value": "768:XyIuM3Lc1tCjtmSPI6QfSxDBY1T0B1Ki9VVDktT60l/nbcuyD7Uryq+:Cm3Lc/Cjfya9BYV81Ki9HAVZVnouy8ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150680, "uuid": "de126e35-cef7-42a9-a6a1-263de22b63c0", "value": 34116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150680, "uuid": "10129619-ac28-4d03-bdf1-293e7fdd2264", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150680, "uuid": "f2d917a8-de0f-4dc5-b8ee-0b102284bf0f", "value": "62d11af3555113e47cd3cfa0a0f85264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fae81e4-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625134550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134550, "uuid": "dae0cda7-8f95-4ef0-85fe-341461a2f09f", "comment": "Malware payload (Loki)", "value": "5a3f7e7152ec98bda5f21310020741be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134550, "uuid": "1af7ddb5-af7a-473d-bff3-6efae7982ac3", "comment": "Malware payload (Loki)", "value": "86a5342cc28aed900160628e88d6a886234b6b586975f8b9119bd4ccef9141fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134550, "uuid": "51f90cf5-e237-48b7-bb93-84a82f13abc9", "comment": "Malware payload (Loki)", "value": "d0c6ea90993a3276d80213c8237532ac1b332456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134550, "uuid": "3ba21033-e760-46b6-b0dd-c280a6de7dac", "comment": "Malware payload (Loki)", "value": "49552078083e344bd224ac74c6bc963b4e6d99bc5b76cd59d25fcfe05f56f9887aba87a544640037e5052183cca99f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134550, "uuid": "e13b3bbe-9f18-4233-b695-4da9e132a40c", "value": "8035C00BF604AA45C4992638DCEFC2B41375ED967C22CB0B3E98BADE3C72355CD516A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134550, "uuid": "a9237ee2-70a4-4b18-80ce-6476da2c4ed9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134550, "uuid": "22ee4d41-04ff-4b6e-832e-dcc17c04ec91", "value": "24576:43tTcj0k6JAhzhagNVgFWR4Q+EThOPlqAh5:43tTcj2JAhzhaggs4QzT0vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134550, "uuid": "2528affe-7e8b-4792-8635-f8c7348d8b41", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134550, "uuid": "2cd9d58e-788a-4cc5-a348-875b129ffa28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134550, "uuid": "95384bca-4447-4ace-acd4-d7e51cb2b0cd", "value": "5a3f7e7152ec98bda5f21310020741be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743ec1b5-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625133323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133323, "uuid": "1a239394-4efc-4758-a074-d54efad0d8ee", "comment": "Malware payload (NanoCore)", "value": "2899aa0c7794357d224a5dcb5e186d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133323, "uuid": "ebc62baa-b50c-4c0a-941b-62b644098107", "comment": "Malware payload (NanoCore)", "value": "884639b2dc1f06412d6a7ce5e3aaefdfe3bdb3e346ac7a04bca596e07754ff78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133323, "uuid": "60559325-730a-4fed-a026-58cc2ec0566f", "comment": "Malware payload (NanoCore)", "value": "56fa2cd54d95eede2e33f5ea21ac73f56f2ad98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133323, "uuid": "07937f67-09d8-4edd-853b-b79514f12032", "comment": "Malware payload (NanoCore)", "value": "c424a45b90c5f5b2fa22a5608f28e6774221ff6c793473b3a430391b2da2490c9fe3413b68ea6197e36c98acb070b3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133323, "uuid": "05d0f9af-0dad-4d83-b1ff-acaa926f4d64", "value": "C9E412787DEE52BAC7755F7A16E0700197BEB221A90BD09A34D303864987FD2CED066C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133323, "uuid": "814a974b-b0c2-48a9-9fcc-fb7099ef9fe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133323, "uuid": "68f6eeb7-4b29-4736-adb1-13ac95a3c8ae", "value": "12288:cpPXf0sL5USUQZbavYVUvPopVcfgtS8XKI2qCpEHaTXNY0IN2AyzcTxPHbfK:WXfV/pZ1iQ3t56I2BE67+NNOkbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133323, "uuid": "685a9d8d-7022-41ea-9583-f54fcf052deb", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133323, "uuid": "5a4200d5-1f30-4d15-86b3-97e0f25b9398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133323, "uuid": "ade5bcfb-274b-4737-a630-f0b3c6cd6297", "value": "2899aa0c7794357d224a5dcb5e186d9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03204649-da71-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625146448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146448, "uuid": "279de9b3-245c-4739-ba08-f1c88ec2594a", "comment": "Malware payload (Loki)", "value": "d7c5f26f48cff5e53e1f428a72e4d89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146448, "uuid": "13e97ca0-096f-4ea3-8519-f6c8115058e5", "comment": "Malware payload (Loki)", "value": "88ab1c44d2799f7d670ba6996bbcbe3d2fe19300957811802e2452e31c415a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146448, "uuid": "0633d9ac-053a-4286-9ee4-a5d45e5f0581", "comment": "Malware payload (Loki)", "value": "ec6456ec836ee257cdbffcea5d9b0bb67c9ddfec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146448, "uuid": "8600b9e3-60e2-4460-b0f5-b4c51cc7491b", "comment": "Malware payload (Loki)", "value": "7a6553f9aef7c08b63912862c6702ecf40c7b782975d6856f6ac1fa27f398f7bef6f5092c664a7297328bbaa47757a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146448, "uuid": "09e91812-459a-43b7-bcb2-040c9f39ff19", "value": "02E47D1C2DA94035E4FA5FBD86A06182576DAE2F2F13D91C24B2FED53733641C9EC12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146448, "uuid": "3697f061-625e-46c5-826a-c6457552ab82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146448, "uuid": "4a67cabe-d9bd-40ad-a440-3ba78e64a3cf", "value": "12288:mJTuBbX5Tyo2m5CUqHV5eb4zzqP2R+1Y+HSWwcHY7:2KR2m5jyOsEK0Sk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146448, "uuid": "06e371ac-03cd-4911-a945-b6827316350e", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146448, "uuid": "01616573-4d4b-46be-8fc0-6cc28cfa4d56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146448, "uuid": "f9f0671a-b798-43bf-89f4-63b90d4983eb", "value": "CDPCM0VO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca371676-da69-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625143346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143346, "uuid": "b984c8b4-435c-4d0b-aff7-13a1a063150f", "comment": "Malware payload (AveMariaRAT)", "value": "851835c0488a22e389e2ce7793f3cb02", "object_relation": "md5", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143346, "uuid": "905ffc93-8fc4-4cee-9271-937357f8f234", "comment": "Malware payload (AveMariaRAT)", "value": "8a1ceb6687babe6ab82a38ca344d1092a7fc9bd6dbaf3420a3311c50131928ef", "object_relation": "sha256", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143346, "uuid": "cb4f51e0-59d2-44ce-92b0-16bb3bc2ed94", "comment": "Malware payload (AveMariaRAT)", "value": "afb6572bc1e6e2f0a76a677bca60b146f50d3bd7", "object_relation": "sha1", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625143346, "uuid": "31ad0c23-ac2e-418b-86a9-dadbd251eda1", "comment": "Malware payload (AveMariaRAT)", "value": "caa71ad7691e333ed0101f555075ac56edb9630f0f95858b945fa046e67999d3c6c060dfbc8d6251e9ab7f56db1b238c", "object_relation": "sha3-384", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143346, "uuid": "b10fc060-2170-41f7-b3a1-465d7357c79e", "value": "C405C11438F75225E5FA6A7FC7E222719FADAF12BADAD818247531810F3F14588F2139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143346, "uuid": "eb49783f-3b1b-46ce-9272-d1d9e579b8ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143346, "uuid": "9198d034-150f-4b25-a57b-c31153d6057e", "value": "12288:yT/gBbX5TyYBvsb85y+cT5pS7aLBvMeV+8cA1dSOb:4opyYy+cT5SaNvMe88Ndrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625143346, "uuid": "d329921d-1f04-4a3a-90cf-6b0f584f9cef", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625143346, "uuid": "e21b3e22-60da-401a-9da9-1453bfbabf6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625143346, "uuid": "6ed3e67b-4f31-4c19-8e0b-b48c12c600ed", "value": "JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8446cfce-dabc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625178877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178877, "uuid": "608e68f3-4c12-4ffa-b00c-b8836cd1db7e", "comment": "Malware payload (RedLineStealer)", "value": "de21b7a82826f264da25e31850a550c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178877, "uuid": "e5a2fd1e-96de-4dfe-907b-2e15d82297f6", "comment": "Malware payload (RedLineStealer)", "value": "8a8ffc4216d0fb7519d785c3b7014c4e66ffc2eba94c2127da3a56b6e8b119f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178877, "uuid": "22f013d1-d567-46c1-9c68-07b10d4a2cfc", "comment": "Malware payload (RedLineStealer)", "value": "2d29229d12909810aa20bea6884566bd4201aa22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625178877, "uuid": "b856d1af-eb5e-4949-b85e-e825c0b614f0", "comment": "Malware payload (RedLineStealer)", "value": "c3eccaa5a73ba8b657a9478d4945d0bbd602f36e319fae2c79a84ede74b520c76976f202fc63705b6f935ca9982e5aa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178877, "uuid": "6ee8ca6e-2ec2-4066-af6b-d56d47688960", "value": "DDE412913A41DA32F45281300466EB65CAEA7D6177A34303F3A92A6F6F3739127F513B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178877, "uuid": "cc3c094e-9be4-46ed-8129-37b208ce0ed7", "value": "4cf437200f0ae648baca8931f107c96e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178877, "uuid": "e11bb62d-f9f1-40d6-9859-3faed5150912", "value": "12288:nPznfM4EPLT++oe9Y3Is+bxbU51G0itjeVNU+eDFxq82:nPLUPjT+0KVYxbU5I6NRepx32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625178877, "uuid": "395865f3-4eb2-46a7-bfb7-d7fa6000a10e", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625178877, "uuid": "465b9423-86ad-402a-be51-ea284df1cbc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625178877, "uuid": "68f5ebf4-545f-496c-ae6a-9466bcbe6dca", "value": "de21b7a82826f264da25e31850a550c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7df3ca-da53-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625133658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133658, "uuid": "da45e5a1-d8be-4aff-bd70-1b52f9cb7663", "comment": "Malware payload (Loki)", "value": "4b96dba8c6dcc5e1d17cd816f9e017fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133658, "uuid": "c35c90b6-5b37-481b-ba8a-34f53ff48b00", "comment": "Malware payload (Loki)", "value": "8bc25adb8d1b8d86275ab9c85cb619deae71b1694809ee9f14f11a03dd6b739a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133658, "uuid": "993985ce-e756-437e-ac0f-eea2f8116707", "comment": "Malware payload (Loki)", "value": "0aca35691207a6d5c4b538054e3c73b5b14e63f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133658, "uuid": "58649451-e5a0-4977-b508-4753d2d82ca3", "comment": "Malware payload (Loki)", "value": "b27f26a761e97b05cd00a74435f2e5f4957501d5c16ae11fa4a8492a76d822e653cb4eafd64beb062cef8326d8c94ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133658, "uuid": "a775d563-a865-4e91-aea8-412302ef7810", "value": "61D48D242DE99035E4FE5FBD86E0615297AEEF632F13D95C24B632D50733642C9E022E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133658, "uuid": "22d9500c-71eb-43c9-80c3-559e4aba79e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133658, "uuid": "2211dcda-39b1-4365-8639-5062e259c537", "value": "12288:UAyZBbX5TyASRM+C3VUcCUj6CE5la8Veo/o:pU5SRwVUcCUjKLa8Veo/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133658, "uuid": "2b3b2828-9902-4996-9795-1e8222809b32", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133658, "uuid": "4debdcf9-29d4-480e-82ff-346421843354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133658, "uuid": "fb0546ac-7e66-40a6-a498-8a141174789b", "value": "4b96dba8c6dcc5e1d17cd816f9e017fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf711b98-daa3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625168265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168265, "uuid": "fc3f6129-2101-48de-a1cd-bca847cb3003", "comment": "Malware payload", "value": "b9973b6f9f15e6b20ba1c923540a3c9b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168265, "uuid": "9157362a-4b82-4a5d-a32d-7324e1338189", "comment": "Malware payload", "value": "8be3b10406f690ae5cf46c1dba18cb9a1c75bf646defcc9cab81d40fe0e0cc1b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168265, "uuid": "9be076ee-5255-4f86-866c-5145f9fef277", "comment": "Malware payload", "value": "22e327a5e2beba5b52358dbe9cd11727a7ddde91", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168265, "uuid": "b584e641-23c3-49a1-89f8-5c0f5440c41c", "comment": "Malware payload", "value": "1620533f4f231761e7bd27eb884e20d07d18b8d6067f8d8f9817b06222b8ec862f740497e3ead0d9cc98820a1c0b45f3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168265, "uuid": "7f7992f1-95ba-42cb-9448-50829cf78a7d", "value": "2DC36B12B6E1C432D06259700CB5E7A25A7FBC22577885CBB7980BBD5F716C08E3936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168265, "uuid": "949f4029-880a-4ab1-a0fe-fddd3549c706", "value": "1f6cf9b9a957c76a44971688f34eefa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168265, "uuid": "1ec8af08-c6b0-4b15-a855-88de635f3641", "value": "1536:8irPlPWrrqhB3kqSo0zmAPwZEMfRvNwqVQ+1XxB/JNPR9fRCT855pZW:8UPlPOeQoqmAnK8e55C455pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625168265, "uuid": "566d2554-0ecb-408e-8676-5c58fe2f11d0", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625168265, "uuid": "289dfbd5-707c-4369-9c98-a916b7d5f1ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168265, "uuid": "fc2cb070-2fb8-4359-a806-c28ad7484769", "value": "8be3b10406f690ae5cf46c1dba18cb9a1c75bf646defcc9cab81d40fe0e0cc1b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a16862-da74-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625147771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147771, "uuid": "6a214b8a-3c4a-4cd4-8605-aea805899582", "comment": "Malware payload (NanoCore)", "value": "5a2715f4fa9e20db6138b9e8aeed9ad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147771, "uuid": "642d8223-a87f-48d0-8a69-3796e3763848", "comment": "Malware payload (NanoCore)", "value": "8bea87933992abf0ab4498cdba996141e3764889d31ccb50c966619f1dbbaaaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147771, "uuid": "b1cffb41-2d66-4366-bd01-1e28a863aac5", "comment": "Malware payload (NanoCore)", "value": "dce614df69e88dbb2de6eec1b26baf5d8fd7e264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147771, "uuid": "b3b0f8d1-5795-46b9-8154-b674e895a676", "comment": "Malware payload (NanoCore)", "value": "3a48b06e500e21c85c40efdec85303c07238ac74a6fb13adac510d9aa2afaafb578a60393123ae04cea8015959bed62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147771, "uuid": "d3263ea1-6b66-45f9-93c8-46b6f77c7962", "value": "FA0339ED8AAE49C6E57FF930D7D439020332593E640C856F04A65AC7C843BEAD7E911B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147771, "uuid": "764af313-35dc-4efa-84f5-c02d6b703a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147771, "uuid": "3ff5be96-2d4b-4022-8e74-5594e073f61d", "value": "768:oErM8Ni3U0Z3k4TL1O+GflVRfZ2iT4UlTLF07r34hG:9rhNi3UNG1Yrx4eTR0Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147771, "uuid": "303278fc-b220-43b8-a778-8deeda63c10e", "value": 39856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147771, "uuid": "f40bc71d-7e3c-419f-8e4f-12190f5a8115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147771, "uuid": "792f6a35-c7b2-4352-893f-b7a674ab254f", "value": "5a2715f4fa9e20db6138b9e8aeed9ad6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6541bb72-daaa-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625171094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171094, "uuid": "8f7c286e-6e9f-4f3c-b5c0-c0b64c28a3ba", "comment": "Malware payload (Mirai)", "value": "7ad37382f9ef2b6f4f77dbabac27157f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171094, "uuid": "73d9dc49-c4de-4ff5-9214-0ddbd8c025ca", "comment": "Malware payload (Mirai)", "value": "8c0e5318757e6fad10ee4dcaaac4fd0ff6bf48368832896b8df50b3eacb98e46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171094, "uuid": "fbabfff2-a73c-4308-a452-f1c286e28a42", "comment": "Malware payload (Mirai)", "value": "1f067511a3d05cea40334cb41e8fb7d744615a23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171094, "uuid": "cb427b2d-7b78-4f7c-8093-371beb8d51be", "comment": "Malware payload (Mirai)", "value": "170d8ed15f8fc0ab1a6d03b3aa56e621e73fd072d3122d0c5dd9f30a1a7e7b189080021336b30a10a0295c0a717d717b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171094, "uuid": "ce0bab47-5ae5-41dc-bcc4-676456a14fe7", "value": "EA333AD6B902AD7CF89BE6BE80270E0AB13123545053073777ABFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171094, "uuid": "7259cf5b-460c-4da9-bf38-942d4fd995c5", "value": "768:ACeKEfhe5XdrbenXI2fNFQnnwdgFH+8iPuvWeffpqmUJTBr6Lu380Dw:hsfIBZeBlO1F+8imvppqmUJZ6Lc8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625171094, "uuid": "d3aaf501-4a78-407a-be4a-edbd10955d02", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625171094, "uuid": "c6aee806-1307-472a-8d5d-2264ada66996", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171094, "uuid": "8fe8fbfd-93df-4742-a2eb-f699b886e25b", "value": "7ad37382f9ef2b6f4f77dbabac27157f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe8d0e0-da7c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625151194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151194, "uuid": "c3386432-c57e-4b8d-9e44-44d3f62562c0", "comment": "Malware payload", "value": "22042b96cee4fb76acf806a38917032f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151194, "uuid": "a70de783-8635-4bcf-9f16-eb548bd9ef8d", "comment": "Malware payload", "value": "8d90c4d3c3719e18588dfaa36025f5d6f415476694db9fa0efd48a0cb47c5afb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151194, "uuid": "08f4fdf4-d03a-44ef-8ffa-184f48dd2722", "comment": "Malware payload", "value": "2cbefdfcd883547b05979860832978236ee1324f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151194, "uuid": "b69253b7-f8f7-46fc-a41e-08989494c706", "comment": "Malware payload", "value": "eb55ab5bfe82915357ae22e9b05172d5e4e755b8a648d459ce6adeae5a16a5393cb390c8328870cd6414c9254ae0139e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151194, "uuid": "e27ade4a-2da5-4010-896d-22244ea88f13", "value": "3E236121BF66D5A1CD91661241DE5E0FD3F86CA02430F2D8AEB1E7CF1B2237E41915AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151194, "uuid": "486c99f2-8718-4d5b-9bde-d04f7003c077", "value": "384:a7WJePZyHQtBdmdrU4LJUAqkGC4gNC+eravIjnweCfx6La2fiSNJl1+sjKIq3CUO:CBByHtPdUAqTaWecnfCJ6+Apq3FNoWHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151194, "uuid": "d6e2cf3e-d492-4337-b8e1-962901bd4d43", "value": 45843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151194, "uuid": "4af73d1c-aa0c-4cf5-b90b-85c8864df96d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151194, "uuid": "085cfe5c-eb52-473b-9c0f-2e2a6102d087", "value": "Pedido100293.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ff906f-daa9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170743, "uuid": "b97807b0-e914-49ca-bd68-5a9d5fce6608", "comment": "Malware payload (Mirai)", "value": "78911c8c9f7e1623371aadf21a8326ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170743, "uuid": "146ebc56-2bae-46b7-8a81-2e4b6bf859a8", "comment": "Malware payload (Mirai)", "value": "8f6fafdb45f401dc0ef840f42d0b34a8653c56a90370212e860ae5705e41d263", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170743, "uuid": "4c2d92d4-d86b-42c8-a6f5-dd452c2a3a01", "comment": "Malware payload (Mirai)", "value": "d82839d332cad966cb40a6fb6d7d9fabb3c6b1c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170743, "uuid": "0922818e-65b8-4345-9d56-860fc0c93b63", "comment": "Malware payload (Mirai)", "value": "c546ee212852c77491342909d3e11fe4ab4da6bd96201241fc0c3731ef80e5a2cb4b08962aa4a7e7820fa4fb4867fb5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170743, "uuid": "365e0c36-2562-4320-8120-51131e475239", "value": "52C2E0CCF815ED81C8E57CF8B4DC87F20695506633AA9F0E3B924DC956F580FB8990A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170743, "uuid": "d6b9135f-6194-452b-94a8-484084c76a56", "value": "768:w4CUFskb2JgIs/E2+On5dafxkmkfEvtY/vb+zyuWb:/CrJgHiOnPUxRyOu3bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170743, "uuid": "2ecf60f1-9720-4321-86c3-29ab6d212c0c", "value": 27236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170743, "uuid": "0acbceb0-39b0-4de9-9d4c-f1b0d3c1316a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170743, "uuid": "e824c3a4-db64-4fde-9408-bde622ced15e", "value": "78911c8c9f7e1623371aadf21a8326ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af0a283-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625133361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133361, "uuid": "3312cc49-106b-4f18-8fb6-417c8038176b", "comment": "Malware payload (Loki)", "value": "da92ad6f98f8613f4f5582f0a12147a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133361, "uuid": "c0fbc8c7-4fbb-4039-bab3-33e1bb54057b", "comment": "Malware payload (Loki)", "value": "8fb3fcb793809295eb0b7b7c9752bf2747b53480fe59550984a438e5d7375443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133361, "uuid": "e8f20191-e7dc-4a64-a6b0-dfc4732f7cf9", "comment": "Malware payload (Loki)", "value": "2ba74c451672381db7084995272d35f57f413790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133361, "uuid": "d4b361d9-4f82-43dd-8627-52e40b142d41", "comment": "Malware payload (Loki)", "value": "8afa148ff75ace268d1ae5320c282435cd7e010cfbc8ed9c565279487c0a37f66ccc37cdfec5dd0758434da155724af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133361, "uuid": "cca9bd0c-242b-4d01-8c78-1bf31ac37cf7", "value": "4D35D01FF308EA55C9982A34DCFEC364137ADD867C02CB0B29887EED7CB2655D8512A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133361, "uuid": "9f8ac87b-415d-4b21-a90e-1c1fc95c26b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133361, "uuid": "c1006b85-062e-4796-9085-605f8d5ba9e3", "value": "12288:lui2+zhzhAzGZNlQCTaypJFPCZqqql8u5+OqgFskMpHWDDVhp:3DzhzhAzGjBpJFaEb5igFhq2Vhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133361, "uuid": "5c22e765-c75e-47dd-9894-223b3503daf4", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133361, "uuid": "9b4dfa73-a85c-43cd-b345-dc6c6d0a5451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133361, "uuid": "ff9426e4-1d34-4ff1-9106-0d879d87814f", "value": "KG Quotation request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab899058-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625118813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118813, "uuid": "83a13710-1281-4b92-9ed3-f888e2110038", "comment": "Malware payload (Formbook)", "value": "d9971408be799aba6b702d970978a5e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118813, "uuid": "37d611fa-f48c-4e3c-8a3a-b7ab7b148caa", "comment": "Malware payload (Formbook)", "value": "918d8e93bbfb6c900fc0e9e6dad19a3524326f32bf7b48f0a74e9eb9e1f50768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118813, "uuid": "6a4ef62a-e14b-45ef-bfe0-126d0b69dad2", "comment": "Malware payload (Formbook)", "value": "bb42aaa71752cf7e5fed04e9572751b3f2a3db9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118813, "uuid": "f93ff3e2-4833-4142-8df1-ded76d9f8747", "comment": "Malware payload (Formbook)", "value": "97fd825f67be1bd50782752d0dd2c13fd60b5bf279df0ad05d1bf47a5ae8aa47394f5b262cb0e7d6b443dc39f62640eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118813, "uuid": "d5f16139-2025-4294-a07e-f184ff38930b", "value": "AC45D00BF6049A45C8552638DCEFC3701379ED9B7C528B1B2D987BEE3CB2225CD552A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118813, "uuid": "63f54922-488d-4bec-9d30-8c1f76e9b97d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118813, "uuid": "fe125dee-200c-485f-b811-801ecc160633", "value": "12288:tPkWjkcmhzh9ZXi4pe5PPwfpvByByn1ypGHUMvIWihh:iEkphzhrXJc5PPEpvyy1oGgWihh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118813, "uuid": "52202450-fd13-4d0a-b6bc-eb2d49a6da78", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118813, "uuid": "e2ac7f1d-3b81-4187-bbb0-e87c8c83581b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118813, "uuid": "ef6a0bbb-059b-4d75-95f0-ed5bba264f71", "value": "INVOICE_010348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf63680-da8f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625159457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159457, "uuid": "b8d0d493-8275-4162-9dc8-b4420e073398", "comment": "Malware payload (RedLineStealer)", "value": "4deb022e4df30a64b1b5c4fee94f0873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159457, "uuid": "b1ba5147-0d67-4a35-9896-31ff88749aaa", "comment": "Malware payload (RedLineStealer)", "value": "924bb78c8e816ebd25d656fb6cf0387449cd4b3cd55846c99d4f0ddb47f71dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159457, "uuid": "ccb0465d-f055-4b7b-8d18-bcd6959cad4a", "comment": "Malware payload (RedLineStealer)", "value": "b55e3c237032745eb9f1990ac9fdc9abc60b0238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625159457, "uuid": "6b287d91-77d5-4fbd-b398-fd8026cac9a7", "comment": "Malware payload (RedLineStealer)", "value": "7ebb7aaac052da3401453cdd6d0a785a32e40df557895f3fe7c3ffd41d2b9d70045cffdc5ead77e1256c86b1a3338cd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159457, "uuid": "6d34b81e-6928-44d7-afd6-181be2f9f893", "value": "1D26338177D5C0BFE59105315A8A8F32D2FAD35C0B644E5B739081AD0EFBA44FA6E12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159457, "uuid": "3215178b-4b7a-4ef6-bbee-1ede4b2f8964", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159457, "uuid": "7b9f7f26-b77f-407e-be05-fc8591a6ab3d", "value": "98304:x7Xxj+HYKjwrSKostBDHP0SM10sJupCa2X5RBUjLltpVPCvLUBsKaoU:x7Xxj+HYoEM1pvNmLP8LUCKad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625159457, "uuid": "6b1bfd1b-ec61-4d12-a12f-7ce5ea726c63", "value": 4706138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625159457, "uuid": "befa6ad9-9239-4cae-914c-c482715cbcd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625159457, "uuid": "3abf1471-0aab-4c7d-b951-da36c2d63b24", "value": "4DEB022E4DF30A64B1B5C4FEE94F0873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c67864-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138231, "uuid": "03fa7d48-3de7-416c-850f-833019d59872", "comment": "Malware payload", "value": "5bf72b539b47888a78fe595610233c9e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138231, "uuid": "46c9c921-908e-49bd-9754-725660a02cd4", "comment": "Malware payload", "value": "92dcc07455f76dd19c3296c21dddae1848ad074beb0b9ac67b5b97dbe8e2b3ff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138231, "uuid": "50f538fb-d691-4895-819c-14e939db6561", "comment": "Malware payload", "value": "e0cc564b3871d0c0615f2dc9a56bd5ff12aa1ed8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138231, "uuid": "ee124bc1-da02-44a8-90f8-03b5b75e5f0a", "comment": "Malware payload", "value": "52988e88cab5c467f164eb42e13e67da387fc0e02d97260a7bb365960e684f293f141eb362fc1876cf1e6ce72a2580de", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138231, "uuid": "0284fcac-c338-4329-af14-7ed787d9e017", "value": "1FA2500AFA95C996F3120375DC6BC684725ABC5D6E82820FB7983F0EFCB05B55B12790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138231, "uuid": "40ad3ed2-ab06-4a3a-9c03-31670605ffc4", "value": "96:TvAUlgLqgx4b0C6Zjp6bfu/OpK81Efkp/XxFpgNV9LlqLEgr0rbLc1v:7FlgLqgG0C6/6r28pp/lW5uNr0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138231, "uuid": "e4ff2c28-e384-45db-a5e4-d84be47f954b", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138231, "uuid": "619cfb3a-5862-48b9-817d-a9aa22e9d5cb", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138231, "uuid": "4de819b2-93f3-444c-85f2-41370c635c40", "value": "92dcc07455f76dd19c3296c21dddae1848ad074beb0b9ac67b5b97dbe8e2b3ff.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b70c809-dab5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625175668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175668, "uuid": "05ae6c4b-4178-4400-bac6-e4aeaf4c5ad8", "comment": "Malware payload (RedLineStealer)", "value": "8a31145cec9114aad8e26b39b20d9c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175668, "uuid": "78a53f8b-6c21-4c32-98a2-adce9f81a49f", "comment": "Malware payload (RedLineStealer)", "value": "937c23fd4ef47dd3d1bd2e19c41d1b5d658619e0747dbc78f0d875c8cffeeddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175668, "uuid": "8cc5e4bb-cf02-45b7-9902-52fd0c2adf49", "comment": "Malware payload (RedLineStealer)", "value": "9fc4ebd97a60de4f146b54a8ecc471ee3b5c4c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175668, "uuid": "9af81efb-29c3-4553-8cd8-c99072166222", "comment": "Malware payload (RedLineStealer)", "value": "6ca1b514290ed669fda58e529eecf821a45889b403fa7e884f43defcc345db1d9668e13dfb65d8311014215a99696023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175668, "uuid": "79a2be10-8422-43f8-8c52-1c0eb57b94e4", "value": "62164BF13A0692DFD34548B4E402D663C4145FE28654A542DCEE7C3FBA62DAB21CEB9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175668, "uuid": "a563566a-365b-4bef-bce8-de33f6182589", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175668, "uuid": "47a8d6a4-186d-467f-9204-7b6afc882bcb", "value": "49152:ufXL9zOhsVAdcBZY7iVXRYlfv8beIynydPYwjXpwbnh3jL:ushvoVBYlqH6yp5cJjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625175668, "uuid": "1dc84dd8-0979-42cf-9682-cad1e35eb4e1", "value": 4258816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625175668, "uuid": "271e4cdd-c479-4421-a31b-7376e52ea9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175668, "uuid": "c00e73fa-a0d6-45a9-a6ce-17a6b16e1f0d", "value": "8A31145CEC9114AAD8E26B39B20D9C4D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23fe620-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625121079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121079, "uuid": "bb633481-b3b6-4d46-b1ef-0dbc76bfb39f", "comment": "Malware payload (RedLineStealer)", "value": "8f4f3098a299263796ba08f5969bb29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121079, "uuid": "0c4e4f95-e3c4-4344-9d43-1955f44f3b20", "comment": "Malware payload (RedLineStealer)", "value": "9771e78ba4c4e0daf1348dfadf839603a08717b090aa01baa9b8ccb802c7f5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121079, "uuid": "64d5bd6e-ac2f-480f-b68e-9e597e0042bd", "comment": "Malware payload (RedLineStealer)", "value": "7486191e90cd6d99ad64c77182a2a66c9a1e80dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121079, "uuid": "e5ad5a4f-3706-42ea-afa5-19f4f8b221f4", "comment": "Malware payload (RedLineStealer)", "value": "1ec7c54e8c9ce8e31c443ae41265a69308df6283e6de33571f1af112d332f9097c575ff96c7d46244d638163a1f7b08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121079, "uuid": "ee87d5d1-c8c5-49ae-9e63-9da968d9a148", "value": "00E412523680C032D44215342A56DB61A7EEBE6266635707F7E90EBF3F276C136F6223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121079, "uuid": "88364d97-24f0-4ca7-b88f-da85c9aead0e", "value": "fe051b2c4e04dc43ff91d31fb9184c89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121079, "uuid": "0c43cebc-711c-4e4a-af1f-022bb8af34c3", "value": "12288:ZYIwHYHbj3NDD/7bLRt8lpTxJWaDLzpZ/MuUxKo3LPDizn6gAiRwKvy:ZYvHobjp/70pTxJWmLzvByKo3Szn67ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121079, "uuid": "2a4660b1-f697-48a3-9224-8cbdd87fa8c7", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121079, "uuid": "f23b6a74-bfb8-4d9e-9cf9-8cad7ebdf78e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121079, "uuid": "8dde2d5c-7ec0-4534-9b95-3e2f0382fbb0", "value": "8f4f3098a299263796ba08f5969bb29d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e67478f-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169337, "uuid": "97c801d9-28e3-4cc6-9e6d-efcf55e316ea", "comment": "Malware payload", "value": "1a28c673b2b481ba53e31f77a27669e7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169337, "uuid": "2e607c91-efea-427c-b12a-586fa323d079", "comment": "Malware payload", "value": "984041fcf46bf0d275bf5f7eed649b3e2968e005e6a59829e4b9a51b875c7ef9", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169337, "uuid": "96b1cb8b-82e5-4ac4-bd32-50a250f7e927", "comment": "Malware payload", "value": "9c9f1dfa79575a212023233ef5a3db4e7a250278", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169337, "uuid": "c780f54f-cb68-4d4a-8269-08c8be74321f", "comment": "Malware payload", "value": "203c4b444339264c5d82cfe02e6a12a28fedc47d050c3bcb8069f195b29045097067981bc47197109d5a85e32a93dd9d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169337, "uuid": "d11693b5-489c-4f07-9f51-9445e4544f90", "value": "C7837D22B2E5C072E0631970B978F7B21A2EF8115B3415D7F3484AB91E616D18E763DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169337, "uuid": "bdbf2a4a-adbf-4f04-a084-b2c9ad7781cc", "value": "401cd4c56c3dae40d0c361337705bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169337, "uuid": "c1d24928-8457-4f17-a668-06724f57789d", "value": "1536:ur3nMgBBXh42qKbpOq3zGqa+bQdBeJc9jqr5k7bTucWPqarJN:wE2qKzrbo19jI7cHarJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169337, "uuid": "fd132654-0729-418b-af82-40406b63aa78", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169337, "uuid": "457c8bc3-2342-4116-9e6d-beef0c1a15b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169337, "uuid": "26f240af-c686-476d-ab80-3b4dce3e8a22", "value": "984041fcf46bf0d275bf5f7eed649b3e2968e005e6a59829e4b9a51b875c7ef9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5ebbf1-da9b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625164615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164615, "uuid": "5504d876-fb0e-428b-bce7-5b8d3a710d5e", "comment": "Malware payload (AgentTesla)", "value": "93ab38b828ce3ff38f9bd60f8fb19d71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164615, "uuid": "393594db-e21f-406b-8719-50cccf02c9e3", "comment": "Malware payload (AgentTesla)", "value": "98fead1019d9493e86eb686d786b5a788ca09bc83c8914cf165e85f029b6481e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164615, "uuid": "ff72f597-a68e-4069-8b65-0bce76db6f71", "comment": "Malware payload (AgentTesla)", "value": "59af48505c8d610eb1e585dfad81597bd91f4b3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164615, "uuid": "51825f1e-829b-4220-9554-af2ae610021d", "comment": "Malware payload (AgentTesla)", "value": "d346f7092058345fe8baef3fe20dac966c2c332b5812f85e3976d947690ca4ff4cf370cb1a6594d897149314db918829", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164615, "uuid": "0854f612-5373-4e9b-b468-9b30ceb960e7", "value": "E9058E312AE48666E2F69F7786A3A65447FDFD23AF17D90E285032CC1733B41D87121A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164615, "uuid": "da26575c-222a-4a2c-8319-bd5114e451e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164615, "uuid": "3c8980d0-f97a-4c22-bae6-221129dc30c9", "value": "12288:i1ICMuJ1EOGQydNStcqKJj/0Zf7CDgCxdPBbIOAyAbANjNo6HtgEbSYFbMjvLe:ikN0yMMlxdlAy8agEb9+vLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625164615, "uuid": "0686a90c-5e90-408e-bf50-a28c50dcb7fa", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625164615, "uuid": "3e3d21a7-5570-4532-8938-63e922cb0fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164615, "uuid": "c78bd8da-2c04-4263-8b43-80f27356cda6", "value": "shipping docs..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ee6b05-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625137993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137993, "uuid": "b36b6de7-b1a8-4e33-91cd-61ebd22f3d12", "comment": "Malware payload", "value": "6c29790838f854c679914528e9d07576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137993, "uuid": "f35d5d9b-f634-4dcf-a84d-a49c6b2a163f", "comment": "Malware payload", "value": "99ebb7d245ea5a3535cfba9d1cc7ec71a8cef683b91522574e32170198851d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137993, "uuid": "b94ba114-2f12-4ce1-af68-8e1725b6be49", "comment": "Malware payload", "value": "98e394312f51231f3c8e56054f49e7b9f41e4840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137993, "uuid": "552eac20-6225-41c5-8297-0728d7decc7e", "comment": "Malware payload", "value": "5fb38eaf93a14f0fb15be079419775d5a55d37a06f51a3f3f2070300d60508694ee5eff931c50fcc201cad9f93a8e257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137993, "uuid": "0c8cb711-827e-414a-be8e-901bbc8e23be", "value": "AF647CE1B546CCD9E80747F2096AAA2010666E7C85A4904F70E93F3F777739328A6F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137993, "uuid": "a4e7b4ea-c676-4d2b-a116-7d0ccf093b4f", "value": "8081bccafec72ad1ecb5103b6457d26c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137993, "uuid": "09fd8f67-44fc-4fa9-88cd-08208ed96ed2", "value": "6144:ZLVOqRxlhys2LUCnzaLEAmg+GEPEAmg+j/r42PAB/Zqj:7OqRxlhysknzwEAmDGkEAmDzs2PABBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625137993, "uuid": "946db66c-1ce3-4a75-8a3c-106ee583675d", "value": 328158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625137993, "uuid": "5555976a-b228-4523-9e0b-596d45c3f4aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137993, "uuid": "e1959bd6-df9a-4fec-9033-5e01744cc630", "value": "CARTA_IDENTITA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c123b7d0-dab5-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1625175972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175972, "uuid": "073a0dd0-3463-485e-9a15-a4676d8fb7c2", "comment": "Malware payload (TrickBot)", "value": "4185a656dd45d56626bc9ded66c3a7bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175972, "uuid": "0e0e6704-e4e3-4f7b-a638-7579dd58058b", "comment": "Malware payload (TrickBot)", "value": "9a0b3a21e8932b903f9d79b948c6abf8f735746d4f4c10934f57c34726af3f3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175972, "uuid": "e23be598-05ca-441a-b852-79a976b03263", "comment": "Malware payload (TrickBot)", "value": "c0f7e382731dd95eeb362aedee928d99e6eaadc1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625175972, "uuid": "ca869b95-1163-40fb-a33a-dc3a35c63b6f", "comment": "Malware payload (TrickBot)", "value": "2ee38f24d5ec7153c08546dd5a6e27429f88c0c4c8fe6b9396e639e23d13840cbc1a731775cc147b35894b69ab3d0cf6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175972, "uuid": "11b5c8d8-efb9-4b71-9439-7b114ad9b52b", "value": "F2B4CF113680C877C5AE32B54557D7796AEDB4305BF0D38BAFD40ABD9E226D18E3830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175972, "uuid": "ab1071dd-721e-4349-8158-61787e4b2684", "value": "81a06e7356308d6f90f3bb9ae999e758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175972, "uuid": "217fa786-61e9-4dcb-8410-c7abc76c3fc3", "value": "12288:eYUqByp7YKoM2/tDnJ6JKNcelTCs8ytO1AlYd8lVI1:DUqQB/2/tLJzl/rM1AY8Xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625175972, "uuid": "decd6c55-bc08-4588-a40d-65044bbc8f59", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625175972, "uuid": "7b61c28a-23e0-4201-a8c2-12a8dfedd852", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625175972, "uuid": "04c9470a-4a47-4579-9a61-e0f80d1b1a06", "value": "SecuriteInfo.com.UDS.Trojan.Win32.Trickpak.gen.13196.11909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544a4e70-da70-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625146155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146155, "uuid": "64a463ce-d094-4e55-aa35-7e0875a53f13", "comment": "Malware payload (Loki)", "value": "b3c48fa922fc6a96837a3eed4e781f26", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146155, "uuid": "205e7987-051c-4b60-818f-aa22ff3e28ac", "comment": "Malware payload (Loki)", "value": "9c2529b776fe1f43eb50e5c9148e6c5acd837e703829dfe506299903888834d5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146155, "uuid": "a822f1b4-64d5-49df-b575-d15063539969", "comment": "Malware payload (Loki)", "value": "f5966258f7fbdc953c40aad1f5a246f3b7d6a222", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146155, "uuid": "baf7ba6a-7ee1-4f70-baf3-f3d29864f0f2", "comment": "Malware payload (Loki)", "value": "a267bf7bb544b4ddda056c1162cd520872d96f66f1d6d91a38a9becd9baebc6040dd29fd6959eef9e88107144da95329", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146155, "uuid": "353b6e9b-9146-4013-864f-9336ec3d4e1a", "value": "A6452227E41C2ABFE12F4471D94DEC23F12BEE849B7946471A063A237EF07B9615212D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146155, "uuid": "62c83824-a31c-4196-b714-8b5c1d854a62", "value": "24576:jSD/hkdmS01PRvqN/JKvdBzSlWgP9tHpmtN7NbjxJOnIFpTJiqap6FlBlT:jSFDS0nqNxozAWgRmxfqDi/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146155, "uuid": "4ad43b91-47bb-422f-a74f-a33a790a33df", "value": 1216424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146155, "uuid": "6b3d168b-d373-441b-b5b6-eb217aed91c0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146155, "uuid": "6aa7b7ee-3631-4604-8baa-24e33041b2f3", "value": "justificacin.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6739e075-da42-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625126429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126429, "uuid": "bce99158-de03-4577-a132-d26c3fa7fbc3", "comment": "Malware payload (NanoCore)", "value": "976de28477571b27083d6119f731dc89", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126429, "uuid": "518c8fb5-f7c8-4139-8ccf-8782a90a1f9f", "comment": "Malware payload (NanoCore)", "value": "9d9e40b5deffbcf070c268681c4fb078d6067dd35b2a5e9fc1b8403e6996d9e9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126429, "uuid": "2060f4d4-8c28-44f6-9034-0566ad62b86d", "comment": "Malware payload (NanoCore)", "value": "4da7e1743ac9d2b80aa543aa34ffdceed347143e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126429, "uuid": "7e33209c-c02c-4982-a0fc-f5f2fff4ba74", "comment": "Malware payload (NanoCore)", "value": "a48b2f0cfb37b11ff9927d6f6f7f4005689539a59efea3f432894e711bcc7ad6b56b1f59d8615127d55efee5e9585b94", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126429, "uuid": "c8ce4d3d-7d22-4146-8891-ae10dbbe4ce9", "value": "E025239785E56B8B873CF1F82EFE25448616EFF806121049FE28540E7EE3FDA410A597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126429, "uuid": "bee9827f-d01e-4019-81ea-8601a5f839a5", "value": "24576:id1lEmgHypFY/UIBZ+8D2yANMVaHVLx9thxqkXrT:9mgMYcIBZ+iwMERXt/qkXrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625126429, "uuid": "895d6da0-15ba-4649-a069-18cc500340b7", "value": 1035808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625126429, "uuid": "a5254d58-5fe4-4463-92b4-a31fb5ecd78d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126429, "uuid": "fabb9064-b071-4f06-896a-f9b3f6b164ca", "value": "976de28477571b27083d6119f731dc89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b99d706-da14-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625106653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106653, "uuid": "b29fd12b-d80d-48f8-88c0-a573b9544d58", "comment": "Malware payload (Formbook)", "value": "d5d18f4689dfb102120da35709ad34c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106653, "uuid": "67b88e43-3015-4622-9740-8e98788d7429", "comment": "Malware payload (Formbook)", "value": "9e4bc7c21a72d800f6e183e85eed53f7648b50a2f5c521f36f812d6b283deece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106653, "uuid": "19e3c298-a524-429f-a2a3-2c41f7e80193", "comment": "Malware payload (Formbook)", "value": "b142f2e5e34e2c5ff068d176d59cf00c775be592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106653, "uuid": "da80a56c-4626-4fb3-99c4-c204b596e29e", "comment": "Malware payload (Formbook)", "value": "e756038c955320d7244dc2aa0c235c58a01115a67b8cca9cbc5f4812ef0c365a2f6d288d002dfdb75c393528dada15ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106653, "uuid": "d60c2255-3188-428d-9399-44820397d76a", "value": "5EF49E252AF84A29F0BA9F7D85B0210587FDF613AF17C95C3DB551C90723E82D6B132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106653, "uuid": "efc2d31d-5920-482b-a56f-1ca981627220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106653, "uuid": "ffc8a047-eaab-42cd-a00d-550a1e000cda", "value": "12288:+sX8FZBbX5TylwKMnTwu2PJJU3+QWKMvt4TReNcuF6wEwpEZGvmugF7:HWZgMMluOQst4FeC66wEoeWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625106653, "uuid": "57f15324-45b3-485d-af78-89e363f4ddc0", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625106653, "uuid": "eb9b38b1-4453-4e50-9207-571aeb581882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106653, "uuid": "da20030a-1486-457d-8f75-b2cd7d9efffe", "value": "itachi Terminal Solutions Korea \ubc1c\uc8fc\uc11c nf 21-0649 (\ud68c\uc2e0\uc694\ub9dd).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d589a1-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625122911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122911, "uuid": "59ee9946-89e7-4cbc-91c5-d3d4b7f51d96", "comment": "Malware payload (AgentTesla)", "value": "9ad33268a00632fd1a5bb210b073b2f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122911, "uuid": "5c237af0-3fea-4a6e-9179-3c94c0fec07f", "comment": "Malware payload (AgentTesla)", "value": "9e537b12c49cb2567b23a965f83695bc071b684c81edb5fadf1b24909f24b3e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122911, "uuid": "93d02257-f5a9-4895-9e6f-ef647fe4d3d0", "comment": "Malware payload (AgentTesla)", "value": "d018dd1f70f84f20d7acb7ae7ee418d69e14f7c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122911, "uuid": "23ff2c7b-5af1-4a1b-826b-453380a3bf3c", "comment": "Malware payload (AgentTesla)", "value": "4a2faf4a12199dd6a1ad989b2da2bc0bb0af243363ca388a9f8d852b6e014524aaf465c86c836ec27892bbb1013a6bb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122911, "uuid": "c6051a23-294f-4114-a866-ecc1b76268a1", "value": "84E412252EFC25A5D1B68E3662F53309D33DB636361BF11C20C35B4A4983B41DEE1AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122911, "uuid": "f8bce9da-2ddf-4043-bf55-bf5643abe77e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122911, "uuid": "9e7acf8b-6c92-47ad-bcb1-d9c7c6c56b61", "value": "12288:PjQ64V8dzLjpnz+ShoyhrU+/xd00sQ/KbGuIvyJKAc44N+nl:ENV8dzLjdaShoGrU+Zd00ssoBpJKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625122911, "uuid": "ce674657-959a-41e1-bbae-c7e630626696", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625122911, "uuid": "8549625c-f908-4e3d-b323-601271d2124d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122911, "uuid": "dbee07b1-f513-45a1-8268-525108606307", "value": "9ad33268a00632fd1a5bb210b073b2f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84aacdb-daa8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170455, "uuid": "ac85e7f3-9ae8-40b1-a779-bf8a800a048c", "comment": "Malware payload (Mirai)", "value": "4b2cece8e852f05445cc6d6c72839d2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170455, "uuid": "53d1dc33-add8-4a01-b396-3ade67cfa028", "comment": "Malware payload (Mirai)", "value": "9f68c827d707b4ffdf36c030173aaf9f0208e7e82d6e03809ec74f896a2b0c7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170455, "uuid": "f3e34764-1090-4041-95b1-8afca1066dd4", "comment": "Malware payload (Mirai)", "value": "89867aefcf18a9c59968d998cddf27f91b28f8a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170455, "uuid": "234b6de8-de14-41e2-a952-96e091d97525", "comment": "Malware payload (Mirai)", "value": "ca80ed1cf912a018096dbc0dae29f79cf9f9ca822c0f267abb963130c9c76eb9e9de3e2b33bc0e686cc5a8a9e85f4d5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170455, "uuid": "2820da97-f53e-412d-9bf5-9f0d26586e60", "value": "AC431925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170455, "uuid": "0cb915d7-7ad1-4a9e-b0f2-62a9695355d3", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCD+:eL0AxvSHfymp0xgunvCkV6vTMDauN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170455, "uuid": "e2c3afa6-dbf2-4596-8d7f-20fdb87d199e", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170455, "uuid": "a6cbf1e3-978a-4a2e-8fc6-1db8838c38aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170455, "uuid": "3157509f-294e-49e1-9f43-90b01f671b2c", "value": "4b2cece8e852f05445cc6d6c72839d2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5eac12-da56-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134895, "uuid": "7a0443e7-7f2b-4d7c-9dce-5985d55e5074", "comment": "Malware payload (AgentTesla)", "value": "d1f5c8c3c64a309ae6b09187935810ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134895, "uuid": "76a6f112-064b-4364-af34-f5a2160d2da7", "comment": "Malware payload (AgentTesla)", "value": "9fcb0cce3dce5ac243463c2fc5a1f4044ad9e92594723a76999a5faec55116ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134895, "uuid": "dc8629bc-ca2e-4c2d-af3f-23e637eb0c0a", "comment": "Malware payload (AgentTesla)", "value": "964f7a10b095882241b197c61d933650a674f32c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134895, "uuid": "6f5cb1d9-143b-451a-8b25-94193c49468e", "comment": "Malware payload (AgentTesla)", "value": "f4ec26ac671b5e23d2ddd9098d14285507fbbb301f9e333d244316efcaa1f760f359bbba59854c0feae912684d1d5a3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134895, "uuid": "c0c8cf35-c197-439b-a9e3-55543a5e7d2b", "value": "E1A457302A146532E7EEC63A609A9522027E1D1DE52DB27549F873A11FF7F7B4307A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134895, "uuid": "e62ebb7e-942e-46f2-9ca4-e5ce14450457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134895, "uuid": "01890049-db0a-4eab-a2dd-48ac182e6f21", "value": "12288:HhEFVzMFp/lpI+QVv8SXEaqR2dxCOI787BOw1CPY9:Hma5I+QZT0akw70w1CPY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134895, "uuid": "256e3713-a16d-4275-b692-981eecd57b54", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134895, "uuid": "37dcf1e9-37d6-454f-9dd6-f21063ad66e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134895, "uuid": "cbb866d3-3990-4324-b168-7f828ab2a214", "value": "d1f5c8c3c64a309ae6b09187935810ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3689b5-da56-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625135112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135112, "uuid": "7bf21ae0-263a-4527-9d17-990613e08e67", "comment": "Malware payload (AgentTesla)", "value": "86492f609c56774ba638f7d69783a3c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135112, "uuid": "2bf2759e-3e21-414a-b77c-1cc8875d7a06", "comment": "Malware payload (AgentTesla)", "value": "9ff203c1fe2e11952de2655d7e830a1d59b87ceedc39cfe6fe2420be49f99bae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135112, "uuid": "9aa7c238-6b7a-4629-ab34-4eaa7900cf2e", "comment": "Malware payload (AgentTesla)", "value": "f7949792483bbd1d910894d9e3b2b2653f0b9553", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625135112, "uuid": "328332a2-51e4-4f4d-a3dd-6507c3574b6d", "comment": "Malware payload (AgentTesla)", "value": "d7ea994f24c063225693dd61fe61fd6712d39723bc166c2638f7504ad2942c55600e508a627e4fc7d799407e907ac3df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135112, "uuid": "137ff684-18f0-4545-bfef-9d9f27c6115d", "value": "C645D00BF6099B41C8541238CCEFC2741375ED9A78238B1B3A9D7AED3DB3621CD556A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135112, "uuid": "639e6c8a-0b44-4ec1-a587-d68a05942126", "value": "24576:GmhzhKWZXXiNSVCPFMMVjR4bkzVLa4hx:ZhzhvZXXdArjR4ozVLph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625135112, "uuid": "9245fa46-7d89-4ab8-aff0-dc1ec3137120", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625135112, "uuid": "b855dfb7-39a8-4078-b0d7-98724d3998fa", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625135112, "uuid": "612e223f-8814-4ede-8c49-3742560083b0", "value": "RFQ 18757_Pdf_________.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74936e09-da71-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625146638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146638, "uuid": "11bab760-6dfc-4a2a-afe0-1440ce2f7c23", "comment": "Malware payload (AgentTesla)", "value": "5370fe8061601f28ddce092bfb2a33dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146638, "uuid": "f69fdb11-37fd-4193-bbc0-5f051cb14990", "comment": "Malware payload (AgentTesla)", "value": "a00680f547b2155b2e24d09bdd49e74b38a7883a13e47553662fb657e42cf007", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146638, "uuid": "43a39f75-5be2-4196-8f40-d4b4cf2e949c", "comment": "Malware payload (AgentTesla)", "value": "6ff5ffd5874d74a4d951e16311220c869be18310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146638, "uuid": "71a78e5d-8341-4e10-917f-dd9a7b0b579b", "comment": "Malware payload (AgentTesla)", "value": "62ae3a23db08b83c6543b77cd5f5423d310fb81a4443c9eca0f404336b05f07b3b4cb0f968a40fc4850b0ef92c65b8bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146638, "uuid": "19235b33-6577-4744-92a8-9ff2b62e925c", "value": "4EB423016213AB1487DE53A3DD62E85F3B73DC17A296CD09EA0210EAA3D4BE0F7D45E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146638, "uuid": "1168a425-0383-406b-965a-cdd37e1c95ec", "value": "12288:qRkq9g5FS2ovwegLlL++0Ldwaj7xvtYnauHXMzWw:q165F7DLlLx0LSaj7xtTuHOWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146638, "uuid": "76d59d97-ce4b-4d2a-a4df-1a77cab17100", "value": 537394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146638, "uuid": "3ddd1624-219a-496f-9c87-513df02b3bc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146638, "uuid": "15279caf-deb3-482a-80de-c614bcf0a466", "value": "RFQ No49958 Led Farm Pty. Ltd New Order.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41fe1f2-da68-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625142852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142852, "uuid": "0bef5634-fcb0-4ebd-9857-4810b813bff3", "comment": "Malware payload (Loki)", "value": "ea646520496fd4603aaf0f5778231f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142852, "uuid": "d9a7f6cc-7ccf-4709-97b0-87353f8fbcfa", "comment": "Malware payload (Loki)", "value": "a130cf9df18f1ae304826c98d4e7cfd2e75043b126a1df0c0a36f98a64cde5c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142852, "uuid": "e8f429ad-0df9-4286-b119-7ac16eaccbcc", "comment": "Malware payload (Loki)", "value": "5112f3f6ae6a8a7cfac8364433128228c450f203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142852, "uuid": "47eedcf3-1fdc-42be-93fb-4479ed6dd0f7", "comment": "Malware payload (Loki)", "value": "52a08a6af6c55e85589441162668448c7d072b6b2cedeb7cc30f59daf5dc5ea78b66fd61072f99516e7144ad68a6c161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142852, "uuid": "44fafc54-0c01-4cdf-b1bf-48d975b7293c", "value": "0635DF0BF6499A46C8942638DCFFC2741375ED967C128B1B2E897ADE3CB2711CD513A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142852, "uuid": "d44d1973-7f66-4b79-8732-ceec4dbc406d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142852, "uuid": "208a5fa3-3324-42f8-8c02-90efd1f88a87", "value": "12288:LHvr5hzhEZ66mE9GXlGxPvL+LI0Iyi/DnyqTts7RAV8hh:Lv9hzhkME9cEFzUI0Iyi/7vmaWhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625142852, "uuid": "95fef011-4dc1-4727-b2c3-7bebe860d5b4", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625142852, "uuid": "401b1420-9b86-495b-9a75-93579b175bb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142852, "uuid": "f11c7979-05c4-4017-bc0e-3cc5fb306b74", "value": "RECAP SARS COVID - 19 - AGENCY FORM.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec6dc4c-da36-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625121154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121154, "uuid": "96068241-6e9f-49f0-994f-421715e6b205", "comment": "Malware payload (Formbook)", "value": "df75bedbb01fdfb56956fa33a46205dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121154, "uuid": "1d0b70d6-598a-4260-a79f-f66afd216dfd", "comment": "Malware payload (Formbook)", "value": "a3fba593fd284298c6c432d6c913a6011a031a5d020bbcc2e41bcca6e7173c98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121154, "uuid": "5eb024be-3d37-408c-a4ba-c8665beab2b7", "comment": "Malware payload (Formbook)", "value": "c9295e94343fbcd2ec530c497a083e8d15f76861", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121154, "uuid": "b8050204-0a1e-471f-973e-b067c036effc", "comment": "Malware payload (Formbook)", "value": "c5ae68cdbd6013d074934dd6f856f9c64358ccbab5328682ea149f902936ddabd2cc6a5b26a467e9a2bce19e29e6f1a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121154, "uuid": "a66ef222-8445-4d2d-8d52-f839cce07857", "value": "68C4DF1231489D77E2031CB94C1DD2B229D76D286069E52DB6AE371F15F232613EFA2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121154, "uuid": "d34ad10c-b92e-43da-b563-a6c913833de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121154, "uuid": "b99d11a4-3f0d-4f4a-9cfa-ec39fa9ca687", "value": "12288:PEFVzMFED03P6J+MGoOCpZhdrSxKzpMMioEjL8DP:UaEDhsdNsrSwzpMMitcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121154, "uuid": "f7ef32f1-d4be-471b-8461-10ea4b6ff9a6", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121154, "uuid": "a80df54b-12f9-4791-b679-b7ea96d6da49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121154, "uuid": "3bc8857c-6ae9-4fab-a7ef-d25065144e38", "value": "df75bedbb01fdfb56956fa33a46205dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac33f60f-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134706, "uuid": "fd2315f3-84b5-4626-a25c-05cf8623049d", "comment": "Malware payload (AgentTesla)", "value": "2f0d92842e695782e1e011d670ad5766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134706, "uuid": "4b55d64b-d4d1-417e-825e-fbcf233b920e", "comment": "Malware payload (AgentTesla)", "value": "a4442121fec5c10f6e974ba45b4f387c16e053f145aa19668d15d564759f32c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134706, "uuid": "ad85cddc-0eff-476e-a026-37071853fe02", "comment": "Malware payload (AgentTesla)", "value": "11ca6eac5f8ee1d37741cc4ea105e392fcbbe07c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134706, "uuid": "fa9bc7dc-e2c8-4b7e-bd86-c68ac28c7acd", "comment": "Malware payload (AgentTesla)", "value": "21d30a08f0a9d278b20087ad98ef979717b534a9fc6ea769a3521710f1682fd72a8e55fdf2ba19b4a8bf4f91c1f56b61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134706, "uuid": "ebfbb3c5-8582-4d50-9581-8653b173bd3a", "value": "A345E10BF304AE45C4992238DCEFC2B41375DDDB7C528B0A2E997AEE3CB2652CD51694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134706, "uuid": "564337ab-6417-4421-b271-d4fd2085216e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134706, "uuid": "190bc6d0-f294-4cac-be67-b65bc42902d9", "value": "12288:CiAO9t/4JSO7EhzhVIaM3mxEL1oc29k+Wi4gjtKv7yft0yAvWABhC:CSv4JyhzhCj34bk+lDYQMVBhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134706, "uuid": "ab3d6dad-f79d-4a6f-a448-fbe5778156e6", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134706, "uuid": "87ccaa66-9322-40e9-a945-57ac4bd2c1d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134706, "uuid": "72774809-097c-4b75-826b-a5354d8cab12", "value": "2f0d92842e695782e1e011d670ad5766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347bbfa4-daac-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625171871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171871, "uuid": "e968762d-6df2-47f5-b306-0853e2bfb3f4", "comment": "Malware payload", "value": "6a1c12e0cfa19f6812a968fabd0efb66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171871, "uuid": "314e3734-234e-4130-bbe7-09cfca25e041", "comment": "Malware payload", "value": "a4651a13c5c1ad76aa985712a38891333b3bdf02a46ed619aabcbfcbfd0ddb5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171871, "uuid": "4bc2963b-0bb7-4ce2-b06a-fc6fc90e1525", "comment": "Malware payload", "value": "0be71728831a992e6b0dce57ee4d35253c1eb281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625171871, "uuid": "d931b560-5c86-4070-8338-043b1a97a9e8", "comment": "Malware payload", "value": "d8feb2ac3b8c117bcd683bb82afa319ecf6a91afb1b128c2c142441ffeb63c13c2d3aaf8ac4b1afb432ab7b2989137cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171871, "uuid": "c871c5d0-81a4-4563-8c18-d6e35eaba475", "value": "6285BD02E399C2E0FE6271F3AA15B751DE6B2C25056DB59B1FB43BFCA9301211E1B523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171871, "uuid": "84d86e50-60ff-4df3-9e64-8159b11c583d", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171871, "uuid": "9ded6e9c-2bcb-44bb-9341-bb3c9176cc7c", "value": "49152:6kwkn9IMHeaFk57U0UAojXIEC93tmaPCS:pdnVE7U0FojXIl9dVPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625171871, "uuid": "98235e8f-9f6a-4899-bddd-121215c552a1", "value": 1739264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625171871, "uuid": "b55adabd-7b31-49f7-8300-fa98e69bc013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625171871, "uuid": "437d9613-2632-45ff-bbf8-03fa54931a4a", "value": "TWIPIX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64831ed2-dabd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625179253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179253, "uuid": "58e629bf-5f72-4dd3-bdf1-67414a9ab7eb", "comment": "Malware payload", "value": "8c19e2bf5e1868d026594605f524f724", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179253, "uuid": "69e2ea12-fbde-4df3-ae2a-49219a3f5560", "comment": "Malware payload", "value": "a60b5b60f28039314631f9546b27d9a185e7866c78476cb45a357ca25b75f2c5", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179253, "uuid": "1180e906-d189-43e9-aaf8-ae770fae04fa", "comment": "Malware payload", "value": "d1cd66ec5adcc60fa24a7a9191d90a0b359dab43", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179253, "uuid": "a0ac1026-b6b3-467d-a097-44379e5c1d7e", "comment": "Malware payload", "value": "6c2f2a8256b839de448aba88819a07aa5aa2968533cdcf8b2d106e7dea1816e0bf303ef63212386021eb1c8473c3836c", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179253, "uuid": "ee976961-728e-4ac0-a1d0-80df3fb9bf0c", "value": "A81413C08A017567B0E9841F72DF216F8B623AD4D1B14AE183C724E49FDC6B477B3269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179253, "uuid": "ca077535-666e-42a9-806b-f37812e226d6", "value": "3072:mP+48qSwsB5jmT+PVlRUjMaYOf1s0DmgJbza6XvHhVEcCXH3E5RnVQGM/Mg0iPlE:mmyO5SMzOf1hS6XvHfEcw3ET3MTkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625179253, "uuid": "0af9d4ee-0910-47f0-98f5-3f7779c85203", "value": 197868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625179253, "uuid": "d2655348-67e9-4f52-b2ba-538fa0ee2af2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179253, "uuid": "2d6f6346-82a4-4887-b62d-d90326b0dc66", "value": "afjfhfdhfdhjfggh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595a22b0-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625118675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118675, "uuid": "9490108a-ea13-4b0b-951f-d5db4cc94384", "comment": "Malware payload (Loki)", "value": "0ecc4e55cfe696e62d808a25f00ff3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118675, "uuid": "5eee93e9-7ca4-4f11-ac4d-4d1e0a4c0781", "comment": "Malware payload (Loki)", "value": "a6aaddec76836b2a28fc166f5d61c494fb7646bf39accdd5302fd1d780b629f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118675, "uuid": "bbf22188-a271-4ce8-888e-dbcade67453a", "comment": "Malware payload (Loki)", "value": "7d0bc564ee5bd3603e8fe418cde3872c239a0d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118675, "uuid": "4e4397c5-7f79-4194-b4cf-73e8f3d36cff", "comment": "Malware payload (Loki)", "value": "2d42e25de2a23d90d9b929bcc0f98d51e0444caa3b978ba0986a329bbdd73bd9727a18c68bbf6c01a4fe27a5e7990636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118675, "uuid": "c5bbb067-f01f-41f7-8aaa-2d2ac2038749", "value": "7B35D00BF2059A46C8981538DCEFC2B41375DD9B7C529B0B2E98BADD3CB2712CD512E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118675, "uuid": "84cb848b-1b6a-4aeb-bcf1-7c88755f1a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118675, "uuid": "c945fe6e-a3d6-4278-b85e-7f6a7b10bded", "value": "12288:2bhu4hzhj6IPsN8FWMWbK3Ql0OZR+fBTAWt2aClD+4PQnyfsM8h5:shDhzhJPsg9WbK20EMBSDWtM8h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118675, "uuid": "f229dfeb-4cd1-450e-a97b-98bf1099cc3c", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118675, "uuid": "177d4baa-7d02-4622-815d-a0ff2a512ac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118675, "uuid": "943d3b6d-b16b-4290-b3cf-a8f86ec564f6", "value": "I-190813-010 CI,PL,ISP,BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af06964-da9a-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625164258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164258, "uuid": "d45427a9-b5ec-4672-9b80-7270a8f14c16", "comment": "Malware payload (CryptBot)", "value": "3ffb28f1dd0a08fdadd33089474a389d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164258, "uuid": "fb9f5288-ead3-46ee-8106-c7c578ccd5fb", "comment": "Malware payload (CryptBot)", "value": "a7b337e3217ad0c3a1fcc7186c8865c8511ba4b0fa3d11ce0c7ababdd9c6f88a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164258, "uuid": "614fa29b-e71b-426c-86fc-452860f623a0", "comment": "Malware payload (CryptBot)", "value": "77835ae9f14a69b35ac291fcc52280d7c6d9c39c", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625164258, "uuid": "71308f44-8661-40b8-bb5e-36c3f4ede2d4", "comment": "Malware payload (CryptBot)", "value": "76069212820f04a4ec1b53be8d5b0533a2ee707f23dcf832b5eb79d29365dccd3b652bdc88a710288105496f2facbedf", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164258, "uuid": "f00dc3df-a11c-46e7-871f-d5142c52356b", "value": "7BF412523B40C071C07241709461DA616BAD997256ABBD43FF982F6F2E332D16BE732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164258, "uuid": "cea79617-1a19-42c0-96f3-4c72fa291fad", "value": "ba9b0f2c256a509c08b05c60ed64bfb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164258, "uuid": "36abfc7b-77ac-4e12-893f-dccc6622699f", "value": "12288:jgg35xNdBvq+22gqxe9llHp4yVqw0fIlsPKGIO4hLVBx3t:jn35xNdBvqZ2IlJ4tIlvG54RBx3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625164258, "uuid": "bd8a337d-c04f-4f67-af4d-aabffdccc525", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625164258, "uuid": "be6c8b90-99f6-4e3f-bf97-c896ca75bfe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625164258, "uuid": "4ea405af-1904-4ca3-9be2-a523d357cb66", "value": "a7b337e3217ad0c3a1fcc7186c8865c8511ba4b0fa3d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cdb196-da33-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625119929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119929, "uuid": "ce56b09a-0487-4124-8c32-b7cf84bb9ec2", "comment": "Malware payload (AgentTesla)", "value": "d552e07fe9c70e09d9d75132d8004c8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119929, "uuid": "da0036e8-7af8-48ea-92bc-419384487b44", "comment": "Malware payload (AgentTesla)", "value": "a8d0378ee4cf93deecfd4a82a95707443de28c6ec719a6ffa840182ddf7d18c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119929, "uuid": "36528458-bf3c-4b1d-a813-eebc176694e0", "comment": "Malware payload (AgentTesla)", "value": "509bae2e3e8a2c9abcd2633419b5c12665f6a0df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625119929, "uuid": "506b6929-a44f-46ff-933f-c5bd81e5e310", "comment": "Malware payload (AgentTesla)", "value": "3b2d0cf3a385413f7647f9547b80a40bcb559779f62bb84473ef0103e1c7d3eea9246524060d40a3fd0b04407c7e4578", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119929, "uuid": "b85d2dd6-68d8-4bb9-aa84-4c6cce0903fd", "value": "9DD4127865EC5364D7B2EF7766AA72D2873E7222392FC50C14C1434A8A83BC1DDC6729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119929, "uuid": "ad72d822-e5b8-44a6-81f6-a3fa42f3a667", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119929, "uuid": "dbf3367f-6c26-47b1-8b72-ea237db301e9", "value": "12288:cCEw3DH9JeOogmMRLjXZWVoWqZdlAW/EAptjHYBwlfL1TSD1a:7EwTzYgmMhjXZc7kAW/XttbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625119929, "uuid": "439be543-fb12-4d8c-9978-b521e6d110d3", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625119929, "uuid": "260654c8-4969-432d-b8b4-960d3ae3c346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625119929, "uuid": "46746dec-d432-42e1-8517-b800829cdc80", "value": "UPDATED S O A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab51a35-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625118865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118865, "uuid": "ca5d690d-9d32-4a05-8f5e-8012d9f9e59f", "comment": "Malware payload (Formbook)", "value": "de90e38788b5a2c88d2709074d1d54fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118865, "uuid": "d49dd35c-8ad8-4707-aa5e-fa2947b4c41d", "comment": "Malware payload (Formbook)", "value": "a98ba3cb7eb936b7edcf60262bb5b78f8584af2f7b41423a62f291c804ef9252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118865, "uuid": "da0f5c93-d589-467f-800d-26f916fc178c", "comment": "Malware payload (Formbook)", "value": "f9c101ae2bfc8606f0a1757d83f03e96338f0bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118865, "uuid": "92708c81-436a-439b-995c-005b11f75bf9", "comment": "Malware payload (Formbook)", "value": "497c00c6d9b8fd149fc11aa6d123865f59db20d22121b72e597e10d60a5401b0462b369f915c9569e73b5bfd94a497df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118865, "uuid": "35793006-1d75-48a9-b1ee-5455a9048281", "value": "15E412387AFC1059E37B8F3656F57192933EA2236A16C10D19C246CA4DCBB80ED81B7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118865, "uuid": "8617805e-2efd-4493-a864-c3c26645bf95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118865, "uuid": "e18b6d35-14de-451a-923d-241fae13ee85", "value": "12288:ZwtZXyewdaFahLKUGI7NSdBGVPUeibiaL7c3rO+2GHx7x3FyNY:ZXbaFiGgUiW3iaL7cRhHdx3IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118865, "uuid": "3b967e1a-2177-4b43-978b-0dda14e24e74", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118865, "uuid": "cb5bdd33-8f7e-4443-addb-7b6b6ec35ead", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118865, "uuid": "3ee3eac6-19ef-40c7-bae7-8dd25a6777c8", "value": "swift copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa31f72-da3e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625124618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124618, "uuid": "ecdbcc31-ab3c-4b80-9dc0-4d09fc3573ca", "comment": "Malware payload (Formbook)", "value": "a9a16cf07175a7bb7ba01a5b7e598e6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124618, "uuid": "59d1802f-9a7a-407f-af13-24fc5a4b233a", "comment": "Malware payload (Formbook)", "value": "aadd085a8b6cb80d3cf5375619ec3a498673707bd9ae3f5cf53eeb7c089c3c65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124618, "uuid": "18cbd546-911b-4675-a789-f59a5d9247dc", "comment": "Malware payload (Formbook)", "value": "ee9dfa0947e3199119c1b091ceef2c216edcead7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625124618, "uuid": "a1dd3743-cc55-459b-9df8-dc0cf6f1779e", "comment": "Malware payload (Formbook)", "value": "cebc292deac459f65a4cad71f56dfb199d3af9d8a105fcae6b1e1e2ff3bd7b154b10b365237c44f3c90e6fba075d9d66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124618, "uuid": "bf1d91de-edc3-47cd-848b-82ad079c4121", "value": "92D4D0E029B0C21BCAC04771C4A3B3B837785E5D8A3186C75568F6EE367BB4509265FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124618, "uuid": "822b059e-752e-4315-b1e4-5d42ad34eee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124618, "uuid": "4237ac1c-47e4-4d2d-9df9-ad57ccb63b7c", "value": "12288:dMEFVzMFFSA436XHuhPvZ5L7Zn4JeaAUoEL+oJCb7Z3YW:d5asoHuhZBd4vY7Z39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625124618, "uuid": "23f3a165-e97d-4145-a52e-b4bce1bf2727", "value": 630952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625124618, "uuid": "21b80147-d509-40ed-80c2-0097da7d3f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625124618, "uuid": "f9436a69-b32b-4f71-823e-8e6ce61227bf", "value": "a9a16cf07175a7bb7ba01a5b7e598e6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9751a6d-da2e-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625117951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117951, "uuid": "13f3c2d9-e44e-42f3-930e-c464ccff83a7", "comment": "Malware payload (CobaltStrike)", "value": "370879b160b20c7ce2aa92976f4ee72f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117951, "uuid": "c9d95fe8-21e3-4d18-bc01-58e0546aa5cf", "comment": "Malware payload (CobaltStrike)", "value": "ab1e662e687e0293800456f457071b61b659f4b247583ecfcda1a6584a0b16dd", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117951, "uuid": "6fd0ebe0-ec9d-452c-90c8-168edc771480", "comment": "Malware payload (CobaltStrike)", "value": "0b41256415d0061adcb12fe70249de05845c0cb6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117951, "uuid": "9cf7df79-f889-44a2-a419-586da12dc302", "comment": "Malware payload (CobaltStrike)", "value": "d832477c34054991ce4f5b1a459c4ee16a960d7d0a9573bf76e10a703f83efb7296f57b195073e53a992ced2c1708b92", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117951, "uuid": "f2dab295-ba3c-4ec3-858b-cd27ff6c1692", "value": "BB6423DE050E6BE4CD0DC47596253AE12401190DCB6C5BC912AEA2F32579E2AFDD3AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117951, "uuid": "f52594d3-1f2f-454e-bbc9-5e600db091d9", "value": "b431941c337157e834b54d99a8a6e679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117951, "uuid": "3f7185a1-9122-4b8d-bcd6-acbcb3659b4b", "value": "6144:R3zkdg7QTwC2ixeNVlvKizcSNEGlS3Mq9cmJ5KiKgve9v0uWjk53A5hbfNy:Rx7QTx2icF3ISN/vqbStgLuWjkZADbVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625117951, "uuid": "6265f94b-6c9a-4ab7-b29a-f8535f1c05d4", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625117951, "uuid": "456f7522-5897-49b2-a16f-2712d831e00f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117951, "uuid": "0c1b9991-68a3-49ff-8597-1d9ba4d91c45", "value": "370879b160b20c7ce2aa92976f4ee72f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2425a2-da5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625137039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137039, "uuid": "f62b30e7-e538-432f-a204-baea325c023e", "comment": "Malware payload", "value": "0c9dfa5c8cf346c75da3972b4b80fdab", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137039, "uuid": "338ae35f-8989-4fd7-91d0-c9b0635b5379", "comment": "Malware payload", "value": "abab55c3c2109d14d6efde236c6200bbf59edf9c2edc6d8a59ce6e310607bc9b", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137039, "uuid": "8470541e-8b88-4ec3-a690-3b14be28abc2", "comment": "Malware payload", "value": "63f43801babb94816931266fab02b98b0eabf369", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137039, "uuid": "8291275e-fee2-4e3c-b64d-0dbab7732723", "comment": "Malware payload", "value": "3ef821621d35c4b4d886a404d79e515388a9ea290db1c8062325b17226b1bf36b7381558d1dcf8d785c413320768de52", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137039, "uuid": "29bfd21d-6f36-4976-8e3c-691c821d9083", "value": "D3D20BA4628C5996C542B981B20FBA5D13A5FA9F29CD9D02C7EFF3F33653D4EA903401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137039, "uuid": "df47a79d-8fa6-467c-838a-27a68144c7a3", "value": "384:lUNiNyti222222222222222222222u6otHAHJrO4ti2222222222222222222224:lsi8t+hmrO4t+hmrOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625137039, "uuid": "82fcb6f8-7957-4fb7-8ee9-3d06d20c3658", "value": 28492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625137039, "uuid": "2b1ab734-09a9-460a-9d9e-b3b303c287a2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137039, "uuid": "95b6d816-a878-47dc-a5a4-7dd63ff118c3", "value": "CARTA_IDENTITA.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dfe3bb-da7b-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625151152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151152, "uuid": "c34b00c2-2543-47e4-9cf6-ac6d80138fc4", "comment": "Malware payload (AveMariaRAT)", "value": "0de04896312059da5e706416636ce15d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151152, "uuid": "2c0ac6ab-9416-440b-98d5-16136629768b", "comment": "Malware payload (AveMariaRAT)", "value": "abf24499470a3d16f45c1b747820a07784a1f98a5e29b2eb8414adcefe83012b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151152, "uuid": "9728167b-7272-4358-83a8-39c06685e38d", "comment": "Malware payload (AveMariaRAT)", "value": "d4b032118b54ef9772898e3db50c7524fbab9714", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151152, "uuid": "be53a80a-261f-4f21-b2df-5f9fc831925a", "comment": "Malware payload (AveMariaRAT)", "value": "31cf313be0b091fb2e87796b74964c23504a6e45827f8f5828d1bbe9a4aa0c1b20ee0621f8bc82e60eb547f01b8cb017", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151152, "uuid": "ecae8d49-75b5-4151-afae-f0341576bb46", "value": "8C35D00BF248AA45C8952238DCEFC2701375DD977922CB0B3A99BAED3C72715CD553A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151152, "uuid": "46ad0578-df4d-4436-b866-f525200092f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151152, "uuid": "19b6d46e-5a95-4b19-8b4e-581fadf4989f", "value": "12288:mAk180WioYjxon0TfhzhjbUyyj1i4X5XOotD4SxpHaKvfhR:mAk/NWkfhzhPUTVOotEST6ifhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151152, "uuid": "f0c71761-6122-45fc-b8a1-21fbb86ff051", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151152, "uuid": "e0c3bf79-2811-4a80-baad-3dc1b4e0df5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151152, "uuid": "f00528d1-61ba-43ee-a5eb-5d645eda844c", "value": "Bank Slip_SC -038-20210303-B.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5309156b-dabe-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625179653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179653, "uuid": "e5d0b41d-2a0a-41c6-a69e-8819a67b9b1f", "comment": "Malware payload (CryptBot)", "value": "987d0f92ed9871031e0061e16e7bbac4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179653, "uuid": "b2fa3ccb-3ebf-4365-aae7-3f45321dc8c4", "comment": "Malware payload (CryptBot)", "value": "adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179653, "uuid": "4cd2b640-5b85-4876-ac78-9426cafba6bb", "comment": "Malware payload (CryptBot)", "value": "b69f3badc82b6da0ff311f9dc509bac244464332", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179653, "uuid": "9663a3b0-c644-4e56-beea-20af1a9f4553", "comment": "Malware payload (CryptBot)", "value": "cc9b11fbf24f6460d5cbd373d380bffb45a9f910f9e91dd38b076e5ca97b4620d600be2286a95d57abda525cf312e783", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179653, "uuid": "221aa904-acf8-4cb6-be92-c3b98dfa45cf", "value": "0AF49E20B783E071D8A204F559B9BE6A947CBC1407289FFBE3D43E5C49791C15A32E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179653, "uuid": "f7ffa49f-fa3a-4ce7-8069-181e7c900900", "value": "9b239827ad94cf9e43aed2c8aec6e783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179653, "uuid": "094ca9be-d409-4ae4-bfa5-c5698bdbb208", "value": "24576:guuhBzW6ZEaA9WipcnEsbsX0GMeVTwLWKEq:1gzJG6EVT+Wlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625179653, "uuid": "3195c863-2b41-473e-9ac1-5d92cac03809", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625179653, "uuid": "16d1c71c-b6cf-4fa0-bc96-02e287bf09ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179653, "uuid": "92233965-669c-4450-893e-2c7bf8e24ca9", "value": "987D0F92ED9871031E0061E16E7BBAC4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615664f0-da43-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1625126849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126849, "uuid": "e6dfeb1e-0c36-4878-8eb5-f438262f218b", "comment": "Malware payload (Heodo)", "value": "5bb737dfe97cebd04f56165dc7ffbb99", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126849, "uuid": "2fc2ec38-de3d-47d8-89d0-a422007fd2be", "comment": "Malware payload (Heodo)", "value": "aead53d435ef092724b8b034e1472b9391e0bd1d742f00fd39a1dd1e7cb5ba06", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126849, "uuid": "db421358-afc3-4ff7-adc6-dfa1449ccc42", "comment": "Malware payload (Heodo)", "value": "06cf84d29627d690f1b026570ffa00b26b1e0940", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625126849, "uuid": "06aab4c4-a070-428b-ba95-38753bf04dfe", "comment": "Malware payload (Heodo)", "value": "97081d64318a0be015a4da10f79c1f1d1d04db495e8f14d700ede3e7ced50c63fde0b68471732225b4a35d6872ff1c81", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126849, "uuid": "3a5cf3a9-679d-426b-ab7e-4129890c3e7b", "value": "F9C412D07968E69BCA991EB0AC9693711B726C2C5DC1A30B74FFF34D26B23D2050A74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126849, "uuid": "bcbc7303-f009-45bc-9f23-c0c167495f83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126849, "uuid": "bed7c99e-0675-45e4-82aa-05f6f4c72694", "value": "6144:TdEOCtVzWvwtcxLTnU456vwucaCVDkELPaggALguP5C1zGReHpAUtptwFIsSDi/M:BEFVzMFTWHZmXjgA3s1q8pJQp9/bvqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625126849, "uuid": "d7722ebe-7c58-4fdf-ac8b-6b91a18485c3", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625126849, "uuid": "5eebfbc8-170b-4dab-944f-cd659cebe4e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625126849, "uuid": "ce4c8e74-32c0-43e2-a133-027ca8c9b0ab", "value": "edited_DO1916.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10e09a2-da88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625156645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156645, "uuid": "587a1bee-e274-4bba-af3a-166f32f1f57a", "comment": "Malware payload", "value": "b66f29b3b4c56b8167be64f48bb254d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156645, "uuid": "b37af598-f175-4de2-8b37-31b90b85f9c5", "comment": "Malware payload", "value": "aed3e00e61a8e18e7e4b94c5a164677d7dc9769b640c4d5703cfbd245f8cf976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156645, "uuid": "fb1df246-e723-4c4c-956d-f4bb0e28ce91", "comment": "Malware payload", "value": "474c0e04929d4a6985dfa6e0d81a145532805bde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625156645, "uuid": "f09117cf-b198-430e-b36a-7392784632c2", "comment": "Malware payload", "value": "6fdd14ad8c9ee6ffee8d49b0a26dafecd9024585a2d6a43b0fcc7ead2fa9b3b6074a0ebfe767dee8a3248ff284fd8d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156645, "uuid": "88aad3a9-f3fe-4e81-b773-fafda3ac67ab", "value": "06F217ED8B4E05D2D13FF230EAF435024739A23D2509863F94A919C39A8A7D1E7E116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156645, "uuid": "1fc8159d-23b8-418c-bd95-6cdcc5debb10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156645, "uuid": "21356103-9b75-430b-94e7-2e809bfef04b", "value": "768:LC3KHNQRnPfSBrWfIEmCUhRzzUZGfl03TQk48hyokoWh1:W3KtQRyyX6RuX4lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625156645, "uuid": "6780076e-2794-4e60-8cc4-bfe59aa16402", "value": 34544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625156645, "uuid": "a1a6a137-d6ad-4757-8b37-69abf17935c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625156645, "uuid": "ea6103f8-d547-405f-a6b9-d3ff7a847fb8", "value": "Wire payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23abef30-da84-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625154663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154663, "uuid": "765c16bf-5f21-4d21-869f-aa30a0c5cfc2", "comment": "Malware payload (Vjw0rm)", "value": "8f5e8de1f67cff6eaf2842d8a9d38fa5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154663, "uuid": "0fb27148-ad64-4192-99fa-ad28338270c9", "comment": "Malware payload (Vjw0rm)", "value": "b021b6f11e1b6ae8110693f27e0d1f638b1d7ec2e51b2f74a17acf29bf457190", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154663, "uuid": "17a36f88-2fa3-4136-9ab2-ebb43881d745", "comment": "Malware payload (Vjw0rm)", "value": "73c5d2068856ddd941e75ae3dc15879821552276", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625154663, "uuid": "d18dcb41-0c31-4e32-b45f-07c2a090ce70", "comment": "Malware payload (Vjw0rm)", "value": "ca3072684e105cd6b7157159909783da2bd6f84145f6318668a4b78497dede11a450cfc75caa0d1cae68b991af6aa7eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154663, "uuid": "aa802659-3c17-4c5b-8e93-16815aa568ae", "value": "7E81119C284B863C53D27B8A802DD148CDF548B47E28D2B5148CDAC5360EDB9C7B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154663, "uuid": "fbff4500-8f43-402d-abbf-54c2c314aae3", "value": "96:SABNo5DLk2c24ZRMHXE6/BID+Ys+fJfIDdQqR7bJyKhBOS4UK:zSc2c24ZRMlBIiYs+fJfOfRfOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625154663, "uuid": "ff27fcda-1281-4ebc-9d36-284d1177c43f", "value": 3874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625154663, "uuid": "f1d00e08-f80d-4eae-ab1c-0a7aa3611809", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625154663, "uuid": "958ddb9e-9996-4c16-a343-ba8ad88e55e6", "value": "Inoice #022392.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206501f8-da7d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625151651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151651, "uuid": "33289444-566b-41ec-9424-f6401a77c867", "comment": "Malware payload", "value": "ab8c37489dc40216f3246179d4289bb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151651, "uuid": "96694d1b-9bdd-4afc-80a5-7d2a7fe37e97", "comment": "Malware payload", "value": "b09cafd97a01e079b28616295179f5ee5269b5f24b8bb25e4fa15625729077f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151651, "uuid": "490009ec-319f-4d1c-b199-da77fe1a4d10", "comment": "Malware payload", "value": "d53b7f8fb9d94f9d7c3e0bb25e568c7d45085cc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151651, "uuid": "f781616c-22cd-4f7f-b0e7-98d50ffa8958", "comment": "Malware payload", "value": "fdef8c0cf6cd8ab92c34cac8a19cf39ffaec7efa813e030e86a09e1096540bbf180cd7f9f4567c6424b7163e27135204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151651, "uuid": "e170f028-b065-4067-87c0-1d46c8e41aed", "value": "F09447E595D8FFD7D1BB22712EE4B6004B634B5928148644ABCC651F3B226CF2782F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151651, "uuid": "34a6b65a-6b81-4468-8792-b8f20ad85d8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151651, "uuid": "cfda7ca2-eb79-44dd-b47a-2818f26e1b4e", "value": "12288:Ddn7pFQ46n3YmKXXxifA8KvnbpHXuC+WnyM56:NQ46noVio8Kng9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151651, "uuid": "c601cea4-0f0d-4c32-a3e6-361f7b93404b", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151651, "uuid": "5ad8e004-dc1d-43e9-90fe-6e10c15aa8a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151651, "uuid": "b11b9769-3b52-4bf0-ab23-6d7ce6fb9344", "value": "ab8c37489dc40216f3246179d4289bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccffe02-da68-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625142948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142948, "uuid": "3f1f9efd-6405-4289-8da0-85a6cc9a96b1", "comment": "Malware payload (AgentTesla)", "value": "ded7729e03e0b44db550529e4872b334", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142948, "uuid": "f102c671-17e6-449a-90c4-15761db6614d", "comment": "Malware payload (AgentTesla)", "value": "b1dd71be684f65897eafa065803b1212a443f5de52bce8242c3136b40ea1e9ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142948, "uuid": "45cd039d-f437-4339-bd05-b80116212390", "comment": "Malware payload (AgentTesla)", "value": "22920b381e7bd8655337b5b5ae40884aaf817231", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625142948, "uuid": "5aa4b2c5-8584-4553-895c-fced3d92b04f", "comment": "Malware payload (AgentTesla)", "value": "3cc221a9f660bda4bd36d889b294e749bf7037f10c61c30eb67888ed9cfcfadc2d650a8597a1477bcb6af7f1cf33e03d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142948, "uuid": "656b9048-4a50-41c7-9621-bf8dcbef3b7f", "value": "5445D00BF705AA45C5682239DCFFC1B413B5ED8B7C528B0B3A987AED3C72652CD512A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142948, "uuid": "38ebd42a-4c42-46bc-9e59-12c1fc278da8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142948, "uuid": "6b9cef68-5feb-4b8f-a8b6-42e8540b39d2", "value": "24576:Y/gJhzhpLb71W75tUkJanTfGQgsVWCLlQ4h5:Y4Jhzh5b71ettyVgoO4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625142948, "uuid": "362e42a5-1a4b-435e-91d5-b4c9091dd0c3", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625142948, "uuid": "19fe8de2-a662-479a-9144-30788af085ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625142948, "uuid": "fe29c90a-74a4-4d22-b194-ebf6dd5a2f99", "value": "184285013-044310-sanlccjavap0003-7069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fab20c-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134690, "uuid": "9f209ed5-0c84-41ee-917a-64e287838e36", "comment": "Malware payload (AgentTesla)", "value": "c9aaa8eb7d6d3112a5621a7b9cccdb9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134690, "uuid": "f0f4f86c-74a5-434e-88c5-67f4d0a50e20", "comment": "Malware payload (AgentTesla)", "value": "b1f257789748f730c5049aa47653680a1297a890c7ba86f8f914869b66249664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134690, "uuid": "99106e86-f015-4cd7-9157-3974b68d8b1b", "comment": "Malware payload (AgentTesla)", "value": "f5473407b6c450c8bf7d9b2eb117f4ca03590e57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134690, "uuid": "94963398-9e4a-459b-b4a2-845e0e118634", "comment": "Malware payload (AgentTesla)", "value": "af64be5e28cc15a6d784d92d27ac904ba969e518057f45a5e74a6009ac7c7ff68acdff8f9d180470c6c41b709d31bfb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134690, "uuid": "0e571335-c200-4369-b9f7-0826a7fd72aa", "value": "AF45D00FF605AA45C5A82138DCFFC27413B5ED9B7C12DB1A2E987ADD3C72652C8417A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134690, "uuid": "dd56f803-7c2d-43a1-a450-c1336c6ddb06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134690, "uuid": "32228937-f1ba-44c6-9f8f-dac5202c9bd9", "value": "24576:+DXLOIBghzh7kgqVLgu/n048e17foRhR:UKIBghzh7dqBgub8Q7fIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134690, "uuid": "f2625605-b203-4c4a-b4a8-5b38704f1d4d", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134690, "uuid": "86481333-a685-44b7-a3e5-5ff52bbd6820", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134690, "uuid": "50ebf56a-c1f6-4404-8b89-415872b9d0fd", "value": "c9aaa8eb7d6d3112a5621a7b9cccdb9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e22eeec-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625118710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118710, "uuid": "3d392508-6671-4326-a0c1-7b8de832ad01", "comment": "Malware payload (Loki)", "value": "24a7897ab472bd1228a67a4a0bb6a1bd", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118710, "uuid": "d0ff7160-14e9-4033-a8eb-74b62d977eaf", "comment": "Malware payload (Loki)", "value": "b232686d3a03aba48288942b91ad3b20107000e4e615816313f0a30dd9ba565a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118710, "uuid": "6aad1a35-5b1a-419d-a5b4-70500e1040fe", "comment": "Malware payload (Loki)", "value": "6f6b4a80764117f7257f622ebed44974e80b9f74", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118710, "uuid": "1204eb84-9c78-4046-9eb2-a9ae0899df72", "comment": "Malware payload (Loki)", "value": "3dc9487cdafec398b82da73269f5e01295467bc8be1f87109745c424e4271a39be5763a36fb24aced8e0efda1d5bf446", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118710, "uuid": "937fb118-e230-4c37-b7db-5d5076d9aae3", "value": "F5457C206AF84629F0BA9F7E95B4111557FDF713AF13C95C3CB911CA0723A42CAB172A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118710, "uuid": "2e86b224-b60e-4582-a777-5ef9f02cc5c3", "value": "12288:wjk3BbX5Tybcvn4B862XTBXbm/aaU48oXqdMbCKMlCEjxuM:qk3jcd2Zy/aa5FyKMLNuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118710, "uuid": "34a3c94d-4b15-4cae-a50f-b4333a454665", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118710, "uuid": "1d75b394-6988-4023-a833-3e507bfeed71", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118710, "uuid": "eed5e48f-bf76-488b-b116-d343cb41d5b0", "value": "Revised Order.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211f8321-da7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625152082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152082, "uuid": "951f5548-e941-4f53-89d6-f786512458e6", "comment": "Malware payload (Hancitor)", "value": "e419c5708eef84f99a38bbb977297c54", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152082, "uuid": "2fd90f56-4194-46f1-b389-968955f9194c", "comment": "Malware payload (Hancitor)", "value": "b2921c1f4a8bdae171c6a3e122d4b2f9cfe28f9ab7bc1d3096dfbc3eb4cd8839", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152082, "uuid": "0aa568f4-2546-4378-a57d-94ce671a33d4", "comment": "Malware payload (Hancitor)", "value": "bd34fc68d4f2ac25139e5117feea78d469676c2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152082, "uuid": "9a34fd15-7e20-4ca3-8e04-ab9480f9e4c8", "comment": "Malware payload (Hancitor)", "value": "656725cd5623c8b030faefa8eb5bab318c3fb26c0d3c2bcd6bfedc7a5b3d92565039c1d3e09f4ac011e258b23702c911", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152082, "uuid": "0ace37b4-d8b6-44e2-aa73-3848fc9ee3b6", "value": "F0B46D23F2914837D13766799D5B92AC9C2ABE007D24BC4B2BD42F4C6F39781792B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152082, "uuid": "e821f6e2-5da2-4d03-83ca-d7537c05759b", "value": "d71cd63d35a7301b9b592007d038621f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152082, "uuid": "733d91a4-bf9e-434a-b34e-3c7e85a07e1d", "value": "12288:Kf5NGH5+nA+R7L05les5ZlUEKoQN3e3De0:2wZ+V7w5lesFUsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625152082, "uuid": "55eaa664-1c28-4281-b5f4-07d4f1b8cee1", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625152082, "uuid": "1f858a0e-9891-4d81-bd02-0baaf77a0f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152082, "uuid": "de562979-ce25-443d-b375-0377a8bb4e29", "value": "nimb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc221e6-da72-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625147053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147053, "uuid": "9da79402-53f0-41f0-81bb-203dc0a4c6fb", "comment": "Malware payload (AgentTesla)", "value": "06fad614300b1d987c571fd83e27a783", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147053, "uuid": "9265f824-db63-40d2-a04f-e1473e168043", "comment": "Malware payload (AgentTesla)", "value": "b431ce5dc4ecd3ca9efbce074bbe8c85602765dc2a8cf98cc3765f6298f71569", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147053, "uuid": "e1477ed0-9c3e-40ee-b9e3-73f47b622e5f", "comment": "Malware payload (AgentTesla)", "value": "0bc7a24116aecf2b305e874edccf5d2377e6a5c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147053, "uuid": "70bcda30-1bf7-409a-a8a5-37664082fa30", "comment": "Malware payload (AgentTesla)", "value": "979b869d667f9e8f2a30b92690cb1a43ff84ffaafc1e5187ab480a5f09cdf82de44d03eb355f1bbb8bd7da98b4be2bbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147053, "uuid": "b074f86a-f38f-464e-b12b-6580ef87e706", "value": "BF45E007F6499A45C8952238DCEFC2741374DD877C238B0B2E997AEE3CB2726CD516A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147053, "uuid": "4d3f3d4d-2d7e-4ed3-877d-8aec3941562a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147053, "uuid": "44f53e4c-2f16-499d-a444-0a4a23867432", "value": "12288:9+hzhvBu+lJmJuQrPBNUFI/A/ThLBiRKhPZMPjY+AWqi/EJoqDfh5:chzhclJuQrPibhLBSGZMc3WX/Ey8fh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147053, "uuid": "59cb3239-fc20-495e-a882-f797a5730b49", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147053, "uuid": "806e40fe-65d6-4dfa-a581-a72ccee76e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147053, "uuid": "6aafae3e-1a54-415a-b536-3be55744a0c7", "value": "SecuriteInfo.com.W32.MSIL_Troj.BEJ.genEldorado.5051.77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d31f6b-da48-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625129106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129106, "uuid": "dcb7c391-885d-4e59-b4c2-44b6341b0832", "comment": "Malware payload", "value": "db2f659dc03c430d809eff66e99c42f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129106, "uuid": "427d070c-8f75-4a3a-87cd-2388ebefee40", "comment": "Malware payload", "value": "b4949bab111ac8d8e02355953e179e395541d5dfcc23682d60efc7499074018f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129106, "uuid": "c0461333-f5b1-4ba0-acd3-a909179cadd6", "comment": "Malware payload", "value": "20a0717d74426902a7136e1c026aef6ecbe6d064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129106, "uuid": "5cb7599a-de83-4388-9417-48b91f4f477f", "comment": "Malware payload", "value": "c996268e5eaf856fc1faea08f460cc92b9baaec2615b35c431a89fce6c5727b5918d8f9aedfe119659c9e405658b8505", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129106, "uuid": "bf5ad47f-b750-4611-8653-ab3e675c4561", "value": "AF462363075921C1E5E5CC36C5B3FDD471FA076A8A42A8FC55EBACC23A214F4F252A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129106, "uuid": "86e52e33-c032-428a-bf08-1389517a35a3", "value": "7fb05647d0537b5b517720efafc40fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129106, "uuid": "37aa68ae-6ee4-4105-85b9-1c2dc363072d", "value": "98304:NFlS9ZuvFerXLR4pHitnG7Nvg/cH7vEoxAC/tewIOjmuCJwmQCQIJb8g:NXogFerF4UtnQvgUbsaAC/cwc5QCQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625129106, "uuid": "d007e2df-f67d-468d-9e5f-e800acaee8c4", "value": 5706240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625129106, "uuid": "0fc54c0e-bf83-48ce-b7e7-f9a39f9da9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129106, "uuid": "1da60a35-d7d6-45a6-9e4d-edc0e94e97ff", "value": "db2f659dc03c430d809eff66e99c42f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48080615-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1625122941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122941, "uuid": "0de4cb25-f7d7-4f0f-bdb7-baf6e3b2e0e8", "comment": "Malware payload (Neshta)", "value": "b85c927551c382c49160ba4ec5737338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122941, "uuid": "13f5bc64-a474-4325-97d9-e776efecdd1e", "comment": "Malware payload (Neshta)", "value": "b4e70946128b7c45e4e6404714ca40df679ed0b6ac5157533c953196d96daa41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122941, "uuid": "ecc5493f-09b1-446f-8dcf-3d571a252fc9", "comment": "Malware payload (Neshta)", "value": "7232fd3128ec2f0d49d61be7384f2e4858c7b9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122941, "uuid": "fbc09b53-12b9-4e0c-bc0d-4ea0c4335796", "comment": "Malware payload (Neshta)", "value": "a588f35c0a3f55663053c598dac9a6546d14f851354923793e7ed79f25a1413aeda4d34b8867f3ffa5e982b08182e55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122941, "uuid": "5ea271a9-4db4-46f7-9305-a313458d3e13", "value": "C4E412242EEC8766E3B34F766AE0B482C77DB922751FD91824D392460583B81CED1B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122941, "uuid": "6f4540df-56e4-4a7b-b3e2-eb9c0cf403a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122941, "uuid": "a29f10ae-e291-42be-b485-43650dd033f6", "value": "12288:ehKbvZ48GArn8nohXhwiBfb2ep4s8g6YJPAP+I+4mlscxz39XrD:4K9MAT8oThtqed6Y1I+IWscxzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625122941, "uuid": "f1cc698f-c9c5-4cfc-af66-630f5fb4f2d3", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625122941, "uuid": "3f185803-726d-4008-b05a-d90c48b65045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122941, "uuid": "109b4e35-b953-433d-a564-a654d14fc7d3", "value": "b85c927551c382c49160ba4ec5737338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eece90b-da5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138951, "uuid": "6f447e81-0bb7-43ee-b388-6412acd99baf", "comment": "Malware payload", "value": "16ea4b8305fa85e18286ab7efe1eb750", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138951, "uuid": "656d7565-7347-42d6-9756-491069aaf0c5", "comment": "Malware payload", "value": "b5e3209b54fef0909ab07536167fd69a660d5fe619da29e62a75e7dd2a8c0328", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138951, "uuid": "da95c9ed-f7c3-4bbd-a0dc-ddc9ecac7be7", "comment": "Malware payload", "value": "de868ec0b51624c38a00b189cd9919d9e19f6545", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138951, "uuid": "378ab8f0-554f-4599-8d2e-a9bac3f68ff5", "comment": "Malware payload", "value": "050dd9228c60ee7157e5d8662bd2ed0b526717b0c74f9673ae90fc8578ee3eb351ebafc4ddc21f14f1bb7f9757968fec", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138951, "uuid": "60c07311-4f03-447e-a7a3-1b5a00b3603d", "value": "71419BB36A0ACE4ED9654DF194CBB04BD690405AADF8CCF26FB1CEAADC516FD1230181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138951, "uuid": "6c61b1c4-4c18-4efa-b7b1-782f66b1d360", "value": "24:YpwAMYCal+GoG7f8G1V6GXGVc6Gg76Gz5u6GMn6GV+z6GQpoHJqQ6TYoamxxtBqo:jF3ald7f5OLD5Jh+gGKVamnbGZAim0AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138951, "uuid": "b5b12bf1-930c-4143-a434-8e8436adc2e0", "value": 1939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138951, "uuid": "10d85f83-fce1-4897-b5ae-bcdf5ab7c35c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138951, "uuid": "3fa2680c-5577-4380-8647-01c637aa50b8", "value": "prova.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cebf17b-daa9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625170731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170731, "uuid": "51a6a075-8e4c-4181-8fe1-62f603f5842f", "comment": "Malware payload", "value": "f6c4278b03536cb8d5e1326f7abd8137", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170731, "uuid": "7227c160-c908-44ff-8efe-b4e3cec4d060", "comment": "Malware payload", "value": "b5fc662dddd17b1e9b4ce76c7c40d94d9cc58b7b39955ea189582cfdce77f79c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170731, "uuid": "da073f43-e05c-426e-b5f9-5acda155fc38", "comment": "Malware payload", "value": "55df02389e6b56c67e6fe216ba67b5ee503c21b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170731, "uuid": "8c724f0f-8dad-402c-93c0-8fbeeca627ed", "comment": "Malware payload", "value": "e71478bcfb72c166c976de1569fe5cb5fbfc1fbf63036ec3114f95505866552f9d5b5c6577d7ff131284d95697868779", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170731, "uuid": "83fb4fa5-b0bc-496e-b136-d27b0856fb14", "value": "31F4EF433141D3E2E436C4B2756B20021B69BC3F47864DD6719BBB245AF64A06B2FE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170731, "uuid": "a738a8fd-6c4c-4c38-85e4-d2cece6b07f4", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170731, "uuid": "20eeae08-915b-430e-97a9-2d3b07c4b94b", "value": "12288:Y9FsOnNN/LPWq5tvKar30+CVYS7NWCss/+MrDVXUCOf95M8ErMvxaV:0sONNVyartCVzsXMrDVXYfoBrM5aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170731, "uuid": "328095e9-9de2-4ed3-b25a-c24b2a5e1767", "value": 792951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170731, "uuid": "795dd68e-54d9-46db-b90c-37dd0bc41ba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170731, "uuid": "1a932b2f-7e8c-4487-a5be-89935e6fc5b2", "value": "f6c4278b03536cb8d5e1326f7abd8137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493b41c0-da9c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625165034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625165034, "uuid": "74903fc3-e8b0-4107-b581-dc972c11e9f7", "comment": "Malware payload", "value": "4f7c4d3e8179a241a66b000ae0e2c303", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625165034, "uuid": "05e513c3-df76-4f25-a0f2-e1fec2455ee5", "comment": "Malware payload", "value": "b77d036cdfa100f7df029c46fe7b33adfd3569ab26e853f166ad3c7a99c024d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625165034, "uuid": "80d77c1e-e95e-448e-944d-d50a87e7d6eb", "comment": "Malware payload", "value": "3dcbdb48a53560855d0176e5a35aa68a83bd086b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625165034, "uuid": "e4bfdff1-1305-4d26-aefe-835659907e7e", "comment": "Malware payload", "value": "9ba775798cf794471e8a7a86d3f947a9b175d99e39c60be037001d56d1f283cab3954ac06660b4a46e83e8b55a1eaf7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625165034, "uuid": "9b8530e8-db13-4e5a-a603-1e779b8216ff", "value": "7E3270143392DA32D69C993F0DDFFADB77A97C43AD1886973384735E1CF8A10891261A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625165034, "uuid": "673fc3c3-78b0-4ae3-bd79-a6054ec68bda", "value": "96:c28vUj7NNDPsjbIJv+pl6ctumwRq61vl+39cjM28Dlt+5uInCSxaJi:T/uWWpl6ckFRzSZLltMnxxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625165034, "uuid": "abe3d120-3507-4cb6-aa1b-76a0fca38d4f", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625165034, "uuid": "7835ffbe-fb54-4873-b850-687a1c40b4e7", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625165034, "uuid": "51195405-464e-44a1-b19f-05957b4a6935", "value": "SecuriteInfo.com.VB.Heur2.EmoDldr.14.D9F97346.Gen.16354.9176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889534f0-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625132498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132498, "uuid": "2f5deae2-892b-4eff-8899-e5f70144fba0", "comment": "Malware payload (AgentTesla)", "value": "fff312347c03021523c229c21d4367c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132498, "uuid": "56fee1b2-172e-4fcd-9ae5-1d96e2341b64", "comment": "Malware payload (AgentTesla)", "value": "bba61d5e175158757aca8e919d25c311cecdd54599aa7955577926033d753101", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132498, "uuid": "9c8f017c-8566-425f-8af9-558884c478da", "comment": "Malware payload (AgentTesla)", "value": "55c77fcc8e9b37bc01ad96d070d6f8424f985f41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132498, "uuid": "b626bc46-73dd-4825-a6ed-3dcee94cc1a6", "comment": "Malware payload (AgentTesla)", "value": "895f1305b25652ff6b5e1c55ec6b2e1e55d3416cd7817bba8fa3c0ca7e6a32c73e61e055b639027b23b0f312ed290ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132498, "uuid": "001bdf7d-fa97-40bc-95d4-ff4fad77431b", "value": "EAA1B37543785AD7DE1780BBC6B4FF9101E2F22AC4CB1A40772CF9F04B5B385A96A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132498, "uuid": "f5b680cc-52cb-476b-b11a-f7e7f6148a11", "value": "96:37ZDxq+pkjfhk7Ud2C7lOa/4tzayBI+2/unsrNMhctLT9EUBMVcgnQG92NOxw:rl9kjxbQzpsxxRacGrnQGYNOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132498, "uuid": "b653f9dd-db4c-4a96-8632-0e08b761a287", "value": 4829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132498, "uuid": "42b2237d-22e4-4210-a79f-3102a3c2cd31", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132498, "uuid": "566f04cf-974b-43ec-a6f4-b5269fd88727", "value": "RFQ SS PLATES - SA240 Gr.316316L - ADNOC AVL - MIC-00417.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddcc21d-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134843, "uuid": "3186c825-15fd-4147-a3a9-fd3fa4305866", "comment": "Malware payload (AgentTesla)", "value": "87d9e4b0c1603cd2f33c2df5a1216faa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134843, "uuid": "1d57d362-7d19-4771-a712-1297d1373466", "comment": "Malware payload (AgentTesla)", "value": "bbebcde67d1cca2b1c7a02832596c5e73bb4db6f98195e778242ca3ed49e5dc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134843, "uuid": "1bc0bb90-4de5-4a0b-b240-c8cc6f69e532", "comment": "Malware payload (AgentTesla)", "value": "dad608a860da7ea87db34e251a3aa398dd6970bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134843, "uuid": "bc5e1170-1e37-450e-bbcc-4d5a9bb79e86", "comment": "Malware payload (AgentTesla)", "value": "cc71049aab4e0ad0034acff4457411186a0bf441b2e4f48fa355fd9dfb6a92fa54c22672df8679b3c5462c8c81256bed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134843, "uuid": "231fb468-2c1e-493e-bb57-8eb0489e345f", "value": "F635D10BF309AA45C8992638DCEFC2741374DD9B7C528B1B2E957ADD3DF2712C8452A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134843, "uuid": "5d49afba-a8cf-4c35-a310-b09f83387934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134843, "uuid": "49e672cb-787f-487a-924b-d56288e3d811", "value": "12288:DH81hzhaNBP7a11uxRrSX3uOZHiznCIMB4dpy1MPY35hp:zOhzh2t+4YXZQnrMBiPYphp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134843, "uuid": "b576e3c8-ddf6-487e-af9b-3bf5d85544b2", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134843, "uuid": "52a8a828-660b-449b-bab7-5a0a7257af71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134843, "uuid": "b212cbf1-42c4-423a-bf95-0339481f23e9", "value": "87d9e4b0c1603cd2f33c2df5a1216faa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29926779-da74-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625147801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147801, "uuid": "143529e7-61fc-41ab-9b90-3fa253f300d0", "comment": "Malware payload (GuLoader)", "value": "9b2319c2dacfbfbfb953265bb08926cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147801, "uuid": "e4f3e160-cdac-4239-b6f8-02f3d04a3257", "comment": "Malware payload (GuLoader)", "value": "bcf08bd75a4016dab6b39ad63101a8e5daa5cd309ee9162374d65dded2d48dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147801, "uuid": "46471799-8ffa-420d-b358-bfc129f89930", "comment": "Malware payload (GuLoader)", "value": "db6ae49893b688cba106682df4e30c2e34823fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147801, "uuid": "c7348d78-c5fb-41bf-9682-6207dd30345b", "comment": "Malware payload (GuLoader)", "value": "b86f151e4aadeb10ef8bd4cdaaa75e0e0ab6d230f33dd732e77bd47d28607fec7398f1b65c103ab2ee9db378568a1c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147801, "uuid": "22e0d2d7-f009-43c4-9415-74bfc4923093", "value": "EDB46C3223CAD931DA2B5DBC8389D445B9A62A3AD713E1992BCD02C99C4D740CFF87D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147801, "uuid": "d04c98ac-5b4c-4cda-aad8-3489425fb261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147801, "uuid": "bf9b487a-70fc-43d7-951e-ec0079b7037a", "value": "12288:I9s9GXXlVJU0eqpWsGFGC7Smx5cxA7t3zoDiXD6v:I97XXlPU9qpFG8CumhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147801, "uuid": "cca4498a-086d-4de6-9b9f-1af803f95bca", "value": 496440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147801, "uuid": "973f0c3c-247d-4f40-83a4-b26334ee3efc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147801, "uuid": "23e4cf7f-cbf8-46da-b76c-11b7ed10fd02", "value": "9b2319c2dacfbfbfb953265bb08926cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ae14c7-da5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625137050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137050, "uuid": "934bcefe-e368-46cc-85a4-183779f655fa", "comment": "Malware payload", "value": "df5e3823543141aee816047e93c5c21c", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137050, "uuid": "1c4c5572-7d13-4163-8326-46ba5672f0a5", "comment": "Malware payload", "value": "bd63f098304c316749c2b49726aaa7c5af4c33a4de7a5049e32587491c21a113", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137050, "uuid": "a7b4f2bf-7f58-4920-8bf2-b6839ac258dc", "comment": "Malware payload", "value": "35a22dd1228e44c5499277a49e364aa62e378448", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137050, "uuid": "e14ae2b7-f731-4725-ae76-dc1fd859c9e5", "comment": "Malware payload", "value": "f39edb25a50b9a5909386d5cfeac703a82b0157901ed7c327351e9ca71c4461571d17109b29dcacc8edc6b284d3ec6d5", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137050, "uuid": "e3bf7430-b7a9-4e5b-b759-27bbcc951d65", "value": "8631D821842FA676711CF1D83A48BCD466A019142587AC90C25D6D8AF451471ADEFCA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137050, "uuid": "9f51ee2f-0ef9-4688-ae7e-7375aa7a9a89", "value": "48:GBueSIOi62RRH72aEA1sG++WsdekRPSRYHTRL:cqIOBaEA1I+WoHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625137050, "uuid": "d90f3595-458c-4e2f-abce-9f07f58911c3", "value": 1673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625137050, "uuid": "0e442b2c-a365-457d-a6a8-c0de86d64465", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137050, "uuid": "a4129f05-f350-4d9f-98a7-2bcf7187b20c", "value": "CARTA_IDENTITA.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c6541f-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625169328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169328, "uuid": "fa01c3dc-902d-4ed2-8416-b3e73e3170f5", "comment": "Malware payload (Loki)", "value": "5b9633731a839cc515e92c7c1628aa52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169328, "uuid": "8a790f23-45eb-41a8-b180-fba261f1b968", "comment": "Malware payload (Loki)", "value": "bf4a7c58551436b7798f9f307d70c72ac53d5722dc277211c38c5f61a95fdc5a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169328, "uuid": "0b3fe2d8-4e68-436e-a7c4-7074b93f81f7", "comment": "Malware payload (Loki)", "value": "1b5d9f4bd24baf688c583e79bceea725f0aab323", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169328, "uuid": "29a17606-10ea-405b-b08c-5892a2da0ff6", "comment": "Malware payload (Loki)", "value": "02122555a032f6651bf17bfb142bb4a145dba6b1b18c5ec5a8e848a9d25457be4498bcd28280838c6ac3b6ca6762d227", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169328, "uuid": "ebe5bb71-a825-4e8c-b3fb-a5538a0b3e06", "value": "8F227E38D646FD16D122013DE11942F4FB695093EA56B83B104D379C0F512C78B4FABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169328, "uuid": "dbb84b42-3545-4e7a-9746-a2e5fe69724e", "value": "192:ScIMmtPIeG/bMOlswWFuMp2oQD80Ni3+OR:SPXgNMOPaDI2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169328, "uuid": "58eef375-001b-4df7-85bf-ded98f1a5e6b", "value": 10338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169328, "uuid": "76c3cb6a-7918-4ada-a34d-5e096ebf5e19", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169328, "uuid": "a00d3ebc-5cb1-401b-8bcc-fcb49789e0fe", "value": "5b9633731a839cc515e92c7c1628aa52.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed8ea54-da73-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625147434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147434, "uuid": "85132e79-0526-4380-ac1a-0b91be38fb6a", "comment": "Malware payload (AgentTesla)", "value": "5362533a4f03ac9da822c2d5e27b6614", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147434, "uuid": "02da412b-795f-4405-93a8-b19b0db2cacf", "comment": "Malware payload (AgentTesla)", "value": "c03770bf3487e4fcb8e642b98a14fca264cab11fb8da17502928e1f59eba6d68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147434, "uuid": "5900160a-802d-4226-ae2a-c9b5afcb8e1b", "comment": "Malware payload (AgentTesla)", "value": "0ce52d9477098e208ff98671cf4d2c0b1c182919", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147434, "uuid": "5daaacb8-214e-4e82-aaf9-927292da805d", "comment": "Malware payload (AgentTesla)", "value": "87926a5b39226821fd081e50b796f746457cca0c950106bc865f9c4b3f20a90a6e2d3a8c020ca73ad8cae149001f1311", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147434, "uuid": "a9a774f3-dcbc-4e30-b238-155c8f7007fe", "value": "4A742390F5AC7F245F854434E2813AB81DFBA00E52263DFA60E4BF6B4D18FD64A47798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147434, "uuid": "65ed2bf1-2edc-4e74-8e26-bbf605a8617c", "value": "6144:NbQxxRdua3MLX7mogcfPPHAvuhWdRciwzHtYCjpX7y2Kc3F6gJ0a:2x0a7zcfPPSuhW3cigHLXFR3sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147434, "uuid": "61cca7d1-c11a-4993-80bb-994aa2041d73", "value": 347032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147434, "uuid": "9e75a85f-2c6f-43ff-8b4f-f47f512163c6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147434, "uuid": "2127e497-69b1-43a4-8b23-5a61dcac6e27", "value": "payment.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fb4886-da75-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625148357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148357, "uuid": "3bc774bf-4a48-42a3-b187-4ccc5cedc091", "comment": "Malware payload", "value": "8dbad4d2b178a5ce26707da0011938bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148357, "uuid": "7639b887-9b1d-4027-8e7f-05e21c29e6fd", "comment": "Malware payload", "value": "c08de01f3bbd06e70886ec21772aee638418eb764681dfc082e5ae4475a0e951", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148357, "uuid": "a43913e6-8298-4058-b8bf-e0662ac27736", "comment": "Malware payload", "value": "1e46cd2525a6f93a39d6dd000c0dee947f009050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625148357, "uuid": "8e91cacd-2654-4384-ae9b-0e33692517f7", "comment": "Malware payload", "value": "a96082db755a863473084e98381f81d2bd680949fc10c989bf169ca3d2261c9d2346a2b90e80fa596ce55c0da2ee39ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148357, "uuid": "33a5bd3f-9bb2-4c7f-8bb0-939c8fbaad40", "value": "5A5302B24E4732EFD81ACC34E276094C65F2DE36976A9A2B533C917097C3506DAF2C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148357, "uuid": "fabd6fc4-3a0b-4ce0-ae69-66792cf03049", "value": "1536:IcLDNYJgd7cT2uN3KR99WHSFhRWlQ9A1WwpE9Pk:XLDMgdYT2uY9gSrRXZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625148357, "uuid": "97aaa490-1dae-400a-af43-60d4e2f8a199", "value": 64152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625148357, "uuid": "c0412c61-5580-43d1-865a-3a46b7039146", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625148357, "uuid": "e6cc80f6-166a-4cab-b486-de4604da237c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ced27b6-da70-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625146196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146196, "uuid": "c3346740-45cc-44b6-89a0-e32ff33b230b", "comment": "Malware payload", "value": "303698732a03a6376aee728b7d12e891", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146196, "uuid": "e03ece98-7049-4bb7-a4c9-a2c59eaee3ed", "comment": "Malware payload", "value": "c19eb6f050ef78ce65766906f1f3ad26693033c745f1ee247fab8ccdb77354b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146196, "uuid": "a0a92958-0042-49f3-aaf5-67d06bb908cd", "comment": "Malware payload", "value": "26b2b08ef9209bc5e67a5e70dc76bf1e8f2fd612", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625146196, "uuid": "38487a89-fd2f-4439-b40d-212f8c57d912", "comment": "Malware payload", "value": "430f7f13588fdcd89d88653e5625dc83cf5f31408a50e08c93096b91b965471ca582195b8514259fa6ccebd2c6538cc8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146196, "uuid": "d0b9d846-f053-4604-a71b-8a92248f0080", "value": "6C9557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146196, "uuid": "33e06069-6798-4618-b538-4d39f3a0ce90", "value": "24576:Dgv3qHMkDWIJMDLnmgGEuebjkuWPxYwec:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625146196, "uuid": "7e93a0a1-a1a4-41c3-af08-6f96db6579c1", "value": 2037625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625146196, "uuid": "072c0faa-505c-410e-92cb-e6bfc5245f71", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625146196, "uuid": "1795a3c4-b301-4930-9879-016f3d5ad13c", "value": "July PO 90002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbd08d2-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625120989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120989, "uuid": "f9f0ad0e-278c-4a57-8e60-3be08562fa75", "comment": "Malware payload (AgentTesla)", "value": "130e6f99e95553fea7197f08ce1c9621", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120989, "uuid": "1cc5bcc8-a35f-4458-ae4e-81d64d6c2d6e", "comment": "Malware payload (AgentTesla)", "value": "c5398c5cfee92e6d601874b13643b6fc7c734ddac76c8b698af42686c26ce9d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120989, "uuid": "82bef692-1666-4fcd-8c77-49e366fc3b29", "comment": "Malware payload (AgentTesla)", "value": "cc3af68db6b24d7351cc41c5769a6106fc929542", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120989, "uuid": "15806119-bb15-4673-8408-ea6a61e29060", "comment": "Malware payload (AgentTesla)", "value": "f23bd07bb176b3008885bae5073db8be8bbfa739e1ec1781f350ec7b277ede31948cf6cc727c0ec91fe9f5959c9193ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120989, "uuid": "c9e24776-db5c-4aea-ad32-0d36fe0f1ed1", "value": "2BC4238C5072BE07EFFA368B7248706A2525A9A64F1E273BDF560704CA96C19B43731D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120989, "uuid": "68dc6658-48a7-40a3-ab8f-1c47e7eb03e1", "value": "12288:+VysxtCXFp5cNAxNq1qSaGV6S69DsI5TD2RgIFC4:+VysTCXFtzwVU951Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120989, "uuid": "5cd907d5-04b5-4e43-bda5-f5042e18b41e", "value": 561654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120989, "uuid": "78115a94-e600-4995-a284-488f927bdc0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120989, "uuid": "54fcc6a6-2f88-496d-80b2-78f1996262cc", "value": "NEW P O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4b6c9f-da30-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625118764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118764, "uuid": "8e39e887-7de9-4d9d-ad47-f323034fde9e", "comment": "Malware payload (AgentTesla)", "value": "a62a449692e012e58e753bff74f2636a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118764, "uuid": "b1efdb51-5b77-4c14-b264-02b2889c5311", "comment": "Malware payload (AgentTesla)", "value": "c57956ac3cb0ec921a56c3c3a75a16fd0b8cc0b4fa25e7444aadefa9868af9ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118764, "uuid": "9ac1ff15-73b0-4772-bfbe-c1f5951a0b52", "comment": "Malware payload (AgentTesla)", "value": "f222c6f1b9550236da34017ad00a6c15a7acb509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118764, "uuid": "2b2bfc13-3c41-4f0a-afc3-a7004db67e50", "comment": "Malware payload (AgentTesla)", "value": "a65df34c18d3b03e164f03dbbded397d3408306abeb9121c8780bbc937b9ad378cc51d73f35147d61b1dd4751f67ab8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118764, "uuid": "24f88b29-815f-4690-b0cc-ebfed57b5df3", "value": "8FD412686AEC1364E3B79F3729F46184D63EF6293617E41D3482478A0BC7B81DEE0719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118764, "uuid": "e8b02b92-bba4-4529-96d5-7b1b0773f460", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118764, "uuid": "0c4668cf-8d15-4495-9e1f-c9fd4b738dbe", "value": "12288:SWxa+dJgTn+wQb9VBGlOQh3q8pF1RKLKQKvZZ09x+X1jr:nsXQ5VBEhqOFOLKQKvL0nkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118764, "uuid": "44161b75-fe76-4892-86d4-233e9515bf80", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118764, "uuid": "fce9ed60-1e54-485e-9ad8-b11f1ffd5a03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118764, "uuid": "668f8974-e7d9-428e-add1-4f89d9f3c88c", "value": "QUO_01072021.PDF(21KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed43b8d4-da13-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625106468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106468, "uuid": "749b86f4-55d8-4f98-b372-c459610a0778", "comment": "Malware payload (CobaltStrike)", "value": "2680d519097273ace671daf7ac0f9e8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106468, "uuid": "331df932-5b82-4003-9156-ad97bd3ac85a", "comment": "Malware payload (CobaltStrike)", "value": "c5b39009be422e89c793241831efd12c6827de20a56b71783d4fd80db9409910", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106468, "uuid": "6b546870-72e4-4394-b91d-62eb1599b143", "comment": "Malware payload (CobaltStrike)", "value": "6af97623ce61dee9f2d6331eb113e2c16831d00f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625106468, "uuid": "531216b3-04f8-4906-8fe9-ff9f89cbc7cc", "comment": "Malware payload (CobaltStrike)", "value": "86c0817c4ed990d03e2dd285730e6d7e796e0f7afc10904dac0a13e1db1e7c8e04d35b04ead5b9740c9b9d3226cbaf8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106468, "uuid": "fb240a20-5a1a-46c3-84a3-131d13f65f61", "value": "D174E621EDD19F93C0D74EB51753E78849F98C7A0B05D38B62627A44F0BAAB354C993C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106468, "uuid": "435301a7-7f5c-4b4a-979f-3ebe04b6e62d", "value": "64f1814b769b7e8d7e61f45d0e9f5051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106468, "uuid": "1722f502-106a-42b9-a99c-fd61047e7d78", "value": "6144:E19kSaAr3eU3UeDwtNz3Fe8fOV3rK+XLIsq6qUnHgs:69dDb5CVe8WV3rKQqQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625106468, "uuid": "491d6506-d1cb-4edf-a5dd-6d1569cc3e33", "value": 353448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625106468, "uuid": "4cbe188a-015c-465f-b790-eb64a8a1793b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625106468, "uuid": "e5270589-58a2-43d4-b2df-148abcc71051", "value": "2680d519097273ace671daf7ac0f9e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cb47a3-da94-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625161535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161535, "uuid": "835d5ecf-9293-4074-b69c-21248eb716df", "comment": "Malware payload (Formbook)", "value": "a2720e17c54697f94a6fc28a3b505cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161535, "uuid": "a84d5f8b-5ee2-400e-8c7f-6264cad974a3", "comment": "Malware payload (Formbook)", "value": "c5b56bcdb7672777ac9f2ed52d73eb7645310d54d93582f48296277efa006561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161535, "uuid": "e2c10ac1-23db-4085-a65c-12a2243b5188", "comment": "Malware payload (Formbook)", "value": "f1b4fa84ae66e136b9e4393a39d969eee1f091d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161535, "uuid": "dc4a67fb-46b6-441d-a527-0dc0c7c30cfa", "comment": "Malware payload (Formbook)", "value": "63c07f9744b77f94237a61e01a925b3325d1b48b9ce5ff3eb948aaa31d90205b69bb51be21ff3e99697dcfffa93f347c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161535, "uuid": "93133368-63cf-45f4-ad42-7a3d1bd8f3ee", "value": "87D4122529FD9079F2375FB666F83891C56AF362360AF64E29C103468B12781DDE323D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161535, "uuid": "009b044d-2f02-4db5-b0ef-2d78573d0a96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161535, "uuid": "f009883d-f730-4e24-a1f7-57d7544a0624", "value": "12288:wBMqUWJLYQHgNQkNzEn/0vNSlwXDPI0q1ddRtSRdASleCE0rpc+9D:NBCJANQhLKDg0KddRtSRuees9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625161535, "uuid": "453888b8-8bef-4167-8a03-8538b43fc9ea", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625161535, "uuid": "f406020a-075f-4860-8b87-716e26f77c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161535, "uuid": "a9dbce33-37f4-498f-94be-37b46f645ad0", "value": "Invoice..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbb78c7-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139459, "uuid": "2ac2fb8b-b51b-47f0-a622-7c64b2a3fbdd", "comment": "Malware payload (AgentTesla)", "value": "eb7aff844794d02cc868aae7c502bcf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139459, "uuid": "65350937-2108-4c72-acdd-da17a07f50f1", "comment": "Malware payload (AgentTesla)", "value": "c7587a7edf4d2ae81da2e6610769bce8fd1fce7dd913c47d69f7cf76d0129e08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139459, "uuid": "d0ca52dc-6b9e-44e9-ba7c-90460e2f35dd", "comment": "Malware payload (AgentTesla)", "value": "c3a1528b9a36394e26c99ba6c8ee4029877a5990", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139459, "uuid": "5367a738-bb4b-478f-b5d7-34bfab7b460f", "comment": "Malware payload (AgentTesla)", "value": "e13f150e254c7a17fa3f52afb8c9ef323ce9525028debf0e55249e91af2b3431084913e6944f8d5f9a5fb1be943d2353", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139459, "uuid": "042da76a-29da-4648-98b2-bda53a19d715", "value": "E345E10BF708AA41D5981638DCEFC2702339DD967C42CB0A29887EEE7CF2759D8557A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139459, "uuid": "afe452f2-5412-40a7-bce3-a0971e7a09fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139459, "uuid": "6c8ff572-c62e-493e-9a1e-4e0f24c0a594", "value": "24576:U5kyagBhzhWkA7uifD2bpEpRv4PTi1ldVYThR:Ulhzh9yJfDI6vgPTirkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139459, "uuid": "b45a3811-b3d1-4278-b595-075e758d8e53", "value": 1225728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139459, "uuid": "ee99a9e6-c59c-49b3-bbaf-8ce3b8173325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139459, "uuid": "2e470f8d-f07e-41a2-b892-e5416e51fbd7", "value": "E5DWE7kujNR3T50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722825ac-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625132461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132461, "uuid": "260200b5-52f0-4837-bf56-733933e79506", "comment": "Malware payload (AgentTesla)", "value": "96afa180005973791f98fb0f51f733da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132461, "uuid": "9b714f14-d3da-4fbb-88b3-a7b20d879df7", "comment": "Malware payload (AgentTesla)", "value": "c7871cf768f4d9e8f938fab225dc9ddbf473d93abb7728cb27db2a6ba69b7541", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132461, "uuid": "81972ab4-a0af-4f13-bc9f-969ee5eefb13", "comment": "Malware payload (AgentTesla)", "value": "afce0526852391cd333021b9f83f305da822266f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132461, "uuid": "c66b4a33-6772-47ea-8e07-3c0b7b0d32a1", "comment": "Malware payload (AgentTesla)", "value": "84b2f48cd3bac6019166d0fc208294d86754ce22f812104760220ab2cef9810155bdb810a4a57e8edd47134ab143d91e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132461, "uuid": "8cc828e7-97f5-4635-826a-93af523be623", "value": "2981E8AA137D8C11ED341AF7D8B1FC0203E9F43606C5D2C8325DF4EA1B9E3215A3A544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132461, "uuid": "b7cba6b9-22cd-4831-a7e2-2ec6db4e5364", "value": "96:ckgRxBhoIk61I+RArMyaGttdlJBJsAK/40Ob/EzmjmwBThtj/rhmtr:Ujdk6CzAyrtyxOb/EiBThtjctr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132461, "uuid": "8b496631-83f4-4a28-8a7b-6f23d68d4693", "value": 4199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132461, "uuid": "10339b34-958e-4ae5-9267-dee49929d167", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132461, "uuid": "96d89cc3-cb67-4f4a-a495-0a5c773b8b17", "value": "SMK010620.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bed6ede-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169414, "uuid": "9f6a1e7e-67c5-4214-9e08-d5d085c1ead4", "comment": "Malware payload", "value": "e98031cf43bfed73db0bce43918a608c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169414, "uuid": "f307086b-d4ed-49f3-8122-06fe274d6aff", "comment": "Malware payload", "value": "c82e0a487203457026e61b77d1becb97e8e0d2d8a30ee17d1d8827f9ece87607", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169414, "uuid": "aa8e78ac-79d6-4580-827e-9f91fec8c8b7", "comment": "Malware payload", "value": "de83c07a3311b5ecb908b7ae8c78766da383d1da", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169414, "uuid": "59dc3c17-20b5-41cf-92a1-50b87a6b9f0a", "comment": "Malware payload", "value": "47ab99b8ab577b7ec57694a60fb2f094ae119500f8de8b82bb59ed98b24c6da7c6b28d832f0ba29fe7eb38af6d64ba6c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169414, "uuid": "fbf593aa-a7ed-4687-8094-bd9aedaafef4", "value": "D4437C173599C031D4721A70AD6997639A7FB9736674804ABB8C12BE6FF06E08F34327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169414, "uuid": "816830c8-e749-4387-86c2-1b1fd7b38f0c", "value": "e42b4e3a14363948ae56748906541ec0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169414, "uuid": "52302fda-f4fe-4a05-9ec3-638a467de3a5", "value": "768:4w/Eyz5vFFC9rBag5ZdHkP9j0oeRJdFpR0hoBuuEkkycNyLTEDhnjIDp8DCSE:Ds45tF43HCyojoBuxkrFqUlNSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169414, "uuid": "1c9acaac-64bb-4e2d-ba42-0954107200ef", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169414, "uuid": "77bdebc3-4de1-4a81-bd5e-5f35a7c65931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169414, "uuid": "dfca4cd7-0053-4c95-a502-6ad0d6c514d7", "value": "c82e0a487203457026e61b77d1becb97e8e0d2d8a30ee17d1d8827f9ece87607.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec2011f-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1625120832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120832, "uuid": "cba97be6-7a72-4da9-bc89-9d0b43505ce9", "comment": "Malware payload (WSHRAT)", "value": "c9118d65be6e415653f4ccfcc9dedced", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120832, "uuid": "3ba69f2b-8495-4a9c-832e-87f01d3e5d48", "comment": "Malware payload (WSHRAT)", "value": "cb14693ffee68af4222ab10ed3ce21ebe607ea9b1862f1302f73e320ef163deb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120832, "uuid": "c8a3694f-2d90-435f-aa03-816744f79636", "comment": "Malware payload (WSHRAT)", "value": "25c48a6c6df8792a5d2dee2a6160ab67bdd89734", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120832, "uuid": "4f6195a9-418c-450b-b421-ecb8d6c33a9d", "comment": "Malware payload (WSHRAT)", "value": "9fa9836009cbda8672d27afe57dbef19e084c7b0395728203b1266ac58a884cad625af9ec10d72cd4bc227d726091fb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120832, "uuid": "d6060b94-f3cb-45de-84c1-44a512293cc6", "value": "BC04E09E5909D13E834176D4A20F971DCCC1A59B3A18C0924AFEC58CB73B6B496F3A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120832, "uuid": "a94c2862-1ee3-4718-8af6-2d687a57c479", "value": "3072:Ap1gHeX3reXif6ZKOBRY+7Q0bamKZtvEzKbURCqeGK/6SbIpklgVDSxGfmuZyas:Ap1gHeX3reXif6ZKwRY+cM24RCqeGKZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120832, "uuid": "e5bccf79-9c3e-4840-9b9d-45c04fd9d57e", "value": 183661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120832, "uuid": "a22ff9eb-e8aa-439c-bf6b-9844ff260728", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120832, "uuid": "37a700c8-2d9f-4bd8-8d6b-c8d17287de5f", "value": "NEW-PO-DETAILS-SWIFT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f4c54c-da51-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625132895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132895, "uuid": "97ac954d-d694-402f-9c47-70d0207dde55", "comment": "Malware payload (AgentTesla)", "value": "b57a2b22fca36597d02f54a652c0d0ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132895, "uuid": "85b1ffa3-d3bc-4368-8a9b-edae47d617dc", "comment": "Malware payload (AgentTesla)", "value": "cb4bdac7a19f73531c9d2795f58e6dc56a5216b967bb8385f0c461cf09f411ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132895, "uuid": "7bbc3776-97b2-446f-a5e3-7cb3b6001f6e", "comment": "Malware payload (AgentTesla)", "value": "231dffe688727ec269bcad0e22fd5f07c3958b75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132895, "uuid": "d50cb3b0-1d37-4924-abc5-aa52ae852f06", "comment": "Malware payload (AgentTesla)", "value": "f40dc18f2bc0e24450dc990c6a79c80d2807e08b359e8558a3cfe485f2bb7881322c96b341c3e4877a87f72ded9b1e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132895, "uuid": "8c23c5bd-bf30-45ed-bfc2-4922ddd713ec", "value": "5A554C3D19BE2137D1B9D3B99BC4882BF840DA7B31517E7958D707A5870AA8339C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132895, "uuid": "7b544632-e090-4e20-805f-0be8a23628fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132895, "uuid": "ead21b82-3f4c-48ef-a94d-8052946f0a2f", "value": "3072:gr3YPfAaNRqHuD0Bdlk7xGdJs/3SzFLJhP/e5OGsBeC8c97kFxxxxSVPJihzf2bD:rFY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132895, "uuid": "b791369a-9d81-4dc9-a958-be9b5b27b793", "value": 1377280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132895, "uuid": "597d8b92-9dee-4fe2-884e-686329fc5c3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132895, "uuid": "5f2f4622-1113-4657-8ea9-25f50f28600e", "value": "SecuriteInfo.com.W32.MSIL_Agent.BZL.genEldorado.31817.19814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8e745d-da5a-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1625136669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136669, "uuid": "f5ac64d1-378b-4f71-824b-44a71d7a2723", "comment": "Malware payload (NetWire)", "value": "c5a6211fe9ab12eb4d85bfb61e9495f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136669, "uuid": "25c306aa-b5f3-40e1-b004-935534d65913", "comment": "Malware payload (NetWire)", "value": "cbf703cf139fbeffc482036fed72e4bcae042a92c769cbb3de5219209b56553f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136669, "uuid": "e0e88863-9890-4e2a-800a-1f72776a4005", "comment": "Malware payload (NetWire)", "value": "635d8c769477ea6fe801544fcfbb50e70011a29d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625136669, "uuid": "ca6b9f73-2438-4573-823b-7b37198003a0", "comment": "Malware payload (NetWire)", "value": "ace0b9de3dbbb30b06c0d91b1f28bc9f0171463264ec4dd6cc9d1ae93dee4b06c93cdb761f23dd9ba6341244ce3ce98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136669, "uuid": "11b826a5-2106-4315-ba3c-80bfc7bf6dff", "value": "69F31719FA8794F6FE4B1D31919BF33F0B757A01C130CE92EF541E86EA23C26150AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136669, "uuid": "44916a21-e432-4300-892a-355729d0378a", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136669, "uuid": "38df69a7-2af7-47cc-9a82-c4c0d6ece89f", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvIYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/IzQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625136669, "uuid": "e00dce06-520e-4df1-802d-f60563bea4df", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625136669, "uuid": "2109337b-b8b7-4581-bf1e-8d5de571f561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625136669, "uuid": "43b5079c-64d8-4167-a1d3-f54b9d6deca8", "value": "C5A6211FE9AB12EB4D85BFB61E9495F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9091aabf-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1625133371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133371, "uuid": "a7d78a88-dca1-457f-a732-4819c965ed6b", "comment": "Malware payload (Neshta)", "value": "819ed5e6a38228a5db2d8fd0a13ca50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133371, "uuid": "31fba257-7993-4da6-8ae1-f9ab5d737ba0", "comment": "Malware payload (Neshta)", "value": "cc29d221864706dcc32aff35a4a7a246c310aa7fd8fd4cb254ad36fb415fe3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133371, "uuid": "db0e40bb-7360-4432-8c05-964d1948b9c2", "comment": "Malware payload (Neshta)", "value": "f21e01f668ae9a51f0d8f718455ce00fb43c36db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133371, "uuid": "1c324d60-f0af-4259-a11a-0342db12af92", "comment": "Malware payload (Neshta)", "value": "91f3386083ac89210cff57e456c708053114265a16d77735fc945d663f4ec7261ac535a676f3236285a7ee7f958f3425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133371, "uuid": "d97fd110-ff76-436d-a0d4-d1713df8e4f2", "value": "7EF4123826FC41A1EBB2AFB215F16255A72EB3317E1BD44925C2038F4753B82DEE1719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133371, "uuid": "a095401c-5453-4113-83e3-235813b92922", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133371, "uuid": "c1c174c7-b409-487d-aed2-167ce50a198a", "value": "12288:gsnoRQtp533lxQYvPECab/9cOfQYuSk3jZgifVhE3Ie3H2Al9cX:NoW5Hl4JJcOfQYuSk3/VhW3H2gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133371, "uuid": "3c631726-f9fc-4a7d-83dc-b1b4f793d401", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133371, "uuid": "cc4254c5-2246-4eb4-9a21-5df6ad4d8fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133371, "uuid": "e7d99f0f-b4d0-4bfd-afac-3d390a83b123", "value": "819ed5e6a38228a5db2d8fd0a13ca50e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb2a8f1-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138221, "uuid": "639c0801-f839-41c3-9766-f950e7266ec4", "comment": "Malware payload", "value": "8f3adb842b3f47bc8e9b939be42fa078", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138221, "uuid": "4da168df-e434-4f30-a4ab-8e67257c2ed1", "comment": "Malware payload", "value": "ccd461a1656f4192313ca78cd4d6746934be35fbe456aba7a734b5dce3f967e6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138221, "uuid": "91191076-f37b-4ba8-a62f-fa23c44707bf", "comment": "Malware payload", "value": "cb8bca4e7ae16118967c1b905d087af751b6b6d3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138221, "uuid": "64fafe8a-d6d7-4489-aa29-1661393540cf", "comment": "Malware payload", "value": "d8ccb0bdc3202fa30caaa75ab15d8732e346b29653dc964820f41a63d4cb17d3e3989f29597f7b319ce26dbf81ec184a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138221, "uuid": "db0e8b44-77c3-4a2b-9cbb-97bc265d64ae", "value": "B7B25302B697DA06F2770A749CBBC284B229BC1D9D81960B33517F2EFC711B147E5782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138221, "uuid": "f4317d44-e993-47e6-865c-ff28601357b3", "value": "192:P/0q8ZjWxMZiZEvA+6/6rT5bk8xgNAOR6GhzW+r0rZ:3xxEiSY5UGhW+r0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138221, "uuid": "9c55674b-3061-436c-91c1-a081f633db65", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138221, "uuid": "68e81122-175b-4464-89a7-8d6a4590f1a2", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138221, "uuid": "7af5380a-4f7e-4d22-a9ad-1d4f0c7f4550", "value": "ccd461a1656f4192313ca78cd4d6746934be35fbe456aba7a734b5dce3f967e6.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81093ac2-daa9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170711, "uuid": "96d5d1e6-03ad-4df8-b65e-b5e731417a38", "comment": "Malware payload (Mirai)", "value": "be5708e0a079d1309ec7e25427caa46a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170711, "uuid": "6d0d981c-350a-4bf5-9030-e09f366b9761", "comment": "Malware payload (Mirai)", "value": "ccd6a95fbae0b21396deb10a4614df4a5d5a8799950d8531a75f5576d6bc44ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170711, "uuid": "e38bf88d-7b62-4983-8486-81318f5cb942", "comment": "Malware payload (Mirai)", "value": "054e1366f08b691a7bc8c9b447882878900c33fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170711, "uuid": "a3d4d318-4c22-43da-b823-285652cc9a20", "comment": "Malware payload (Mirai)", "value": "68b3286778d4ef218b15d74916c7bea7c5877b8a3b0aa46e5f65b55ae9f0e84313ca2c63489b3ece60112e5dee589981", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170711, "uuid": "37aab8cf-0c5d-4f74-b849-74ee944bc63f", "value": "0FC2E0AD1706CAEDD0A950FE0344277A5E110BA1AD83DC021AE9F6D7DE09CB0B5D7DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170711, "uuid": "a16288cb-ebfd-4eaf-b517-66fec9ed69f6", "value": "768:12G214DFyos0+aOIRRa3bkz2uEOJgGlzDpbuR1JY:12GdDgosnanRRaAz2uE6VJuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170711, "uuid": "b703602b-7e17-40b0-8139-1011b763cffa", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170711, "uuid": "2556dd1e-d069-412d-b0b7-e2057eba380a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170711, "uuid": "3b7b80bf-93a3-452f-af2e-bdd56cb6a3f4", "value": "be5708e0a079d1309ec7e25427caa46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b57f34-da79-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150284, "uuid": "2eb232c6-63c8-4c89-ba8e-033a989cea06", "comment": "Malware payload", "value": "a26118e505bde3b50f263d5fb226e4a2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150284, "uuid": "d8486c0e-4247-49fb-99f3-09bfe09fc5e1", "comment": "Malware payload", "value": "cd51c032f06c33c41eac06755b6d00accc0d9666d843651583cf8c9a78ee1d74", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150284, "uuid": "cf32cae3-1d91-49fe-9292-b81a897be300", "comment": "Malware payload", "value": "7283fdc8e030ea62f40571c8a7b1e17d5c28b8e9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150284, "uuid": "aa324cd9-12d0-4fea-876f-f22e65df4544", "comment": "Malware payload", "value": "7ca26d2333aa812a9498dca7a8135b6092df8f3982e9533a75c4c7d9e2db083bd54a9c3c8eb9eb4aa3b2a14058e68153", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150284, "uuid": "7596d4af-992d-4a24-ad04-f62614a11adb", "value": "32A423BE7DC1178DB65B014D108D693024A2F65B0A4B5C121EBFB1B7A6BE0D8E12DE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150284, "uuid": "3faba846-0806-4037-a69f-e28ba68658cf", "value": "12288:L2IlwKhTkbnA8dU09Iu2YdtxtjEdhfnGqZF6:rlwKVkbA8dNht/Edhuqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150284, "uuid": "9208e667-8e9c-4a90-acf4-2798d57a3df0", "value": 488768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150284, "uuid": "0a4ef292-14bc-4bd8-b4fe-8953a6d5f00b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150284, "uuid": "3b4eea84-e205-471d-82d5-04fb27553a46", "value": "infjgd7371.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57172d47-da7a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150454, "uuid": "fdbf43a7-aa3a-4b95-a321-ed43b0604026", "comment": "Malware payload", "value": "b349c1fb16bc6235fd898006b0fdca1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150454, "uuid": "fdefc602-ae7a-4d7a-bbb3-1171a6b0cd7c", "comment": "Malware payload", "value": "cdd8666d0de57b840d0e4b6e34da9e8ace7e8dfb13445845939532aca6f97468", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150454, "uuid": "c939bd00-d6f3-4064-9e5f-388a235fc0b0", "comment": "Malware payload", "value": "b6a04f127b08bbe093652c8efd010b38f78980cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150454, "uuid": "f4d60046-42e9-45ad-b998-929800c73ba8", "comment": "Malware payload", "value": "dc502b348bcc91c0b14345412dd289d24e4e92f7c9551572402a9418062169df10e792a01172ea86f56dcf0792888be2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150454, "uuid": "8df86cd6-8a42-4502-92cc-dfc2d6abe6c6", "value": "0554AEA17640C471C486C5305866DBB16BADB83166A3874FF7982A6F7F333C11AE631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150454, "uuid": "f6b5f8ae-1621-42f5-a310-5781e9857c58", "value": "87fe651e6418c1bd0aa48fa04abdaea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150454, "uuid": "d04f193d-8423-4db5-bb2a-6014bcdcab59", "value": "3072:bYBdlcM8ZBLd3DNieRo1XQxlLoo24zFb7B:bkdgXLd5ij+xQ4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150454, "uuid": "b1983b4d-6a92-44c1-ad8c-065eea687aa5", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150454, "uuid": "004d8ecc-5c01-4b65-97b8-4e1238b7a156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150454, "uuid": "8e77e801-2c51-4d1b-b0d3-0f0e38ee9749", "value": "b349c1fb16bc6235fd898006b0fdca1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3300a43c-da8d-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1625158554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158554, "uuid": "8c351619-c524-464a-b35a-84dddad20bd6", "comment": "Malware payload (CoinMiner)", "value": "4508b79414a6ee98badbf039aba57a3c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158554, "uuid": "d1c69f22-86e4-412c-ac03-4d2fae0b0277", "comment": "Malware payload (CoinMiner)", "value": "ce6c7f3f54f49e2e6bd10fcdae8e91a616a4234df9f694d44db8582ab1c20ed1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158554, "uuid": "70c8dcb7-85a9-4e87-a8f9-225cb0082d43", "comment": "Malware payload (CoinMiner)", "value": "4d40b457b656220ffe113c83931675c1fa3ec12b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625158554, "uuid": "358bee85-758b-4916-873f-ba2841c77873", "comment": "Malware payload (CoinMiner)", "value": "b659aea9cae90bd9d43c450d4277c22ecb51f6727939f41bb2e1943958034b0fa7ac3c7b82cee41f230f7db7831729c5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158554, "uuid": "a86d647c-2be1-4149-98a6-297c32018ea4", "value": "0E16330AA7C18DB2C3917136DEB6E3F716246D554F92524317C8BD2F3972A232846AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158554, "uuid": "8221c268-64de-4a59-8262-f53b6cb3e9a1", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158554, "uuid": "b758fe0c-208b-4b2e-8a52-cd07d6ebf214", "value": "98304:ePRCtcuqCUA5Ch584uikK0GUudrhFx7fvizHPSnJxu99DRt:6R4cuqCcb30Sx7fvibP4DuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625158554, "uuid": "4ac11420-7288-422a-b9d4-eb20450e811b", "value": 4405248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625158554, "uuid": "6e9df730-8253-4cbd-9bc9-a27e7ac61a07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625158554, "uuid": "3eb8ebc3-0a4f-4535-ad4c-4c22692810a5", "value": "4508B79414A6EE98BADBF039ABA57A3C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a43d355-da5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138944, "uuid": "291418f3-d305-4de2-8e23-eb6ed71cbf2f", "comment": "Malware payload", "value": "b74dd51e08e810ec722d7576d8ab22ca", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138944, "uuid": "3fe59b60-9d83-47f0-8fd3-8ed3d6b918ae", "comment": "Malware payload", "value": "cf3631a7bd04b0507d7e5510337f98c3feb16d694e5aeffa7447af6fb576ef4a", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138944, "uuid": "e798dbd3-9903-48c9-8c51-4d6bee35efd1", "comment": "Malware payload", "value": "baab5f6841308a3e93fb2e57a289337937f41b9a", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138944, "uuid": "e71e8a3c-eb39-4d79-bb13-412df348a873", "comment": "Malware payload", "value": "6e2728dcc8978b19bfa4d1f47ff4b5c30509a1cc2e5ae9f651fa04b65629a8d4c3c67c558ab48b14712fd40c308471df", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138944, "uuid": "d5c4c6cb-dc7e-4708-8086-37b9965596f1", "value": "16C08CBB1897C3023580B099CBCCF10B78E2C20E780AB51A23E00A0EF01242A298262B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138944, "uuid": "4b8d199d-8801-4dff-9cf5-f14680054bce", "value": "3:+yjoIMLkXiEoK4ZcwBJNBNRcYuRPTjWe1MRaAsCLPoc1aHF5pBM1Td:+xIMCinZtJNXu11MQYL1aH1BeTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138944, "uuid": "6babc8a6-df13-4cbf-8d12-ce08e9058bf8", "value": 164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138944, "uuid": "723d1ac6-be1d-4502-b045-c82fffbb1685", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138944, "uuid": "d16f0ea5-9f4f-4b1a-b1c5-af6d70f163f8", "value": "provo.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca550e9b-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134756, "uuid": "2c4de735-0a56-43f1-8f12-e2e40dababa3", "comment": "Malware payload (AgentTesla)", "value": "cfef24eaa1cb13c455c62ed259eba525", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134756, "uuid": "f9db5e5a-ed83-47d6-8efb-a17346dcc325", "comment": "Malware payload (AgentTesla)", "value": "cf81c86cc82a3ffc8d21661e1042d2e4d9807828563d2d00a0a2079095eeac1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134756, "uuid": "4d0caf96-c8ac-4ce2-979e-a2e028f0d7f4", "comment": "Malware payload (AgentTesla)", "value": "6c790eceb48c29b48dcbbecae59f39e08cbbc317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134756, "uuid": "21f996d9-3720-408b-b147-e71a91579021", "comment": "Malware payload (AgentTesla)", "value": "38ff1e910f4150b4d811cf677268fc897e34e856767450021f37621bcfe7c613a85c8d97c12c856637d9e3d4e297613e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134756, "uuid": "3ef52e19-5309-4fad-b82e-2400d13a88cd", "value": "ABF47C202AF85A29F0BA9F7E95B4510197FDF613AB13C95C3CB511CE0723A41DAF172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134756, "uuid": "8904b2e6-db0e-4f81-8f3d-5bcd9b8ce10c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134756, "uuid": "9c7da53b-7e12-4f5d-8fea-9c735ca67e0f", "value": "6144:76rb434V5ctyxsyuAgGxcBuqX57ieLyOR6475eBpGx1qKY3a+avZnHI6FYdQYtLJ:7ogicBbX5TyIfHY2Rno62ttUIK4IQ+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134756, "uuid": "9e8bba0b-ad8f-4231-853f-31122e348f20", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134756, "uuid": "f023bbc3-35b2-40d4-968f-2da98336085b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134756, "uuid": "3229c9c5-64e7-43f4-8973-b63d7fe24dfb", "value": "cfef24eaa1cb13c455c62ed259eba525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f1f941-da35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625120847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120847, "uuid": "760c8a2e-69ca-4b08-910a-cd04ad5bddb6", "comment": "Malware payload (Formbook)", "value": "c4e21d3ce3cd5d249dcfe18172ad94ac", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120847, "uuid": "17379a9a-d67c-4252-9c96-da310cd83530", "comment": "Malware payload (Formbook)", "value": "d09f39568e68eaab9c15ea9d32a431c1a54b303b41528fdaeb7c601ef3c846b2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120847, "uuid": "4207046f-ac5b-43c8-a5ff-db9c9de6d504", "comment": "Malware payload (Formbook)", "value": "bb10fb7c39d872cc51ef81918abe2b391736f1a3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625120847, "uuid": "5851ccf2-8242-4c32-a842-fbe6a077ad91", "comment": "Malware payload (Formbook)", "value": "cd52ebe03de8ac8c9b3f6abab176f3b6fe40eda2ad70064db2bcfdb2182d62e6828f9f18e2bde86ecbad281e553cbec2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120847, "uuid": "c75307b0-9107-4955-87fb-24fcc5b7f9db", "value": "B9549DCCAD404059CF0F82303DAA75AD7B5466A3C6451DB3DBC2560FB9727EAE40DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120847, "uuid": "b019fc20-2bae-4d96-a98c-15699cda2fa0", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120847, "uuid": "e6c2ce3e-cd4b-4b38-b5ce-ff1796da27ff", "value": "6144:XqjIBO4PKzma5uOD5fC6SQJZvtWr4kN54HaF7rjhrqWjj6:y8O4PKzma5uOD5fC6xZvwrvrqe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625120847, "uuid": "ec0ac29a-cd14-4add-b9fa-e7f8db3cf9b5", "value": 302966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625120847, "uuid": "1f04c222-08de-4457-8b48-d30f1a73843b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625120847, "uuid": "812ebc35-1aea-4a44-8f8c-8b3e850cc3fb", "value": "7723421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05fad5b-daa3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625168294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168294, "uuid": "06318e75-63e0-4f10-808a-196cd5ca338e", "comment": "Malware payload", "value": "974201f7895967bff0b018b95d5f5f4b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168294, "uuid": "17f0129c-09b0-4583-8005-769fa166df4f", "comment": "Malware payload", "value": "d0b88ab321a05fc94505620c9d02baec4cb1de7bb3b0067de4f8c0d3ba8548b2", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168294, "uuid": "6600bbbe-5cf8-4ab1-8f69-6a2bb321e455", "comment": "Malware payload", "value": "5c027de1a7883f78e508ebf85847d0b32bf3c9a0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625168294, "uuid": "e832c322-a5c8-441b-a639-21dbf07ec818", "comment": "Malware payload", "value": "225d9b13842718987987c0540a80e32fbc26047c6a9da7c365c9824631c76d888fe3d02ac4bdf01c31c63c0d1e800f10", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BoxCaon", "colour": "#42F6B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168294, "uuid": "7ea2559d-b0c3-48e9-96c9-bd4969670682", "value": "08636B22B6D58832E06215705979EB629A7FBD22577445CBF7880FFD5E306C08E3932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168294, "uuid": "56c4c129-a0f2-4c26-871a-f7f63387a453", "value": "30ece1b838a644a71dc2fe4427b30c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168294, "uuid": "c897e004-4d11-4e03-99d7-149ae11e251a", "value": "1536:CwZEMfRvNwqVQ+1XxB/JNPR9fRCT855p:YK8e55C455p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625168294, "uuid": "76df4d4c-a609-44d1-b6c9-8c2762184a0c", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625168294, "uuid": "00f4bbd1-03ae-49c0-aad3-83911f630e2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625168294, "uuid": "de5d0b32-fb6a-4b48-b156-aaf62482e59c", "value": "d0b88ab321a05fc94505620c9d02baec4cb1de7bb3b0067de4f8c0d3ba8548b2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4e7052-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625122921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122921, "uuid": "e5fd540f-50d6-481e-9699-4b3083a827f0", "comment": "Malware payload (RedLineStealer)", "value": "3893e4751b5148b1e9e06acaf86fb799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122921, "uuid": "3502b44a-438c-4301-ba67-269bfb75c48f", "comment": "Malware payload (RedLineStealer)", "value": "d0be526ec952a11041e3792dfbb4afc7d68f721c1e4ef5eab49bf1888e755a84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122921, "uuid": "13c30944-0a09-43b4-84e3-a3620a509809", "comment": "Malware payload (RedLineStealer)", "value": "1b4606773c807c81726035b4eebaa9040450141a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122921, "uuid": "270a2860-e2bd-4df3-adf3-f852ac15a86c", "comment": "Malware payload (RedLineStealer)", "value": "1068ac8a3f4607b35a7d463e65a71d887ba74463d8395d6067e2e9b3a84ef05c33dd2d84b4ec2f0c3f823ef14b29330c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122921, "uuid": "10f63650-554d-4a77-9f3a-bdfa32eeb3c7", "value": "FBE402B23A40D072C45D00319066D724AA99AD316FA75647F39E2FBF2F737D046E622B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122921, "uuid": "409c6bd3-6920-46f6-8308-47c29469863d", "value": "4483f0889078eb2786cc4b4cdfa1342a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122921, "uuid": "fc754a24-b340-4172-b905-b1c981344c18", "value": "12288:IVuO2Y3F4A9uyMjAe/KnWFYK0B77d4eFgUxBtBX:IVuRY3Fv9CAHnTKQ4IgUxtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625122921, "uuid": "6873afb1-43c2-4ca2-9d26-05202bf03852", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625122921, "uuid": "7ca53648-08fe-4aaa-967d-0f683c368edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122921, "uuid": "8b360261-169b-47fe-a4c5-6421a3ea2e03", "value": "3893e4751b5148b1e9e06acaf86fb799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22743d2-da2f-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625118368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118368, "uuid": "faa5b4ef-5919-42f6-a3e6-c53606195431", "comment": "Malware payload (CobaltStrike)", "value": "6bc39adcb5f0eebc590a241472ada276", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118368, "uuid": "cf02a91f-ec4b-46b2-ba14-a67546d829c0", "comment": "Malware payload (CobaltStrike)", "value": "d147fdfb576ac2d9a3a12720b2b423d6c34dd5667975cae7fb99ec7c3f35a605", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118368, "uuid": "626e81a2-3d53-4560-b877-d3b64534fbe9", "comment": "Malware payload (CobaltStrike)", "value": "3795d83aa5d4c8be1e1d1fcf02bdfc62eefd78a1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118368, "uuid": "b2149db6-5491-4a2d-8fa7-762e50dff4ad", "comment": "Malware payload (CobaltStrike)", "value": "1f2b6da1f2aa4efe3afbe5cf9cb5b218535f5667a504a8b4f7454b0dcc9a0c208a17d0ab89485c3fb354bdef74ee7c77", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118368, "uuid": "29230539-ca28-4e7b-8403-1634f0398992", "value": "8BF48C027685DF31E1AF0635DA64D6B05A7F7C21DF218BCB63843E1A7A706C1A931B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118368, "uuid": "4ce92ba8-13c1-4f09-b793-6dea6b6aa17c", "value": "4db85bf845f78d3968401d3dd78f378d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118368, "uuid": "fc452be4-677c-42fc-b1da-878ef8c3a350", "value": "12288:8cZJbBoDvAGzPPiT1+NuOuG5GDp2r719Al13/NN3wB9XFwX0z76EMAqa8HYHhZGg:LbSvAGmZcMDi1W7bwDS0qEM/YGRK1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118368, "uuid": "d2838e26-5db6-443e-9a85-5e552b69cb89", "value": 741607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118368, "uuid": "0e3ffee7-4e95-483e-b080-40cfb9da0492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118368, "uuid": "59bd93e9-b9ed-4c30-9686-6a752f2ca8b1", "value": "6bc39adcb5f0eebc590a241472ada276.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576f2e16-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625132416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132416, "uuid": "5af82ebc-2650-45dc-b905-c5b92a8f4e43", "comment": "Malware payload (Loki)", "value": "22aa2cf51d90274fb55d8ddab856fbd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132416, "uuid": "c307fe35-0d55-469d-8d64-cdecdc152eaf", "comment": "Malware payload (Loki)", "value": "d31aa0368300ff352c821d26e866d05481f0b578c8a4855dc9fd1c45831b33fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132416, "uuid": "8f6a4240-a088-4b3d-aa3a-85e924308285", "comment": "Malware payload (Loki)", "value": "38c25ca3621532711f2c27212ffe1b7f7d90b924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132416, "uuid": "38098a3b-f553-4e85-8875-294305207056", "comment": "Malware payload (Loki)", "value": "e00e3cb18642a5048e1a54b0e9e72e97ec9e1fb292f7ac5b0c6ce43ff61ba870accc61ef83aae8ee927282cc37b9d9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132416, "uuid": "eb39f59c-4ffe-458c-8309-62b7a1c3ac21", "value": "76054C3D59BE223782BDD3898BC98C2BF840D67B71517E7858D747A58706A8339C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132416, "uuid": "3e04db0a-ff11-45a3-b415-5dc31cbeac50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132416, "uuid": "192bd772-9941-40d4-9fcc-e3e90857db39", "value": "3072:erdKPfAathh/7XHnDyzISi/hHV3ncTYk/RA+1Kfo6bUMvPSIz4yDelft9yAC6n3M:VlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132416, "uuid": "b11001b6-864a-4c5c-91cf-ea7840e79b86", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132416, "uuid": "7f1eb56f-5e51-4208-a0a4-57c6d185e7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132416, "uuid": "e905bf57-a7cb-49f0-8278-074d034f3799", "value": "statement of accounnt june 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fc12eb-da36-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625121146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121146, "uuid": "f1a6613a-4381-498d-96ca-23710b8eb5ff", "comment": "Malware payload (Formbook)", "value": "d0a3271d3966f4765b194b203abaf782", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121146, "uuid": "7213ee7b-c2b9-4c23-8327-ac82e57814a3", "comment": "Malware payload (Formbook)", "value": "d38491c76eda29b3135557f28eb4e2fa15ee55d54c15452f9221e82a5b489c5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121146, "uuid": "8067671d-604c-47dd-aa03-a61aa88d7830", "comment": "Malware payload (Formbook)", "value": "9c17b21c9b6013ddab38b7a6ba5badf94e7d8f31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121146, "uuid": "457e3bfb-7063-4364-be27-654f60260d56", "comment": "Malware payload (Formbook)", "value": "b4a921bb5f20dcc0b8358bab8395b87347524640718fac83c6eb26f0f592201f34349a52a42c5b6ef7148d15a7f8efd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121146, "uuid": "304a68f1-6bee-4863-b003-9af3bac7e9f3", "value": "E1C4E05235489DBBE2131CBA4C1DD2B115AB6D246059E52CB5AE330F19F232613EFB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121146, "uuid": "ee022e22-254b-41d1-9745-255c2fbb36e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121146, "uuid": "6f9398ff-80a4-47cc-8f7e-2224eee0da6e", "value": "12288:0EFVzMFRaI5qSeMLLer3wE7NuRXGJKB7Q9AcyjL8DP:hav5SzwE7NuBlB7Q9AcIcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121146, "uuid": "ab4abf94-cffa-4aae-8c38-e2d34277337c", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121146, "uuid": "71cc9d32-90ae-4112-af40-2106531ffd9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121146, "uuid": "1f5e7d2c-14b2-4f8d-9f7e-982707dcb1e5", "value": "d0a3271d3966f4765b194b203abaf782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf2fcd-da5f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625138874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138874, "uuid": "1e59e8d7-31a6-4553-ae82-8d37b5c62f66", "comment": "Malware payload (Formbook)", "value": "8c1e1c77d7977d23fdfdd1a5922c43de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138874, "uuid": "5549f88f-c3b0-4b1c-8c96-5566f074fa9d", "comment": "Malware payload (Formbook)", "value": "d3d0a52b6be4713710b0d9a74b3a0eb6a2dd77de6ebd65899fef5d424e330c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138874, "uuid": "a0cd8fbd-2e5c-4422-8149-def8e303d379", "comment": "Malware payload (Formbook)", "value": "fd71ef865ccbb4eef71c16ed1095ba1d82bbfa65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138874, "uuid": "218e66cb-fef4-4da0-a4e8-5383457295fe", "comment": "Malware payload (Formbook)", "value": "07c3e05b6ec2a63729ba51c6db77c8c0a4b347c4fcd0d0ab95d06cb853ad65c35bb5c2d4db4ebc6a693ee7f93ebe9e0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138874, "uuid": "78a6ade7-b6c3-4ade-81ff-a83000fff97b", "value": "D0D4123829FC2345E5B24FB656F52156CB7E77327C1EE01A34D2868D8982B01DEE17B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138874, "uuid": "994bfa48-c772-47df-b27f-ece171e273ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138874, "uuid": "0cf13c97-8211-46fc-b1a1-527ed32fd7f5", "value": "12288:syJVcMM0sPTWxSiMJFCr+BA3xwUvoO6uFvN:3aMM0OTuStcZnvo3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138874, "uuid": "62646b77-6cb1-42c0-b401-6b2462928dbe", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138874, "uuid": "1a3ce6ff-7414-430a-ab7a-01647cf5a953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138874, "uuid": "5f378681-ea43-4e80-b02f-0bdb81ada1ab", "value": "Offer and Company LOGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1324305-da73-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625147679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147679, "uuid": "0ec7f764-9a17-44ee-9f7f-fc99446b6f4e", "comment": "Malware payload (AgentTesla)", "value": "9d48a77ab9e588ed7e47a1bc80c131e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147679, "uuid": "0e7b8323-0adf-4ec4-ac2a-c66337bc7a0f", "comment": "Malware payload (AgentTesla)", "value": "d6882af91695b65b4113b5e072e39d7c1f1121d4984202c6c0063c3ebaea7fac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147679, "uuid": "60b78b58-ca1d-4672-9ad4-b4f4e52d353e", "comment": "Malware payload (AgentTesla)", "value": "b654ea2b10a83320c411807a507d2af3e55e2e03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147679, "uuid": "22a03e16-9909-4b44-ac23-439eba2336b6", "comment": "Malware payload (AgentTesla)", "value": "f29780c1cf037f67be8a5ebd73c8235f30123d619b14697d8157f48d804e3e02d6fbdc28c6a996f2449fe54688f4547f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147679, "uuid": "a048af15-25c2-4b66-adf8-1422c0f56b5d", "value": "9DA469E5A5D5FFD7D1BB22312EE4B2004B634B5928119240ABCC651F3B226DF2792F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147679, "uuid": "09729a9b-8690-41bd-8ba7-4d1e3524b0b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147679, "uuid": "abbe7669-bcac-42a6-be26-26e19bee4ba7", "value": "12288:vcW05pFlRP8Yjc9uCKhmT8SI+GQCsUDyDq:QfjuA2HpC3Dy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147679, "uuid": "4429004a-625b-4a4b-915b-70657387b7c2", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147679, "uuid": "f58a85a8-8f44-40da-bb4c-85a949746401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147679, "uuid": "8c97306c-22dc-4d74-bfb4-03ba2b40f9f9", "value": "9d48a77ab9e588ed7e47a1bc80c131e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c614b05a-da9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625166532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625166532, "uuid": "94690d4d-7102-4ae8-aeb8-04b2c44059ac", "comment": "Malware payload", "value": "36ab5ad5b56dcfe6c1879a1e003abeaa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625166532, "uuid": "3b65bdcb-9def-4037-802f-bd698aa87847", "comment": "Malware payload", "value": "d952c6fd7fb2d6e5d899351fb7760f1934d86e20c9a2cd133cb4b5fd6789e338", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625166532, "uuid": "944b93f8-2733-4e82-b285-0a3cd57099bb", "comment": "Malware payload", "value": "2948a2436d80b6f050b2c58b753bea817632eb94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625166532, "uuid": "cf356556-3955-4553-b14b-069baea1f447", "comment": "Malware payload", "value": "66961a04fd64c3bc938146d3f3005c54de6a7881887f6c579b40698d81960028d8f4fe78a3c66fb69481ccfad9175d8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625166532, "uuid": "13c50a29-5471-480e-bfb0-15db07d216a3", "value": "80C12873F8714172F7333A7C8892B8AF6A7CEF014A65566A28F92C4C1580C45EB29753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625166532, "uuid": "32672bb2-10b8-4076-a20e-6765142ff15e", "value": "08d73ecbe833f54c3be14e0ca3736cc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625166532, "uuid": "d99cdca8-7db9-4b48-a08b-53b63ee9859c", "value": "96:N+4jG8Qz/Ufh+Hr7rQ2pGfx0ipYTN+e35FNI2cgpGiJI8W65XKBBb:N/GpbjHrg2pEx0ipYTNnFNI2LpLI8W6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625166532, "uuid": "b79aa4d2-a9e2-4b58-95a4-9b6e621d9347", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625166532, "uuid": "47b77f53-e11d-4956-ae57-fbf9f7aa13ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625166532, "uuid": "aafdc415-6515-4b8f-92cc-0a679ef13e61", "value": "download.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c3a720-da72-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625147063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147063, "uuid": "67008b93-e12b-46c6-b1b2-b6c030acc7dc", "comment": "Malware payload (AgentTesla)", "value": "9f54a650ca6d4838ac02ac5b2c9f247f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147063, "uuid": "2920bb10-5f62-4429-86df-fc79a2bba6fd", "comment": "Malware payload (AgentTesla)", "value": "d96693158d721f5d10874de296f62c220ef14d708c07f6e72731643ee2f00b2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147063, "uuid": "f63c7858-282b-4e9c-b8c0-6cacc5e6ce2c", "comment": "Malware payload (AgentTesla)", "value": "ad8734aa2357297dd747883a08e7e0cc69c32071", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147063, "uuid": "55a2f924-f4a8-40f0-ae94-a2bbc2378922", "comment": "Malware payload (AgentTesla)", "value": "d6740e686a6f59f1328106c851b94d435f117040c1f9c9a9b6e09de96965fc19980773b27a1d65085246cc19eec3f7d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147063, "uuid": "ed4b65cf-8894-4adb-995f-9869e7945ef0", "value": "5645D11BF2089A45C8551238DCEFC2B413B9ED967D129B0B2F997ADE3C72712CC516E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147063, "uuid": "8dc5058e-6286-4f88-bbf2-63858967e101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147063, "uuid": "44dc266c-cce7-4dc8-bc34-c59b74c57899", "value": "12288:oWTHDByhzh6YsirPL1hhjEwATmkRcmMpljDEtH6RKH5RWO460UE7gGy6BEgcGhR:fyhzh6Y5LJjEwATQmIDEZz47fsGqGhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147063, "uuid": "d2509892-22bf-4de0-b51c-f8bb29dd2935", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147063, "uuid": "8ae47663-d950-47d7-807b-0375887602cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147063, "uuid": "3f56eba6-6c6d-40f8-8c06-46a56c431677", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.6038.12190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc42104-da7c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625151187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151187, "uuid": "af5b6d38-2619-4951-b72b-1f6d8d11baec", "comment": "Malware payload (RemcosRAT)", "value": "462fcd363ba1294e243777428a95348f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151187, "uuid": "32e5b579-82dc-4da6-b64c-fe52af15a3c9", "comment": "Malware payload (RemcosRAT)", "value": "db5d7098903a45bb318ee2f897baa8584d86071be755582e87d3fd7192f87c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151187, "uuid": "6de18fff-0370-4e50-88e4-0104d5eec8a1", "comment": "Malware payload (RemcosRAT)", "value": "6e825d8bdfc29cc092bcbf8ff3c16028b09a2c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151187, "uuid": "56a1eb57-a970-4afa-b5fd-945473cb1dc4", "comment": "Malware payload (RemcosRAT)", "value": "9be8bfa0b6b2b9a334c53a6ac8f77d9717cd192d81a58fb423f9349bd690db4cacbeb24cdf0da8b6e88e620039dc832f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151187, "uuid": "25ae61df-a210-48c4-8d71-d90b31bf26d9", "value": "6235DF42EFF144F7D4750B3015771B316ABAAF201A76961A9BA03478AE323437E27F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151187, "uuid": "d339e6c2-5752-42b8-a54b-704a0dd588ee", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151187, "uuid": "68d9e726-5996-4e40-ab56-240f9a09f88f", "value": "24576:WAOcZwlfX9gKxsMYU5kjT/dfqEkdbiG2K2fpmx:c73YUyLIdbcHfpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151187, "uuid": "19dd9948-0b8b-4618-8efe-f68c408dab9c", "value": 1158808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151187, "uuid": "60a5d98f-4b00-4538-b0fa-3c398c52c763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151187, "uuid": "bbd5222b-b6f3-4e9f-abc2-f95ea03399b8", "value": "IM000637191_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81a5c3b-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138215, "uuid": "8d7a97e4-3b8f-4b32-9def-f4acc45ed8be", "comment": "Malware payload", "value": "6bca61e1bbdd312bd05369cc85f364e8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138215, "uuid": "3151e394-1924-4a91-819a-78253299f085", "comment": "Malware payload", "value": "dc9d38febdf38c4223bbb818aef14ef1d58aafbe7a722ed479081bbcd41b4c43", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138215, "uuid": "df1a639f-1710-4be0-a218-5b4a035e2ffe", "comment": "Malware payload", "value": "ac8dcc9af52f36d52621a24a005c4bcfec1c7b31", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138215, "uuid": "b8a0b7f4-89dc-4a79-a3b7-73555fb0546c", "comment": "Malware payload", "value": "739117abb7a0639d07912896af45c50623b2212fe9ae5a47200ed55273bbc30a5165f1be1de99d919b75f036635b3b63", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138215, "uuid": "81471c5c-cc19-4599-973b-4f7fa71e6339", "value": "B4A27106F645D826F2520376CCABC288B229BC1D8D86970B33687F1EFC311B9BB56701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138215, "uuid": "970a9caf-7a58-4b8e-9a61-09c0a9b64ec5", "value": "192:tmMM3ZiZEvA+6/6rT5bk8xgNAOR6EZ7r0r:EDiSY5UEdr0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138215, "uuid": "80e96906-a423-48a9-b0c0-f19d123b1f8c", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138215, "uuid": "aafdf44e-09c6-4709-88da-a69f2b5dca02", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138215, "uuid": "d27464b3-1d40-46a3-a8d3-0718b0f677a7", "value": "dc9d38febdf38c4223bbb818aef14ef1d58aafbe7a722ed479081bbcd41b4c43.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeb8a9a-daad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625172607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172607, "uuid": "f47472e7-d1ce-440b-810a-04cee864ab3c", "comment": "Malware payload", "value": "bf626a654af263749ec25d36b30a38f9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172607, "uuid": "7489dd85-288b-4f03-9196-5e0acf6c7c31", "comment": "Malware payload", "value": "dd1558bbd14818641c98ada72fc037df48a1739fa134bd02ef011bef56d33d9e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172607, "uuid": "d6cafe0d-5e5e-470f-8ff4-728eed2d4dfc", "comment": "Malware payload", "value": "5fa2bcc4d4af763f73125d00e5b3989e32c87938", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625172607, "uuid": "df319f6b-9452-4a0e-917f-e93b5936486b", "comment": "Malware payload", "value": "5563326762688208857825027174937a34ead2d3f473c72fd2083530dc05a64cefcca96b6c5fd0a60a356b44ba9344b6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172607, "uuid": "53bc802e-540f-417f-bbdf-4750ba8f2805", "value": "DEE358FA2469EDCE33FF946D0254D38DCAC2AEB6174ACBB1520181C2C7346A1D2D5A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172607, "uuid": "a33fac41-30eb-49a4-996e-9d430b06bcb7", "value": "1536:KaayG6v2WsIKOLyN+TH5ckN0w7kBOgybs4mlMyrFfntmvMvHW03W2acOh5O0tYGz:sInpmXpdMox5YGk0ph36Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625172607, "uuid": "ea50dcb0-069b-406d-a04d-26fc7b244fe9", "value": 143773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625172607, "uuid": "87d3767b-4f86-4257-81de-52e8f06505f1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625172607, "uuid": "18aa1a68-6c02-4cb2-9a13-73878d52f5ad", "value": "Payment_Advice_Summary_06292021.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12eb2bc-da2e-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625118071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118071, "uuid": "1e052106-bb6a-48fe-82a2-fd15cc886450", "comment": "Malware payload (BazaLoader)", "value": "04c10e9f9d677fe7cd87ecb8f682c88a", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118071, "uuid": "c8e650da-4dbf-4d76-be31-adc6020574b2", "comment": "Malware payload (BazaLoader)", "value": "e04c5bfeda44a81b6c820bf89515ab98bce767728c34919bed27a2767926a514", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118071, "uuid": "15494fb6-25e7-41cb-8b1e-376c508d49b8", "comment": "Malware payload (BazaLoader)", "value": "300e082db1542bdff361c131ebac92849993ffbd", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118071, "uuid": "ded0770f-ae1f-45d0-b6b2-82f7473f2780", "comment": "Malware payload (BazaLoader)", "value": "8b4871ca2ae614910069d3191d1aa3bab35e92bf102ec23169c36d9aa01724bdd2f285f59799fbc812abb2762a4504f4", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118071, "uuid": "76b54139-66fd-4bef-a8e4-d003ad59a167", "value": "3B54CF09B2B508ABEF6F9BB680939601B6723821C3759FDF475483799E0EBD0453AF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118071, "uuid": "660a802d-25fb-4e13-962a-03d69c6bb65f", "value": "365e89d9a085550ede8ce40eaac82aca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118071, "uuid": "47b45979-ebd2-4236-82e3-8d340236615f", "value": "6144:gc3BqZ6NCDsPC5Ufc8epw3GWRMO041VTPnrsb9hkf9C:gt5UfujOhVTPnry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118071, "uuid": "08d36e50-f893-4b26-a933-b8058e111d29", "value": 291847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118071, "uuid": "cc331d95-dfe2-4b4d-9448-387eba55857c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118071, "uuid": "0d271cc0-0891-41b8-b183-0b0fd11e7807", "value": "04c10e9f9d677fe7cd87ecb8f682c88a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b5d11d-da93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625161317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161317, "uuid": "cb8a0474-4844-425e-9b0a-d7d6890c3d68", "comment": "Malware payload", "value": "eadde5e39575d91cb613b840e9ad1ce2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161317, "uuid": "aa6e8749-4049-4f3b-8ec9-10675c1d4b50", "comment": "Malware payload", "value": "e11869b6475b5308b8c23356489835be4e7a6668714c0eb6d289cdf83eb0c81e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161317, "uuid": "728950f7-6a87-485a-8c9e-87abc9d36845", "comment": "Malware payload", "value": "738e362295cabb1dbfc8694e6462300116fdb778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625161317, "uuid": "115ecc79-5695-47a0-b422-3a0bff43c68e", "comment": "Malware payload", "value": "3a3af2b84642afb10877d06afb75d96ba13d7afa76d2b5cf3a1159cb14d7be45ba7ad01e37ecc790321e6b876ea7012f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161317, "uuid": "abeff9d3-d0d7-4fa4-825e-ba5dc05055cc", "value": "0994E1226781C872E1CB113985B687B54B6ABC129BB074C72BD43E7FAF246C1CF75219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161317, "uuid": "81021047-8fdb-43d6-8e44-b8b5292f419c", "value": "9c7729e7e6125436737710b1ba737d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161317, "uuid": "34ff3a2c-546d-4f2a-b110-9f2527c2a672", "value": "6144:E4Gp1gZmOqpDLlkMOzuOLWSbrrbysRLjq0wcAc1ot:SrgZmI56OLWS6sRLjFw61o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625161317, "uuid": "45758081-95a3-491c-b0cc-df12c7b2308a", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625161317, "uuid": "92d98b9a-979c-4edb-9536-601bdc9cb439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625161317, "uuid": "09070751-9eae-4f91-a6c3-2335f0b5e55b", "value": "eadde5e39575d91cb613b840e9ad1ce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337f6b7c-da61-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625139657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139657, "uuid": "a671e02f-6bad-4f82-bcd7-6b8de9dfbd79", "comment": "Malware payload (Loki)", "value": "7ee94644f9d6a3a9e45266faf8c8c526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139657, "uuid": "0bcbfa36-b4f9-4213-b9ad-27fd0b9e8cff", "comment": "Malware payload (Loki)", "value": "e16a0f6555a1caf9cceb1ffcf79b792df4cb4eab306b4df269c0a6adb27e53bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139657, "uuid": "0f404fde-038e-44ea-a06f-912edf4e4f5f", "comment": "Malware payload (Loki)", "value": "f5ec063cd5951ed3f1be01b125b0b0a14016f186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139657, "uuid": "bdfa7479-d8aa-4bee-a321-77af0e67c0e0", "comment": "Malware payload (Loki)", "value": "15a3b6efe2bbdb3593a457a9a3b63bc249754414a064efbe0c3d6b6e8d14e329e4813b5b1a16b1f5a7721a934a232ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139657, "uuid": "8cec3c41-3752-4b36-a217-9bbae9e753d1", "value": "E3458D11BD95D51AE0BA5F3D4AA5941452BEBD237F23DC6C3DB933DA0B3328388A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139657, "uuid": "436e8088-f7b1-42dd-90ab-e68fb0a3773c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139657, "uuid": "14394fd4-8e97-4001-a7dd-f6b4fa27f5a6", "value": "12288:X5ot4UWM2BbX5Tyw4y2pt+4y2ptXnSOiD7bFJwEM178ugyUADSyd7dt97N2zKk+z:Xf+yoyw5iDNJwEMwugyLDLd7x7dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139657, "uuid": "89f00512-d1e7-4575-980f-061b4684f7d1", "value": 1254912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139657, "uuid": "0711b75b-d12f-4535-bd99-e73901868663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139657, "uuid": "35bfb4c4-e903-4428-862d-466121f68da9", "value": "7ee94644f9d6a3a9e45266faf8c8c526.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8776acc-da6c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625144712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625144712, "uuid": "b4d7fffe-8bbc-4be7-a261-953349a96fc4", "comment": "Malware payload (RaccoonStealer)", "value": "be660e84f554b37e9a9f3dba3a24daef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625144712, "uuid": "87cbe3cb-ab32-4e8f-a8f8-f94addc94538", "comment": "Malware payload (RaccoonStealer)", "value": "e220d3ad9c8d7eb0c65fb77c962dfec00c1f3eebc92aee35e8a7e75ca87509c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625144712, "uuid": "bfcb934e-04c0-4dc6-90e2-2475363e1664", "comment": "Malware payload (RaccoonStealer)", "value": "414060f94f80941a711441c12ab0d9c4a7a3e5fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625144712, "uuid": "a99205ab-77da-45fb-9d45-7e15a6b289cd", "comment": "Malware payload (RaccoonStealer)", "value": "d0e7d0adb64968d1345f16906602030469457a4ab16ab33009165658a3ccdeb63383118238a86ae3989f74f6c83fae1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625144712, "uuid": "d80dffd9-6a09-4459-a26c-07b186f08da5", "value": "91058B0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625144712, "uuid": "64d73f22-5f29-451e-a0f2-034d26ab30bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625144712, "uuid": "f27c6cd3-1b07-480f-a67e-94bf84eecf65", "value": "24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaDUK5:th+ZkldoPK8YaDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625144712, "uuid": "a687a560-a9a6-4500-bb82-88e4552c7b48", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625144712, "uuid": "12f4ed10-1774-4bbe-8531-f3a494bbe027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625144712, "uuid": "17cbd199-aaf1-44c4-a961-97069ede26bd", "value": "be660e84f554b37e9a9f3dba3a24daef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c36998-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625134821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134821, "uuid": "c4269d37-89b5-4fba-90a5-d34fa27d99a2", "comment": "Malware payload (Formbook)", "value": "7e06d1bcadf14d1a21c3a137c133fb6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134821, "uuid": "6e7edd19-7567-412e-a04f-988a27a66e34", "comment": "Malware payload (Formbook)", "value": "e2ee9ae1c0a60cde24b23313927a75e890b3cba57115ebcc9ac886e4eae48945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134821, "uuid": "ad20be0f-3e39-4625-b857-dd620b068ba3", "comment": "Malware payload (Formbook)", "value": "bfbce7685ee2f5b88ca2342127e5a461f2759421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134821, "uuid": "9bcca0b7-49a9-4d9f-8d28-e6b2abe17609", "comment": "Malware payload (Formbook)", "value": "e9a6046eced987c6601aeac5a19caacd68c027163f1e9ba30224dda098b3421e27169a017f30222bd0c4f12ab7addd0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134821, "uuid": "3edbab2f-142b-4095-baf5-661e54092c20", "value": "7945D00BF308AA45C8592638DCEFC27413B5EDD67C128B0B2E997ADD3C73715C9516A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134821, "uuid": "33e53e52-4185-42e0-91ca-f607e6095436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134821, "uuid": "ddb7d9f3-a922-47d5-b150-279bd936a569", "value": "24576:SCqR+kxs3DAnhzhljN2/1Qi6yIc9gSIaYmhx:SCHkxsTAnhzhh2Q/lqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134821, "uuid": "133c72b7-81ac-476e-b847-5bd84b5d3a6e", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134821, "uuid": "09508f70-067e-4627-9571-bb82abbf6099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134821, "uuid": "6cf67015-4361-46bc-8866-5bfe8b728c8d", "value": "7e06d1bcadf14d1a21c3a137c133fb6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df5f590-da60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625139245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139245, "uuid": "661ce2dd-8520-4b8a-9123-5891d46ed2d3", "comment": "Malware payload (AgentTesla)", "value": "49c6f66a2e76d004e6d1ff56c5bc7f5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139245, "uuid": "c26f03ed-223c-41c0-b181-b1e680fbf9f4", "comment": "Malware payload (AgentTesla)", "value": "e328a0687f5ea79a8e9565c8f0dbbc016971b25d0fb5ad95e49f570a45bad22d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139245, "uuid": "385b3554-2675-4630-aeac-9f00f90595b0", "comment": "Malware payload (AgentTesla)", "value": "59be4fa3ebc01a216aba7e5d84a6f7178fe6796c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625139245, "uuid": "2449debd-d2f0-4d25-b632-585b64250ccc", "comment": "Malware payload (AgentTesla)", "value": "a90c201db09b67cb160726ab2bb76d874a30cabe55ee93da7bc0314377308396caf094f0a5bb731805871ad7c859fcaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139245, "uuid": "793acddf-a77d-499e-bcbe-a1d51ee56de0", "value": "9E063D6041CE25E27B097F56BFFA00C468533AE7F47EF84AAE0509684F5ADC9C994738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139245, "uuid": "292a0f62-b1c8-4dc3-8763-063bb68892a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139245, "uuid": "871a74a7-7f69-4d4f-a304-c5729705e2b1", "value": "3072:C+8fYPHiAEjeIJSmqqqhFPmINMSjJeJpY51dMdoCyyDfOZW01j0lMRmE8MlS37gr:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625139245, "uuid": "724098ee-3a95-4327-9fea-20c181aab0c3", "value": 3924480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625139245, "uuid": "e48619d5-8339-45f7-8c40-e665c8cbbd0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625139245, "uuid": "84d43e93-a8b5-463c-9173-c0d319b9e00d", "value": "don_file (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137c2c42-da7c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625151200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151200, "uuid": "9d7ed147-7762-4b9d-9abb-516dd36f48ea", "comment": "Malware payload (Formbook)", "value": "c43b44c1b16050963dfdd9a6b4279a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151200, "uuid": "82673df7-6b30-4c43-b60b-ca4b74b183ee", "comment": "Malware payload (Formbook)", "value": "e353357d1b27fe4845d04d1927ad24b4c2963908f7e942d502cb1c5067677934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151200, "uuid": "5cd0cb88-9de5-48d7-9355-2b59fa1173b8", "comment": "Malware payload (Formbook)", "value": "c4629223ff65f31a2f19ca3f7503ed19fc5d1a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625151200, "uuid": "02f31f52-0cee-4bd3-aa70-f10c157a074a", "comment": "Malware payload (Formbook)", "value": "0b5cacaa2e92e055f2b9e29d69cd7b0c64ab042a19208d21bbaa2e0da9ea4985d17083d937bf430c32897ac5406400b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151200, "uuid": "3dbae689-4ffa-448b-bc33-01246316fa33", "value": "E3059E1C2DA85035E4F95FBC86E06552976DEE2F2F03991924B1FEC53733642C9EC22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151200, "uuid": "e44329b7-2d27-45ea-a993-2576956f7ddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151200, "uuid": "4cb37a39-5392-4b39-b45e-d19b1a187b1c", "value": "12288:Gns6ABbX5TyMULUBUs7uf5AEWqfGLduyG74y19wf8/mH2kLOIm9UiQgl7:f5pULUBH6SEWqf0AZ4xfxH3ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625151200, "uuid": "2fa4a78a-2a28-4116-a071-951184c9534d", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625151200, "uuid": "1599d25d-a76e-4571-914f-38e69f431b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625151200, "uuid": "02b87ddf-8b50-4a0b-9258-7cc2b3a1ee1a", "value": "IMAGE#4020-40586.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b0cd60-da77-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625149276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149276, "uuid": "2970242e-a3a8-4d54-b746-02a972586d74", "comment": "Malware payload (RemcosRAT)", "value": "c431d09b3af2211a74331c6d8fae7b6d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149276, "uuid": "8bf5ed00-0932-483e-8ddb-6178d668dda2", "comment": "Malware payload (RemcosRAT)", "value": "e44ff3e7d575fbc24d4d206e20c1d1f7bca10350b1bcf21ac9465b7d37b9f885", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149276, "uuid": "4ad5f5ee-d5ae-4553-a652-e1a9aa9a6a9b", "comment": "Malware payload (RemcosRAT)", "value": "5713f7bfd9453ea2a1a85733213a256e6b15a765", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625149276, "uuid": "592f00bc-1c4d-4cfe-af1d-46c62b9e5985", "comment": "Malware payload (RemcosRAT)", "value": "02d0da6495c28034c373d02d81167c66f2217da0b8b16188baa3ad7b6cd3b8bd378091bce52d0a839b33c3ed2443871e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149276, "uuid": "4f8d8aee-7a43-4010-8d03-44d9b1fdc7eb", "value": "707433A4119F8272E6488E4D35C0B1895E75FE9230CACC2963AECA71DF55AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149276, "uuid": "25fa5ae1-a869-407f-8f29-41a272149217", "value": "3072:9tBrB2BrB8hK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHslXueyd9nIn4xkV57/csKPW:ZVcV8OWdzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625149276, "uuid": "768b27bb-0f01-4153-b7b2-2cdf09bcea7c", "value": 342892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625149276, "uuid": "b62355d7-364d-46a4-bb19-9e78b1eb47a1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625149276, "uuid": "d5f475b9-574f-4f82-ac28-90753986770c", "value": "Product catalogue1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb936a43-da7a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150703, "uuid": "379c82d7-049a-48b2-9c6d-f9491c04e0cc", "comment": "Malware payload", "value": "5ddfbddf74d9e09bf434940362019979", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150703, "uuid": "82421274-6f4f-417f-8b3a-92bd33e62d20", "comment": "Malware payload", "value": "e615a06c4539fc5fabedd46658fdc2ff534d0173f9043162f3809ef3002f0a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150703, "uuid": "f9f2e4f8-23a6-42e3-84b9-b2ba8cdeebb1", "comment": "Malware payload", "value": "595d69d9fc35b83cd8d6567e88ab6526582576e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150703, "uuid": "df96abd4-05fd-49e5-aa44-90ad69471570", "comment": "Malware payload", "value": "a7a1de0e990d87193b29132a8dd2bde8083d104e359fdb8d3496cf1d91f48893f7ac15ee07f2ea4feccacfe035ae8c53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150703, "uuid": "5033ae2e-f806-4d51-8fc9-69c414199c73", "value": "710539D45E9A702ED0BA6F7C755050FD83AB7E231A8E97EA12F3F9C64733141C8A0295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150703, "uuid": "73b17e76-8672-4d53-aedf-d07fbc4a5216", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150703, "uuid": "f989ed53-9b0c-4e93-bd89-4e6de4e6b2c4", "value": "12288:fClBbX5Ty5syL0CR8gotz/S31L/5C9RJl7ICfLcpy:faUxLPigotulL/I9RACfLco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150703, "uuid": "eab57c4a-fc4b-4fb7-8788-1c8bf8c395f0", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150703, "uuid": "034d544c-0e85-433b-a3f5-416a9f42cf37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150703, "uuid": "4e36f73b-47c2-423d-9f8d-6530c603b31e", "value": "5ddfbddf74d9e09bf434940362019979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d7a6f7-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169436, "uuid": "5d12255a-e97c-4753-84c9-045463dbfed1", "comment": "Malware payload", "value": "ccc7f88b72c286fd756e76309022e9f8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169436, "uuid": "575fcb6e-053b-4b5c-9744-b79e619f062f", "comment": "Malware payload", "value": "e683c86fd40eac23bc6435f479518ea5d80f90da294d5ad21d024dd7acc8a6ac", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169436, "uuid": "0aceb449-50d3-452b-8cf6-080e54383554", "comment": "Malware payload", "value": "4f2ba5c8848ec94835f4070acb92dcad46769995", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169436, "uuid": "98c87ee4-ed5a-4bda-9848-2b7c23b8dcc9", "comment": "Malware payload", "value": "b63ce6863c17b3fd120188ae1f387a8baff412fa56e0a1b5104bd76418d66e8beb6504c5caadacd7707de725380999fb", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169436, "uuid": "3a6fc045-bbc0-4f32-866a-8f253a33486e", "value": "0A936C13F5E4D076E0230531AA6AB7A348BBBA339935011BF745067D6EE40E24E3B793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169436, "uuid": "c3b0ba7f-e436-4494-b56b-8294f841a61d", "value": "cddb7721dfb6b274295c36e2989d0590", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169436, "uuid": "e1b1fdc8-be53-434d-8b0b-d5babed38034", "value": "1536:80CXSuO6tzhogN+CL72NQ6To0xzW4wkEBXFa2UQPb2/:KS6pCgJLrUHZW4+a2UQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169436, "uuid": "226c1650-b8a1-40bd-a6a7-eba3bb6f5fac", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169436, "uuid": "d56f84af-5f84-42e3-92a1-ae8390d2d4a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169436, "uuid": "7081d684-e69c-4453-8dfd-aed2927d0df0", "value": "e683c86fd40eac23bc6435f479518ea5d80f90da294d5ad21d024dd7acc8a6ac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779718fd-daa9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170695, "uuid": "7b4de453-d485-44b2-bddb-1603d91529d1", "comment": "Malware payload (Mirai)", "value": "badcdbd6e7d15ec9d7690364401051d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170695, "uuid": "c1404b1b-da50-4f40-8585-76d212255882", "comment": "Malware payload (Mirai)", "value": "e6c9f7f105c2c55293c56f0aeb1ed6a4898534ad399d6a8abd9f98f5cc546db1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170695, "uuid": "0aa90142-2bac-44de-a19c-7bf22def0a36", "comment": "Malware payload (Mirai)", "value": "11c184afa9eef118ada3d97402a743f1ec1458ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170695, "uuid": "9fa09463-d450-402b-8868-dfc3553543b3", "comment": "Malware payload (Mirai)", "value": "9aa0390a49b28f01f33229bbcb5ed8ce0a53208c543bad691949ce4fffa82e50731535dbe52b8607866c3f25fdac7cfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170695, "uuid": "7a3d9fe1-3fef-417f-bd7f-99381e9ecc53", "value": "6423021164930DD2E810F8FAC0C04ACDA7BEA0B9E1AFA7E7054689B66D55DCBDC7474C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170695, "uuid": "8082ffd7-86cb-40b6-ae72-bb8ec979369f", "value": "768:MK7y1XGOC/p3l81xe1849E5Ljhkeb6B9q3UELct/iw+kAYYQcp2SFd1MF:O12Omp3l81V4Slhky60Lchiw+kXYflF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170695, "uuid": "889b7b71-8161-4d5a-83ce-e6f25edd827e", "value": 48712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170695, "uuid": "ed69d7c5-eaf2-4c75-9243-9a7efe6383ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170695, "uuid": "972b7edc-f4bb-4a42-aeba-94a3afb1c251", "value": "badcdbd6e7d15ec9d7690364401051d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559792b9-da4f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625131983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131983, "uuid": "8e5aaa68-f2cc-4bc7-b7ca-0cf6d8e1caef", "comment": "Malware payload (NanoCore)", "value": "e878302e18fbbf24520dbad1f2105a60", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131983, "uuid": "badb21ac-e8d5-4b4f-a5d6-5d31a4d71015", "comment": "Malware payload (NanoCore)", "value": "e78c379150f1d1dbb3f655d2df110a160462ee3f6a8c9fa73a1ba9f0e65f0907", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131983, "uuid": "1c0730bc-fcc9-4a01-b4a2-853990912fa8", "comment": "Malware payload (NanoCore)", "value": "4d813861b68c8fb3c7c9263eef2de8224521bf28", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625131983, "uuid": "b1affbe9-be0c-4a43-a878-d5b7bf7e30c3", "comment": "Malware payload (NanoCore)", "value": "f9d9dad12365617b8bafae32c5c782a6a3a84e51db1d290907ee2348d183ef8528dadfc90df22e1b757ef00092d146a7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131983, "uuid": "3f13bcc6-6f99-4f06-8de9-56a4065bfbf8", "value": "AE7433A4119F8272E6484E4D35C0B1895E75FE9230CACC2A63AECA71DF55AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131983, "uuid": "7bf40642-1892-4c68-ae83-ca0d062979cd", "value": "3072:9gBrB2BrB8hK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHulXueyd9nIn4xkV57/csKPW:MVcV8oWdzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625131983, "uuid": "c376ee10-0ef3-4c5d-96a8-5114d6544737", "value": 342309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625131983, "uuid": "2a2622ed-b76a-49b2-9732-db683f60a3b7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625131983, "uuid": "47cd8c62-5536-4c2f-93bd-7513093197cd", "value": "new Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9383fcf4-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169453, "uuid": "d8814d90-45c6-4a34-a46a-20ee42d83743", "comment": "Malware payload", "value": "c00f6268075e3af85176bf0b00c66c13", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169453, "uuid": "92de3cf2-506a-436e-9389-1ab551237812", "comment": "Malware payload", "value": "e9013f35ce11fc4c5eb2c21827bdc459202d362365d6ea5b724dee4fe0088bd1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169453, "uuid": "2dfcd6ec-7583-4091-b16d-a20d650873bb", "comment": "Malware payload", "value": "a3343f4cd3eb8415d3b787ff442074180d108d3a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169453, "uuid": "2bf2c981-1fb7-47a9-a8ec-31896918cc24", "comment": "Malware payload", "value": "de8970bdfb8314664a701e275f66c36acb7c398d29e02604d537ffd902d83664e8a984a434cef685e966bfe60e218ca3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169453, "uuid": "978c3c7a-d075-4c97-a6f9-1469cd1ea422", "value": "D4638D1375E1D072D02245B1AC25E6B28AAFF9736A758047BBC912BE6FB01D09F38357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169453, "uuid": "99988946-c825-4902-a3ba-731d06ebf81a", "value": "a6afa5b03e3f460fa6ef1066cf588231", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169453, "uuid": "0442e10c-401f-4bd8-85b7-29b5f41843d9", "value": "1536:neI1HbPFWt/K1MfvR4ZxVhN0kzAsroD90cb:l17dWt/KK2xVhlAsED9nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169453, "uuid": "f5bf4901-c6a1-4298-9339-da16e9182931", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169453, "uuid": "78402a47-069c-4e50-b819-a4005ce0d91e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169453, "uuid": "f3801e61-09e3-48b2-a89c-c2535ed6d389", "value": "e9013f35ce11fc4c5eb2c21827bdc459202d362365d6ea5b724dee4fe0088bd1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df06a513-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625133502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133502, "uuid": "92375de6-37bb-4412-854c-7ea98ef2f6b9", "comment": "Malware payload (AgentTesla)", "value": "3e6a85c99306943e28dbbacc95cfe52c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133502, "uuid": "9c6a5f1c-5285-4008-909b-9ded256e7576", "comment": "Malware payload (AgentTesla)", "value": "e945bb8adf04184220759eee4322100778cbe096875c8cb0d21ee7d01d36e457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133502, "uuid": "748a1ca1-07ed-4d46-86d1-eaae2588d99a", "comment": "Malware payload (AgentTesla)", "value": "5397f0d2c49f4df65d09c41715a4a68ad622684b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133502, "uuid": "55200ea1-09bf-4707-8cad-f93205a72d86", "comment": "Malware payload (AgentTesla)", "value": "630712156e44b5a01fe0c575f6bf1f157699a63ab2c2adcee9bdfdfa7779abc7bc9f36acaf196b0c6a9e6d5835de558d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133502, "uuid": "4ede052a-6e81-4506-be3e-3d8197906a52", "value": "85C412243AFC06A4C2764F331BB57106D7BEE63A781EE55D18C3068D49E6B41CED0B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133502, "uuid": "dc2a6a67-957a-4189-84bd-58d808331d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133502, "uuid": "e84fa765-7b31-42f7-a20c-4a3902c32635", "value": "12288:9o8fiQYO7JMAFygxLZbVmqaCoMxfZ2E1J3VeRIJX3gocr:i8aQY2JRlLlVmqfvEE1J3VeRIJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133502, "uuid": "e8ed1831-2e65-4b48-8417-1c6d31fdc69e", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133502, "uuid": "761b5d9a-9d72-4160-be79-f634603f46da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133502, "uuid": "c294cf6c-4f0a-4685-a37e-cdd2eca1c3c9", "value": "3e6a85c99306943e28dbbacc95cfe52c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61949a02-da2d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625117401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117401, "uuid": "8aeecac5-96a2-4ab5-9189-7052126bae25", "comment": "Malware payload (AgentTesla)", "value": "cce761a6801c7b93374efc6fac094941", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117401, "uuid": "348f181a-81d9-4d40-92f2-e04a93b24dcc", "comment": "Malware payload (AgentTesla)", "value": "ea1cdd93670b588f9719c7ecf883586b1f393cf3f84e61ec8502ca9ee327716e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117401, "uuid": "a920b708-c599-459b-a16f-4664c7f5baa1", "comment": "Malware payload (AgentTesla)", "value": "79240889d134ef26566543151f3abaca0d949e9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117401, "uuid": "2468796b-8026-464d-b47b-5b47c2782451", "comment": "Malware payload (AgentTesla)", "value": "3fc968c37d9c8bfae4aeb7ebfc672093d38b1b47fd1a6ea915791022ff54611813235d90e836bb6b71bb99ba4282d8bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117401, "uuid": "4a99607d-401f-41c3-8dae-98e929b7afaa", "value": "FCE423E4162ED071FC24BF3213C279D1DA1997B5DB3B2AC27DB7B230185E5B489D2622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117401, "uuid": "3e2667d2-2702-4b12-b016-3b8049d5bd39", "value": "12288:iuxCdHnSIIMuO5zx5JURcWSkWmrXQCJlLg9JSqnc9KMob+5m+X0:iRhPweNfmrh+7sKMUMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625117401, "uuid": "b7b1de21-ac82-49ec-9092-e99ba653789f", "value": 691352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625117401, "uuid": "22883672-1d73-4e32-83b2-ea0597b44415", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117401, "uuid": "a88549eb-9d0a-4514-be04-0ba593089db4", "value": "UPDATED S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda6ed2a-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134735, "uuid": "932a2e03-dc9d-4a7f-85ad-e354d0b64286", "comment": "Malware payload (AgentTesla)", "value": "330cd800ae02945a12fa8e99e06724ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134735, "uuid": "b8ae70f5-61f1-4cad-84a2-ec507564c830", "comment": "Malware payload (AgentTesla)", "value": "ea831d181c370ffd8dbfe01745f662406e2cd2ebbb517c071ea03195828927a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134735, "uuid": "a8218c78-4fac-4bfa-83d5-4ada8339d4f6", "comment": "Malware payload (AgentTesla)", "value": "09c5df0cdd88042b0c491203383843598db80d10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134735, "uuid": "4b194d45-a9e8-40f4-bf36-54bcc6fdf75f", "comment": "Malware payload (AgentTesla)", "value": "f8b99f24a995a81d55331989469172e0a4fa60b716c33704f90291870947eb36e8e8f74fc7aab9e7b083a9a5bc2329b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134735, "uuid": "99532d26-ff13-45ab-b5df-6b2ac2df09ef", "value": "BE359E15BEA89026D4B65F7DDDE991A1526DFE633F038A1E24B536CD2B33601C8E027C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134735, "uuid": "8d7e9c51-5933-4d7f-934e-addfe4c2c843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134735, "uuid": "3706e45b-1d71-412d-93f9-3706e99da535", "value": "12288:MjxdBbX5Tyr8hzh2viDER75J4MsuztZB/vr8eurEfvzmyXhp:AU8hzh2KDER75J4M//vwQSyXhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134735, "uuid": "eddf6fec-cd77-4993-a166-432702243576", "value": 1154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134735, "uuid": "b82f71d5-b118-4923-b72f-bcd466171b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134735, "uuid": "b5e08815-3e78-4524-a97c-d97100b74b56", "value": "330cd800ae02945a12fa8e99e06724ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f53be6-da64-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625140866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140866, "uuid": "3d9eb41f-6c5f-4b04-9dbd-3a32d5439cb5", "comment": "Malware payload", "value": "397b4cd1f1b9e6a308e6dff423c62c3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140866, "uuid": "9d415faa-5c83-4e46-8264-8960d071cde1", "comment": "Malware payload", "value": "ebd46183b53aca011bbd1c430296089477faf2e2130e8d9da3c633f9a38e3488", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140866, "uuid": "abd29947-d888-4200-bece-102282f8f8a3", "comment": "Malware payload", "value": "4e8be84f4ffb4fcb63a3db24ddb474593da8a5af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625140866, "uuid": "589cee9e-f74d-40ec-b254-e9d5ceef1eba", "comment": "Malware payload", "value": "a32f844f4961d217e20c41336664caa0b24c04c72fadf3e0d48f0e84cbdf51c739cdd12ea53c8af4eda0dd12da761dc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140866, "uuid": "6c90a402-89cf-40f9-9c5a-0834c3490079", "value": "D40472272357C475C1C42230E0A1CB3B3668CD270770725AB4CAAEABBD6B24D5DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140866, "uuid": "ab6e3140-6ebd-49cb-889e-eb7cc0126ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140866, "uuid": "50ca677f-51ef-4597-bcb4-1458bfcd4294", "value": "3072:W50trK3HVOYwIhw5kWXNHefmX77MeW6pc4/4/42:W5V3blieY37MeW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625140866, "uuid": "e6849570-ed3a-4120-be1c-affbf20c27b3", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625140866, "uuid": "2f31e77d-1c66-4244-bfc6-0188044e40fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625140866, "uuid": "38393fcf-40b2-48f9-9496-242b051c2770", "value": "397b4cd1f1b9e6a308e6dff423c62c3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d626081-da37-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625121662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121662, "uuid": "a2743148-0900-499d-bbae-d60399b0231e", "comment": "Malware payload (Loki)", "value": "d4d7d25d2820540d25a6e8f76043d192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121662, "uuid": "ac31e87a-9b7d-4608-8e9a-d43224a20e36", "comment": "Malware payload (Loki)", "value": "edf026e5574ffb90f1df86e95bfb3dd6a3391c2ddc5786afc4506cf9c31e80ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121662, "uuid": "82077339-f613-467b-a011-c3de7afa7f2a", "comment": "Malware payload (Loki)", "value": "eadbfcee6a0489db53350ff3ad17d5276080e63d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625121662, "uuid": "9fd37168-b5e2-4f35-b031-e86464e48236", "comment": "Malware payload (Loki)", "value": "eb9f7ea45647b93cb88440234464cd058cf86e4fb69ab5fc6872f15f2fa1e498cd80f592bcd39c4ceb8d913d6f763ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121662, "uuid": "49998ec3-4d30-4238-9b1d-526b8884f29a", "value": "0835CF07F7449A45C8692238DCEFC2B413B9DD967C128B0B2E997AED3C72756CC513A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121662, "uuid": "4889a493-6178-44bd-8f5f-fa123d5e57a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121662, "uuid": "8964aa78-c625-4035-88af-633510bdd893", "value": "24576:FhzhqaC6C2ncd4izrCVY/8P3l4w4OKRhhh:FhzhbVvq++/s4Nfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625121662, "uuid": "f3054c23-4c1b-4813-bbe2-2f0f155965f7", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625121662, "uuid": "da8a64eb-e17c-407b-bcd0-1395b43cfd7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625121662, "uuid": "9623a16a-75b2-4e0d-b596-76969d6f42bf", "value": "?????PO210701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deba008-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625122844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122844, "uuid": "fe1ac294-7e8b-4140-b81d-4f66b1f9e45b", "comment": "Malware payload (Mirai)", "value": "8d80776ab03b6b3edc780a7b09e1cbc6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122844, "uuid": "5fa93c91-a4bb-4c1f-8bc7-b91146025edc", "comment": "Malware payload (Mirai)", "value": "eeefa38dfc10a999cfc7a0fa0c13917466196a0f770d7fb696b692d7d6616950", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122844, "uuid": "e6e81f38-70d8-4038-b2db-7a55f4c321e9", "comment": "Malware payload (Mirai)", "value": "82a0d9a22fe5bae23d37645acc014d7c49fe5e59", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122844, "uuid": "51dd49cb-d58d-4e9e-8d45-cd392edfa617", "comment": "Malware payload (Mirai)", "value": "5f8e85b96760abf26c295a65eb1b6b2e332eb6f7dac3e41cb3453e18fa0bcad5cccd2af22f1de3fee223185b4278854c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122844, "uuid": "0ebbdd9e-ad7f-4c69-bf5d-946874a326d4", "value": "4A64E08AEE01AE25E9C016B9FA5F034D73778BACD3DBB111E610C72936DA54B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122844, "uuid": "743b95c6-c059-4a98-b14c-d97036181c8f", "value": "6144:p3lOYoaja8xzx/0wsxzSiHa77oNsKqqfPqOJ:p1CG/jsxzXHa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625122844, "uuid": "6a168442-af5a-46d7-947d-f7bd51884839", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625122844, "uuid": "e4c4e7a5-7277-46d4-adf8-e24f109c6e4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122844, "uuid": "7b5b8f76-3912-4688-ae75-c227686dbb69", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc807ba-da52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625133309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133309, "uuid": "f6a61ff6-9512-4007-8890-ff27c0249353", "comment": "Malware payload", "value": "61f052c62cc122aae331317e493275bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133309, "uuid": "77b39ea4-eae8-49cd-869a-b0ea4cc008b8", "comment": "Malware payload", "value": "f03e44339ccec266337496169d478be9683f0a6057d58697d2942a52aebbf7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133309, "uuid": "3f252f1a-1ee1-4dc9-979b-c26453ed85bf", "comment": "Malware payload", "value": "07a18ecc412f8ef692bcedf7941823f26c12719e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133309, "uuid": "6548f232-fd8a-471c-a0a5-39fb3a6acab3", "comment": "Malware payload", "value": "6eea184f9c761086d1c7c8b28a072d6da060a3309f8bacb320dd9fdb0e640fbc67e4bc787979962be5fb9aecd8a7ccc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133309, "uuid": "dd96c729-fef3-45f8-bdf3-4ce09325759e", "value": "5E3523382AFD226DC37A673B10F0711ADB7D6773B91BC22A24A5454E45C7A40CAF127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133309, "uuid": "9e30f048-d439-4a96-9fea-31668c5028aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133309, "uuid": "20f6c3dd-c338-4878-813c-c71382b7dfa8", "value": "24576:Z/shGI02qw0UUgOZ/jnmmZ+zX5KZE7jpqRLlXRJG3:ZUhGI02FmHZ2+TxXTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133309, "uuid": "27249411-ba34-4d97-bbbb-aa7ca6c5148f", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133309, "uuid": "d1972c6d-2ea5-41bf-8efe-6a98f6b647b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133309, "uuid": "39f1594d-1f1e-4717-9b96-1b30ee94d85b", "value": "61f052c62cc122aae331317e493275bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e59e2b-da2e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625117950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117950, "uuid": "43ccb07b-970e-4bdf-a015-cfd81481cd8c", "comment": "Malware payload (AgentTesla)", "value": "01bed8a3f652f4c4a1792fcfabec7b86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117950, "uuid": "a2f37114-83c2-4e25-bf59-a9a79418625a", "comment": "Malware payload (AgentTesla)", "value": "f077eba249e41b618f2beca6307585844eada56f528de4fa2468dce43a81fbda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117950, "uuid": "edffd31b-a79d-48de-944b-1f0036441c2a", "comment": "Malware payload (AgentTesla)", "value": "8f96af6e7e60f1d8c49efc6566ba17a0e930de50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625117950, "uuid": "53cbfcf3-5c54-42c6-b1fd-e6730ee3b2ed", "comment": "Malware payload (AgentTesla)", "value": "cf44d14e79fdc910aa331abe42e383d4ecdeb3ae40aaecf14d7e2bf6b59654e7c5ba4ff5ff34d3e54db05e06be2353be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117950, "uuid": "1f094ebb-b0f0-4c4d-a2d4-b768678ef020", "value": "98F4023825FAC818F8BF0BBD99D6B1819777A9226231D31D1049129E4F63B42CE6177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117950, "uuid": "0f3110b2-c85d-4171-958c-bf29b2a7b927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117950, "uuid": "2257b3d0-2eca-4e4d-9f5d-3e3751ed4550", "value": "24576:FqDoKgwUrbE9DUgRg/tYnZjZdquMF7SnI4wJ:FINUrbE6gRktQ8ngg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625117950, "uuid": "2c147067-2063-46d3-8bd0-fff56fea173e", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625117950, "uuid": "971dba01-04f9-4da6-a198-8c87554b14ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625117950, "uuid": "06b577d8-2f8e-46b0-809c-d586c3ed3f7f", "value": "NEW P O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc9a40e-da5b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625137396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137396, "uuid": "1bc1767b-0ed9-4ff4-80e3-afedd9ee1fe3", "comment": "Malware payload (AgentTesla)", "value": "55792544ad840eaa0fdbe5cc04683529", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137396, "uuid": "5397a6ee-057f-4eea-9c76-adbff007277f", "comment": "Malware payload (AgentTesla)", "value": "f0fbd7ed1921ad8c47a0b91b32487d4cdeb7bd72ea54f49434ff91da0273e31c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137396, "uuid": "4087c6a1-2e51-4282-a105-689535187f88", "comment": "Malware payload (AgentTesla)", "value": "80c482b268197f0d1766a406e820f751b45de184", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625137396, "uuid": "e90801f3-7b85-4c9d-a596-7e90ebf91ee5", "comment": "Malware payload (AgentTesla)", "value": "a3194acfa4f55191f19265ad7fa44785ac291ed5a748e37befc3ce172c94df60c4bdcd30b20758506d75705a3996b6cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137396, "uuid": "f126a453-6227-4494-920b-a1eec56728d4", "value": "437433A4119F8272E6484E4D35C0B1895E75FE9230CACC2A63AECA71DF55AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137396, "uuid": "2e91fffd-e9ee-4607-8983-fa6a8d78c900", "value": "3072:9gBrB2BrBOhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHlcjmHC/fhi4txeHry1oziLy:MVcVOfc9dzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625137396, "uuid": "1e7ad92b-d479-4ae9-8213-659729c0f067", "value": 342325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625137396, "uuid": "912ac56d-a12a-4591-8a6c-57ce2909589a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625137396, "uuid": "db87eb09-ea17-4c50-9361-919ddf9e399b", "value": "Scanned Document.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec27211f-daa8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170461, "uuid": "ffde0b9a-de27-4701-9186-ffa35da28d43", "comment": "Malware payload (Mirai)", "value": "605b38b6cc8c4ad4706ff58313179f16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170461, "uuid": "04f698d7-170a-4669-97e8-e21fb84d855e", "comment": "Malware payload (Mirai)", "value": "f1392a230e3daf8f00a2338bf56d4aee9bbdc5463fa03f5a0bec2bdbf4e775d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170461, "uuid": "09482098-ea5a-4a7f-88af-6e990538f253", "comment": "Malware payload (Mirai)", "value": "c92025670cdec4753f0cf10b8460e6191e637600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170461, "uuid": "4ada1694-53b1-4c58-9140-6d4d6bec028c", "comment": "Malware payload (Mirai)", "value": "154e8b866c0efbbe2fcc7a745f196ff6eb51ebcc041a0df0da5be5e4de16f6c502c45e5609327237c90c6181b82ac1d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170461, "uuid": "fd82ac2e-624b-4700-9184-ffce4f7c4987", "value": "B6B2D155C2195AF1CBFF8D34196296E073A50F8E4B22CCA2F2D2DF139145C2B01846DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170461, "uuid": "363fb514-420a-4550-bf41-4d5e93512518", "value": "384:Bn+fhb79/cRN66PJEFpB5/aWKgZqAkjCjnHkrygv4p67MstxpCVQM4uVcqgw05Vq:wfht0X6oErB5/aUZqAIsnEpXiP4uVcql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170461, "uuid": "107af12f-8bae-40aa-8702-fd527b561db4", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170461, "uuid": "061811e0-5299-4bb8-89c0-248e94692112", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170461, "uuid": "b81bd071-22f0-48d3-83b4-87b74963f6e4", "value": "605b38b6cc8c4ad4706ff58313179f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f22db36-da3a-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625122953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122953, "uuid": "4636cd76-a3ab-43d4-8fb5-7da62a8fc7e1", "comment": "Malware payload (RemcosRAT)", "value": "2941c871eb1612be073828fa369a03c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122953, "uuid": "a85f433d-da2e-450a-8361-543de2a27177", "comment": "Malware payload (RemcosRAT)", "value": "f19b2e31a0bc55cb5d4ab540605cfeffca6dd241cbe4e96e065d403a7273534a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122953, "uuid": "4f78575d-98f3-4e44-a0f2-2e8f786686e3", "comment": "Malware payload (RemcosRAT)", "value": "8a4cc7f0dfdbd9edc94f2e08e485f876980f808e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625122953, "uuid": "27ae71d0-8e3f-46ea-8d59-e0914b01cfa7", "comment": "Malware payload (RemcosRAT)", "value": "eac2c264d8b22f6228331da9b15bdb5dcdf29366919ffe26f2761e7e3345ee714ee2466c724505bc2f84fd778877744e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122953, "uuid": "aeb69854-6828-484e-868f-7e11d19afdf4", "value": "95D40138B9BA8909F57E0FB998E460C1877B75312632E60E544D218E0F43F918E65B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122953, "uuid": "1b3aad7a-2c05-434b-bfb5-e2aad0b72403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122953, "uuid": "eb1abe88-c24f-4d31-ac6e-d1ba0e3090c7", "value": "12288:RxZR+1lVz1hgvIcZr7RxYeaRSIB0twCbcZWXZ15o4vz1iIaL2/x8KI:HvElVz1/cZPnlQZWXZM4b1L/xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625122953, "uuid": "330844fe-a227-4b18-b54d-8f5143ef4f09", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625122953, "uuid": "2a051780-7614-41eb-a860-ac7b2cf66473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625122953, "uuid": "bd358b00-1eb6-497d-86e3-0c574feb2985", "value": "2941c871eb1612be073828fa369a03c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ee401c-da2f-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625118508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118508, "uuid": "a28f4a08-af45-4562-9868-7ee02e67c9f8", "comment": "Malware payload (AsyncRAT)", "value": "116f7462dc3df6b704736114572e5b2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118508, "uuid": "e35c4e8c-fd06-4ce4-b5d9-d177a100b32c", "comment": "Malware payload (AsyncRAT)", "value": "f1aa48a5d134df8e09362e0c55647e8d550c974f3fe92083cd5e33806bca27b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118508, "uuid": "a50df9b7-e074-4b16-858c-1f2db616c5e7", "comment": "Malware payload (AsyncRAT)", "value": "806fdec10b1d45f17022dc23a57a83308deb10a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625118508, "uuid": "d6022f25-8b71-4009-ac18-857216afe525", "comment": "Malware payload (AsyncRAT)", "value": "6db0e904754e1cf926aaac3cf3df3064f2efcb018c70bf10542212d096f5dd5f7dca5c315fc9c4ecae5ab016409fc039", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118508, "uuid": "f21b62f1-f78c-40c7-9f9f-b483f71c4eb7", "value": "92D412873AD1D435F67B24355834E9B4467FFA154B64EEAB2388023A1F30AD15C36DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118508, "uuid": "e1b2396e-e31e-45b2-b84f-bc64183ab36c", "value": "1a6642dbc8d924a440c6f0c0bee8c1e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118508, "uuid": "7b02399b-e2fd-47fa-9c73-795bb9d467f6", "value": "12288:nE8Rbuh4YmGpAenrYjHVPeMOUCas24d6ezmId855n6GUTWMGK5xsCJ:nEobuh4dGpAIQHVPGsneqIM56dWMG2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625118508, "uuid": "5c5e82b0-44c5-47f3-95f3-f59f4af49e52", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625118508, "uuid": "0eb5e63d-0951-4854-ba5f-c3bb53f91342", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625118508, "uuid": "57dcdcc3-b50e-4a10-96cc-2681eb7c65c0", "value": "116f7462dc3df6b704736114572e5b2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817e417f-da50-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625132486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132486, "uuid": "d15d5555-de9d-4bc2-95e2-489194659540", "comment": "Malware payload (AgentTesla)", "value": "aa212c0f86f8bbb259d2f9d00ba6801a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132486, "uuid": "a6fc3249-2374-4c48-93fa-168ed4a01c4a", "comment": "Malware payload (AgentTesla)", "value": "f2722185144e316d55f4bd76aafc3d43ad9b67d714a08a2f174c93a93487c98b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132486, "uuid": "183eaaca-9586-401c-b647-34c8201610ef", "comment": "Malware payload (AgentTesla)", "value": "46c04c9a7a8c74a2c3be05c49e94150fc1cb679f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625132486, "uuid": "fcbc3fd1-ecfd-418d-ad5c-0132a7694183", "comment": "Malware payload (AgentTesla)", "value": "b4966b05aab18d99f667591cd34ad3f6cf66e5d10f74e5651e98b1bba89289acdc0f92dd785eecabceda76bf59351ebf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132486, "uuid": "48df548d-3208-4f34-93fb-407e15873270", "value": "DC51F87826059963F71FA1F78B38F13817727922C9C60DCAFCA6AA6512B20629553C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132486, "uuid": "e2369731-1285-493b-99a0-78eec3664038", "value": "48:NMf9FE6rrPAzUy5tr6zx5N1PmyQ8f8ARVaDy6mDieDiuEbRM7P5yImfEUyld+C:ef9O6r7Azl0x5N1OyH80sF70Eb25yImE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625132486, "uuid": "57b65495-f71b-48c0-bc9d-a9b4bbaad025", "value": 2825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625132486, "uuid": "07a06092-84c2-43cf-8801-53c9b5aafb0c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625132486, "uuid": "0ceea0df-5203-49d7-b705-5c7657356876", "value": "Bank Details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5943ce7e-dab3-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625174939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174939, "uuid": "8a90201e-7ee5-4e59-a643-02714bc22ea7", "comment": "Malware payload (CryptBot)", "value": "749fa83717a6bd29603a50a5da3db0b2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174939, "uuid": "de181a54-9e81-4c59-b098-fc7912e0fd0d", "comment": "Malware payload (CryptBot)", "value": "f27bfb9eecdf84fad6afec20037b2041c052d8b5cab29ac28ae143e611563202", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174939, "uuid": "fb88c084-1ef4-47fe-813f-e5b789629dad", "comment": "Malware payload (CryptBot)", "value": "e0c95ffba66e81b2ccc002222b38a23959830a00", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625174939, "uuid": "03c6e282-f13e-4703-9f2d-5e4c50b35f71", "comment": "Malware payload (CryptBot)", "value": "a6e3b219e289229c37c63a2502e056793d455b314d560c9eaaffac69acd264d84c36943e2c3dd5884a400e19a9627dd7", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174939, "uuid": "f5e256c2-e5b9-400c-97c9-03af98000529", "value": "AF2633B6A9254F56DF60F7F06DC17AD44CBA11059AA069BE8FA75FB83024027B247333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174939, "uuid": "6b77d3a1-26f6-48c2-894a-65b78a73d61c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174939, "uuid": "8bd567e3-9d8a-47ae-8f92-3ba10b6ceaed", "value": "98304:JmIsJM/C71niWV8OLaD/+Dl2hLaNCsEa/6cAhXFVU:J/JOjTQ8FsDsHwXFVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625174939, "uuid": "a7018b2c-20ab-4204-aeca-33e15f78df9a", "value": 4760165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625174939, "uuid": "03ef5e29-db66-4e75-a5d0-ace6753ac381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625174939, "uuid": "a3bb9e88-9b7b-4977-bfbd-c32eae410fa7", "value": "749FA83717A6BD29603A50A5DA3DB0B2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ead3451-da7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625152131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152131, "uuid": "c46d88e6-c477-4cb1-b274-5f8d81951917", "comment": "Malware payload (Loki)", "value": "ad98537a1796949ef413cba82662ae33", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152131, "uuid": "09baecd1-49c1-487d-9041-eea8591958e7", "comment": "Malware payload (Loki)", "value": "f33c5ab923663af6614c346e1691e7cc30f0c2c1afed05efd6f7beacd096a166", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152131, "uuid": "a26c28d3-1136-430f-aa93-aad9317da5fc", "comment": "Malware payload (Loki)", "value": "ca5a82d36e86556c2cab504ce23f6480edb3f36d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625152131, "uuid": "a491e80d-006c-4f30-ad84-1e00ab082602", "comment": "Malware payload (Loki)", "value": "3074cff7e5d4f27070d04c038398fa843e6ecab54da7e8e0466c48d2f614bc1b107c38f9b1fcf0f4c722be2e67904f0d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152131, "uuid": "9bb6afd5-3e36-412b-9b6c-3b29c0783473", "value": "58458D312BE94229F0FA9F77C6B3A54057FEF5235F1BD85D385422C90723A42C9B162A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152131, "uuid": "0b6fe9a7-6f84-462d-983b-6658a5914047", "value": "12288:ap+yB1EOGQysGIqvRl0DN1+hXfmO81dyZiCgb:aPJGRODWf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625152131, "uuid": "b3b77984-42e0-4cac-bcdf-e1c0f30b1c2a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625152131, "uuid": "7e28e948-4937-49d3-aa15-949d30a84e58", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625152131, "uuid": "76b885e8-1651-4bbe-8a4a-4a201ff08f5b", "value": "RFQ01072021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f05039-da52-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625133413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133413, "uuid": "45ef5940-c378-469f-bd4a-7131b8b98e28", "comment": "Malware payload (SnakeKeylogger)", "value": "0eab169ca241fefeadae030e857f87e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133413, "uuid": "ee21dfa4-76ef-457b-bcee-08100bb3efa4", "comment": "Malware payload (SnakeKeylogger)", "value": "f354ab2b18c8fcabbc94123f41ce225fb9ec4adaceafda7c5fefd61dee656f70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133413, "uuid": "28272db2-e7b7-4ac7-9189-9ee5f5b83b55", "comment": "Malware payload (SnakeKeylogger)", "value": "45318abcab2aa2b9c91057cd100d930afe315129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625133413, "uuid": "0cda14ab-4b8b-488c-bb43-fe1b2005337e", "comment": "Malware payload (SnakeKeylogger)", "value": "a56c961ecc91b5600f03a79a118aadcbb3a0b43bff75180243d33244b3212ac66a6ec870fc9677a24bf92ad17a354024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133413, "uuid": "a22404ac-26e5-461b-951d-ac228481b0ee", "value": "74C412387EFE03A1E2724F37A6E43180877EB53A3926D56925D1474A08D7E81CD9336A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133413, "uuid": "7cdf0bbe-9448-4781-a6bf-c4c34643219e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133413, "uuid": "be2c84c2-00dc-47ba-af43-087a37abe34e", "value": "12288:KHApFzOAgYw36c8udrTpwq4kJFxqOisBfprbr/cVlpeGm/IROo1U:KHqFzOAgYQ3i+DFBfcZmwT1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625133413, "uuid": "78ffaff6-d20a-4d4b-8de5-4e509b8ff161", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625133413, "uuid": "4a30f299-85aa-4eca-84da-3b91f2cf6ff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625133413, "uuid": "64f330e4-8573-4838-b7d4-48f4585c713b", "value": "0eab169ca241fefeadae030e857f87e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617dcfc1-da20-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625111817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111817, "uuid": "1ed44f54-63e3-4510-b9b8-23f8def4fadb", "comment": "Malware payload (Loki)", "value": "e57651631a11ee5e62470d85eef98f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111817, "uuid": "2fe3b486-58c0-4ff3-8785-1851bc2aec60", "comment": "Malware payload (Loki)", "value": "f3fd0394a1d4721d0faa94112a64a7dac38e567359f61fe559a19855fc69b4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111817, "uuid": "6d16a98c-4a00-40fb-a678-2281a31fb2df", "comment": "Malware payload (Loki)", "value": "a467760f1f302dc10b5423c399e54b339b75789c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625111817, "uuid": "369aaeb6-5703-4c21-ab15-9d445a948ecd", "comment": "Malware payload (Loki)", "value": "34738fcd73fb5146093c072c285f398aa79766158b1699c6e86aadbe4f14025daea4212e71a72cc1e1a0ca9c52fea652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111817, "uuid": "19a66e84-9ec8-4c51-8c66-cd313247fdd8", "value": "D3A4F1102116F82BF9BAD1727453B04277563F2528B2DAEE8347793D01B56089AFFD3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111817, "uuid": "f9763537-85bc-43b7-b0f4-58362a673732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111817, "uuid": "63dbf8c5-0724-4b42-8c8f-cc3d1051c5b0", "value": "12288:NEFVzMFycrS4HgKkefNS2g+sAw6NGn+Ca7:aatS4AKk0AzfAwD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625111817, "uuid": "e664351a-d983-4811-a79b-2b11798137f9", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625111817, "uuid": "bf318c72-5110-4c83-87d0-c76c3a28f29a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625111817, "uuid": "97aeed22-b0f4-4e53-b1f8-3283530caf58", "value": "CMA - customer Advisory - Container Charges.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87848320-da49-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625129490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129490, "uuid": "c6e0bf4f-33bf-4c88-9df2-f7c5d7da6274", "comment": "Malware payload (Formbook)", "value": "b4016a20b83010a87e77ef31a544e10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129490, "uuid": "681c2fe5-6e5d-4c4a-a525-f9b96144fbb6", "comment": "Malware payload (Formbook)", "value": "f550a35f384444015f42a6c7ac5abe988027e2c499eca970b78a22c80cceb136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129490, "uuid": "e30a2778-c75e-4c21-bccd-f18ffdddb7e3", "comment": "Malware payload (Formbook)", "value": "cb88f4810cedecbe3953056763fffafaab431391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625129490, "uuid": "d9f12118-8ff9-47f5-8500-27a3c7d8d2f4", "comment": "Malware payload (Formbook)", "value": "095c903d8558abd5f72817781c9405204cf058addc7d2590addce765b28b41e363d5b31c1a0f37cf126e8900fa452217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129490, "uuid": "667d1c7e-f5e6-415b-9222-d4cbfa2933e8", "value": "2845D00BF644AF55C5582234DCEFC27013B5EDD77C228B0B2E997AED3CB2216C9516A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129490, "uuid": "b1676693-6525-4c16-8934-95a0a1048a7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129490, "uuid": "d00b8379-30fe-41e7-b60b-4f8e813d2e39", "value": "24576:cFNvty7KFrAhFhMXbIIorvbQf9pzcmR1qGoq8h5:cFhkmAhFhMXbIIajkzcSqVdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625129490, "uuid": "b020c279-9b1a-4355-8a08-12dcae66f6f1", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625129490, "uuid": "b3366103-bb8b-4ba0-b8ee-b11d046ba90f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625129490, "uuid": "0d1f8014-207e-4c40-85e8-8ab07816405a", "value": "RFQ-Itachi Terminal Solutions Korea \ubc1c\uc8fc\uc11c nf 21-0649 (\ud68c\uc2e0\uc694\ub9dd).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fd6b59-daa6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625169488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169488, "uuid": "c83a9c22-df0f-4a19-b364-031357fcd4f0", "comment": "Malware payload", "value": "fdcae752f64245c159ab0f4d585c5bf8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169488, "uuid": "7ebd2411-8509-46c6-b86b-f12465fe28fd", "comment": "Malware payload", "value": "f5ba2676ddb81f29c69867556fa261563d68a5905252bb94090e0db05b048cc8", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169488, "uuid": "d3e32664-585c-4fef-868f-98678d600e65", "comment": "Malware payload", "value": "d280f33f6d6e748313d3b637591525383ea749fe", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625169488, "uuid": "75456133-5cd9-4313-bc10-4b2d6383e2df", "comment": "Malware payload", "value": "0c2048f937f95e69b2b151f5ba805975b2cfc48b73e2f8ec31e7b8482bdfe1abbfa726cf3740e6f61e15f6313cd58d54", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IndigoZebra", "colour": "#80A4A1", "exportable": true, "hide_tag": false }, { "name": "xCaon", "colour": "#EE1ABF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169488, "uuid": "f0e8c939-7dd5-4c0f-8035-e646f1e3aa2d", "value": "70936B13F1E4E073E023413169A2B763497FBA33A9390247F789467E5EE51E19E29393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169488, "uuid": "f3cff6d1-3b69-4394-871b-b371da72ca89", "value": "8678039faaa05fa1dd7d27292724e055", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169488, "uuid": "091c0140-66a3-459e-823a-dfb6afdc830e", "value": "1536:NEVUT+/PTj7K7gghxepbzRcglNDYMkdq8fPp1d9o:NEu+PQgghxi5J/DuHpz9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625169488, "uuid": "6065c19e-02bb-4d5c-ace8-b9c93cda54bb", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625169488, "uuid": "6c6cb85d-95bc-47a9-9b42-b15da4699ddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625169488, "uuid": "583ae61e-fe38-46a4-8e40-9352b964ac22", "value": "f5ba2676ddb81f29c69867556fa261563d68a5905252bb94090e0db05b048cc8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634b0851-dabe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625179680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179680, "uuid": "d2602005-1da8-4c1d-97f2-779568be6765", "comment": "Malware payload", "value": "41f28ba9d94721b4397b1d4a170123a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179680, "uuid": "c9413fbd-62bb-4bea-a511-5d4e02e9bcad", "comment": "Malware payload", "value": "f65830401cf628b23ffb0de217cb465b985797ca7ff4129753511f3f93862590", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179680, "uuid": "1eea0d4d-0f64-42b9-b294-e157e853443c", "comment": "Malware payload", "value": "60729a0005f3f4c001722eb0dcc6a98fb2982b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625179680, "uuid": "126408dd-611a-4446-af3f-dc0144df9cbf", "comment": "Malware payload", "value": "0062985482c972015337d545896d9a0be00abfcc3bc8ab9f823001d0b4666ea926f7f17199444ce3bcd181ca632fba59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179680, "uuid": "4a541a0a-4b1a-4629-b4fe-2d65b7ce5759", "value": "F4E47C202AE84A29F0BA9F7E95B4110557FDF713AF23C95D3CB551CA0723A41CAF172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179680, "uuid": "5591aded-42b1-480f-bee8-68c6ca378fd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179680, "uuid": "50445f86-9938-47b2-a912-9c26b70f1e56", "value": "12288:t4YK1BbX5TyCXsT81P56eTn3lCSeN1UKwKKMjkzKHXcY:tK1lW81h6eTnVqoKwN2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625179680, "uuid": "1a4802c7-f368-4646-90f0-9104dc7ec370", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625179680, "uuid": "64793a7b-0575-489e-9756-bd60d50fcdaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625179680, "uuid": "3b5b4806-2c16-4298-915b-d7586e6ef6ab", "value": "41f28ba9d94721b4397b1d4a170123a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b1cc1f-daa8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625170214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170214, "uuid": "e37f5bde-7241-4835-91a3-be864f33e2ce", "comment": "Malware payload (Mirai)", "value": "2fa7513243b05dbfbf2dd5698898756d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170214, "uuid": "4a3f7b08-5d3a-46d3-8b79-85f20507d9f4", "comment": "Malware payload (Mirai)", "value": "f69647a5a664f46347c895a793f1d999fa940fbfcdc1ac09afc154c1c2e115b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170214, "uuid": "eacf4afc-6b42-48b9-be4d-7cea09317511", "comment": "Malware payload (Mirai)", "value": "191e8467190e1d947cf6f28391cbbb8e638974c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625170214, "uuid": "5e8f10ee-513f-4ea6-8f22-0a3d325c7501", "comment": "Malware payload (Mirai)", "value": "4260dfea207d04c8c73e9018a12b28bcbd6f4c15c251c5e53e81ae898761363b9aa6f928714d916e7752219b1647fe4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170214, "uuid": "756b96de-adee-414d-b81b-7c9a444ba295", "value": "A6B2F1D5D6AB2BC3D2929336D0BC9A5DE2721AC10747851B100AB64EA3D760E47FB3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170214, "uuid": "f3c7afe8-646f-4b5f-a170-30a5e5b68b6f", "value": "768:P/QOC0Yhn6ROHWF/P+cwNlwFCnNBxc29c4:P/nihneFzw1NBa2W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625170214, "uuid": "1e72c69b-2638-4524-b922-9eeeca3c437d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625170214, "uuid": "d3c1de0e-c868-45d9-86f4-ad02a62a37b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625170214, "uuid": "ea8528b5-6a60-463f-9def-405daa54a5da", "value": "2fa7513243b05dbfbf2dd5698898756d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf21efe-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138275, "uuid": "dfd458ed-a343-4dd9-9043-58192db6f098", "comment": "Malware payload", "value": "048950d66e95cf5c6e1ad89dadff0c39", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138275, "uuid": "0fbdc8b5-610c-4235-bc16-074533f8dd51", "comment": "Malware payload", "value": "f7483907b4f787169106ae1fd6d066ec6d6ceb67f8f382703dbaf25e037a4d06", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138275, "uuid": "05a29840-46f0-4d25-908f-8f4727eb88fc", "comment": "Malware payload", "value": "e5f33d36c990b940eb7231a1212358f285314830", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138275, "uuid": "88bf52fa-5ba0-48d6-98bc-cf2a82243941", "comment": "Malware payload", "value": "da5efd8ac1a5733a554040498f85bc6a3684d24afa7cbb3e8fbe93c703230d03bc9a9aabea42a7f75840aa4ba7b63c69", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138275, "uuid": "eab52762-96f9-4c43-a9bd-84fe2cbe321e", "value": "23F039A325E95045ABBB1E41AFF5D4689B34BCA81C05E46E05580A4F00F2C14D831BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138275, "uuid": "fd64c06e-3609-4c58-80e1-d17ec98c85d6", "value": "12:QKg+rRNEEmp+lJezyyJfORuSZOobrRNEEmpEzzyyJfORuSv:Q+rrER+lSyy3chbrrEREfyy34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138275, "uuid": "4e6eb49d-7f24-47e7-a4ca-9eebc44c1c9e", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138275, "uuid": "33642308-7400-44f4-9b3b-f5ed8c840ef7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138275, "uuid": "4f697fb6-c8cd-46e7-80b5-d9f93aeabb2d", "value": "Rastaf.reg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04c6737-da55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625134766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134766, "uuid": "1b66f724-9f2c-46f7-b808-3909e2d5d3f8", "comment": "Malware payload (AgentTesla)", "value": "77bd38dbf3b64bc06f15292564185b15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134766, "uuid": "098d7c85-1c64-413c-974f-d0539127b513", "comment": "Malware payload (AgentTesla)", "value": "f7fab80cc4652417ab933bfbd07627566968b7167fd82b1c35a39ed69a49fe17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134766, "uuid": "838409fa-154b-4dee-9d8c-bb2304eb79c8", "comment": "Malware payload (AgentTesla)", "value": "ab4062873cb1c2585592d28fe4228b3e2f2c7512", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625134766, "uuid": "7e1907a2-f121-4756-9dcc-99983189600e", "comment": "Malware payload (AgentTesla)", "value": "0f33639dd020b5aadeecc33f0b50b12c47c14f244e51cfd6752e5a0c8a5e8e0008da2f1b68a34ad543e4ff6a88c70e4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134766, "uuid": "f55c67e9-1083-4dfb-a75b-45fce81e9a7a", "value": "9745D01BF6089A06C4952238DCFFC2741375DD9BBC238B1B2A987AED3C72752D9507A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134766, "uuid": "ff4c462a-7f98-44a6-a982-79a70492c243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134766, "uuid": "dbcb5662-55af-4a15-951a-2d47a2b32375", "value": "12288:XBdH1SFdtlcbM3hzhogke5jFDr6O/UF6q1whNw/hDkNax9tLiRhB:XgFXl2AhzhoFYFvrw/VGaxXLiRhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625134766, "uuid": "8ee8e5c0-381b-44a1-b704-711acaf7befc", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625134766, "uuid": "14e2a395-12ff-44fe-bb89-a7f0d5c4d21a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625134766, "uuid": "e5179dca-009a-4c06-b508-043d8674535f", "value": "77bd38dbf3b64bc06f15292564185b15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaed041-da5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625138253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138253, "uuid": "44581e53-fbaa-4a42-b136-4aaa6455a4ca", "comment": "Malware payload", "value": "43baa45fe89176698d40364adc30d62c", "object_relation": "md5", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138253, "uuid": "13d812cf-f7c0-4242-8f2b-4a36eeada3c6", "comment": "Malware payload", "value": "f9efdd12746fc1ea86ce86440c2e090448cb1e1de9c901d50e312e479189b471", "object_relation": "sha256", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138253, "uuid": "e8834945-23aa-46e0-8088-f66ebc368335", "comment": "Malware payload", "value": "b74f737874631cca04206a5ebd9b7e2162eaafbe", "object_relation": "sha1", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625138253, "uuid": "8dfb9653-d723-40cb-9bc6-5398bd58b1f0", "comment": "Malware payload", "value": "be2dadb9d1e1f71eb8f42c1d1216bf2c4d68329623c4ff2fab1911d8001583449083ed075fe9fcd0760daf3393fb3bfc", "object_relation": "sha3-384", "Tag": [ { "name": "rinaldo", "colour": "#9B20A8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138253, "uuid": "4078714c-610b-48b8-b44c-65d8cf7674ee", "value": "70A002143A89E3D1662841A465339908CE84DCA5161099194681927D2360E610736105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138253, "uuid": "c9a845de-5388-43b0-815c-02f33f73f841", "value": "3:FER/1GXfeFHE7MURHb+n:FERtbFHmv8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625138253, "uuid": "748dd16c-a46c-4f64-9bdc-65b4ca3876a2", "value": 58, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625138253, "uuid": "cf3505d3-96d0-476c-b88c-a1b2dd78dfdc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625138253, "uuid": "fe0293e8-1a05-4dba-a434-ea802e353b61", "value": "HideUAC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2928a5e-da72-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625147225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147225, "uuid": "1bd32385-6b0e-4fa7-a041-c88ee8c5fbe5", "comment": "Malware payload (RedLineStealer)", "value": "2d7bea3cf016ea68d5c85dcec7284079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147225, "uuid": "3955a4fe-d72f-4780-ab63-aa726acab685", "comment": "Malware payload (RedLineStealer)", "value": "fc26fcecfceb59618212bc780f8e571bd52cd9004530c297656558fe62a84c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147225, "uuid": "3017e177-d847-4859-a4d7-9784b5bc95d3", "comment": "Malware payload (RedLineStealer)", "value": "a22f5b5a2baf23e4409860e81e493d8a0e4977dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625147225, "uuid": "35acbc46-8742-4ef5-91b4-2bfb452aa1ab", "comment": "Malware payload (RedLineStealer)", "value": "38e0614a7af67df2cf806e8e951327ec9e6d665279ac78c59ee5509fe2715e84172d7fbdebcc7c1c64739245de47d0c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147225, "uuid": "706fb0c1-2e32-4108-ac9a-195a1d552d8a", "value": "F794E1523A90C472C586423C5867CBA057A9BD3166A38737F3A82B6F5F332D126F5327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147225, "uuid": "13dbba4b-c76d-4d4a-884f-faa83345a8d1", "value": "87fe651e6418c1bd0aa48fa04abdaea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147225, "uuid": "86c20bc9-5e51-4298-9737-913c1f8a74ff", "value": "6144:eMxGtBZsTw23sb7tXArBLD0cmnoxoHL9WB:eMxyUM227NArBscmoxoHJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625147225, "uuid": "324e67d4-9d4d-498e-9d22-c2064a8910be", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625147225, "uuid": "81128430-f4fa-4f71-a854-dd0546e78a30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625147225, "uuid": "cba282fa-3dac-478d-befb-25860efe10ee", "value": "2d7bea3cf016ea68d5c85dcec7284079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6eef6e9-da7a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625150696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150696, "uuid": "f7162c14-6bdf-4e9d-bdfa-8cf5df5d3489", "comment": "Malware payload", "value": "ab19fb310a5ad71d3de9b4fa601d30ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150696, "uuid": "ac6ef8cd-0a77-479b-9e11-68e6bd63cd7b", "comment": "Malware payload", "value": "fdc74d29165f155800bdbaedf3aa5ac8b8a8e1e00d3217d9b369f3e3a010fab5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150696, "uuid": "10973f03-d1e9-4316-938a-fa63933871d2", "comment": "Malware payload", "value": "69d2d74378f9c50796bbe55de521175bfb1b120e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625150696, "uuid": "9b9cd8ac-e383-421b-af49-d47720e1e906", "comment": "Malware payload", "value": "e3ceec35b26b0221edb77e0348669eb50081ec0734379ee539bd77afb3be44ebef1516e703f6d5bc6e1e867c8b7cb619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150696, "uuid": "c5ca8c1b-5ca3-4466-a854-0898c7fd61f6", "value": "FFF2E1B008889929D9E518BCED7D035D26552BB5CCA639E27C31423CE8E5D60F9E0FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150696, "uuid": "82bd7eb8-9e6c-4bda-9815-a19f946351cd", "value": "768:qWL/3AIqMD7D5unD8SlIWvG3DeQ20UNSVuIc1/kFG3Ut:qWL/3ZqM74nD8a23qQmNeuX1cFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625150696, "uuid": "f3bbe38d-2542-497d-9150-3e3f0d59c5e3", "value": 36648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625150696, "uuid": "e3b8fddd-0415-49ab-9a45-b12172c1e314", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625150696, "uuid": "bd895c36-a118-4462-9f0a-94d0c69050a6", "value": "ab19fb310a5ad71d3de9b4fa601d30ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }