{ "Event": { "published": true, "date": "2023-11-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-01", "timestamp": 1698883382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "725ce58b-0531-4ac5-8cdd-d06ccc66899e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d7f460-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698819897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819897, "uuid": "9e07e733-36a1-4785-9c3b-8baec982b5eb", "comment": "Malware payload (SnakeKeylogger)", "value": "e1fb2289b6f908395174f732fc2adca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819897, "uuid": "470dfa94-2924-4c95-ac47-dd2113fae7f5", "comment": "Malware payload (SnakeKeylogger)", "value": "00308ca925c73beec6b8c62befd7da021f911f3ad7edc64bd90d9f3a85c766bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819897, "uuid": "241c6236-80bd-4089-8d95-fcb0c7540480", "comment": "Malware payload (SnakeKeylogger)", "value": "fde24804f26d70c28219c12615be96d544beda1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819897, "uuid": "13d984a7-1381-43bc-a2d1-e630675d7ba1", "comment": "Malware payload (SnakeKeylogger)", "value": "fb250dff8eaaf0fda36fb8d00b9fc5745a8f57f015ed0eaf8ca1199850a69f0e4c8b1df82ae964b601353d2a42cc0196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819897, "uuid": "d9fec129-ebf6-4f9f-a377-5a80edda2009", "value": "T127C4021471AD6619C4BD7FF869A0540247F0ACAA2111D64DAFBC7EE54A32323DDC2B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819897, "uuid": "936e58a8-516b-4f37-9bf8-db13fb1e57ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819897, "uuid": "a985d1c9-838e-4a4d-97bb-0fe810086f47", "value": "12288:OXPZ4X2yOhtAH+4KL9EqmD3iD0/yAcGlG3z4O7Wm75:Jom+4K5EHiA/y//zHS65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819897, "uuid": "ab263279-0cdc-4c62-a7cc-d71fd81b6aa2", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819897, "uuid": "cb54a4cc-216a-4977-8a17-432fb7203cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819897, "uuid": "98cea551-c147-4ea8-9879-19c4dfce6381", "value": "987654345789098765.PDF..0987PDF..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5327a6-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698820024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820024, "uuid": "20155bf9-64f4-499d-b1c0-7d5cfdee3907", "comment": "Malware payload (GuLoader)", "value": "77433a4a235aa96180f7a6296d3ade9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820024, "uuid": "ace349b5-1915-467a-84a2-63ac489d0fa2", "comment": "Malware payload (GuLoader)", "value": "00d74bda97511916ea1c3a839a9d3705d692103bed13d5ad055f6af7d914dfef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820024, "uuid": "b4bcb005-0f3a-4d76-9263-7382a4226e52", "comment": "Malware payload (GuLoader)", "value": "3ea096781f5e07640c670c8483bc0ab3ad979d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820024, "uuid": "416b1d55-a37b-464d-8214-5c9f1ffbbaef", "comment": "Malware payload (GuLoader)", "value": "7ba64258a8e020ecd2f21345b53ab61b4e513df5f9daf8465396c35580a7f3086782e39a5879e4874d4366c10e5f2f93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820024, "uuid": "39f72aa2-4aa5-490f-8f91-48e8c3761323", "value": "T108C4236649F1405BF52313B5992B077F97F66C6C11148A4B2B84BE0D38722E3DEAE387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820024, "uuid": "3a72709b-f232-456b-ae70-819abc04ea60", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820024, "uuid": "09d42cce-3abd-4860-b89f-de43e6a1ffa0", "value": "12288:3G5kTb2rujpgqsgwrD2O2zR9hGu+7eYTIznckeYW1TJvmTxkua:3DHguelpihX0ukfCnckedFmVkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820024, "uuid": "0beeadcf-22de-4bae-8b38-b784090f02d0", "value": 547322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820024, "uuid": "1af77d7d-2045-4843-8108-41b64871a8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820024, "uuid": "acae4f82-a4b0-4592-954c-ab25fdcb5022", "value": "F0986556780000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5bd89a-78b2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698841901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841901, "uuid": "be52e2d2-beba-4526-abe5-8e926e902985", "comment": "Malware payload", "value": "1a29991d058791b29ef8b8ebaf6e036e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841901, "uuid": "c193e881-7add-4217-8d88-0ba7fa8a078a", "comment": "Malware payload", "value": "00dceb3bc7a64da6efb7eb28a43e52ac056053bb07254224d9121e8968c37f37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841901, "uuid": "a2333a1b-3fe7-4692-828c-e27484437351", "comment": "Malware payload", "value": "320ba123e3931bc005324348df239430ce702088", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841901, "uuid": "e98b8742-c8c2-4aa9-a5af-107a62a2b8b9", "comment": "Malware payload", "value": "6afb3a75ba66561e3273de5063b2ee9e41336e3d32fb7748ddd86f38bdf22cf87d7be92aa152b9e2b2aff1cbc744787f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841901, "uuid": "824c0482-7e29-428f-8e0d-6f14f62a478b", "value": "T1F2D36B44F241367D59FB237E287F230697336A1974178469F479F2E02A2CE8D5233EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841901, "uuid": "bfe5b926-e24e-41b3-ba72-7bb03167d9bb", "value": "3072:qMb8VzL5k4MYcAQY6/0I7tPRx6PFWgXUpDRPVlKYPguvb/t:Zb8VBk4MYcAQY6/j7t6X+tVoYPgGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698841901, "uuid": "e9eefcd4-87c3-470a-b00f-76bf36fb7eb0", "value": 136602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698841901, "uuid": "829cfa42-2a55-4286-b100-9c565ae899e0", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841901, "uuid": "146191a4-c5c6-45f9-9ebf-825fb6646c29", "value": "dolor.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3844573c-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833573, "uuid": "7b73d258-60a4-4c3d-b122-fde25672e163", "comment": "Malware payload", "value": "b212ca96c3a869b1b454803b3ca601c2", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833573, "uuid": "341a38c9-ccf2-4d0e-bb18-1df08c5dc813", "comment": "Malware payload", "value": "0116ef873ca6d990795aad0d1502de94dcf6260c2215e0a4fecd6027e936547b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833573, "uuid": "247f7ac6-a027-49de-8d3e-4e8deb33a68a", "comment": "Malware payload", "value": "6fe7258a69082341cbd1e17bbea01094d4fd9d05", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833573, "uuid": "ecd518b6-61f8-4dc6-bbde-9687fe0112bd", "comment": "Malware payload", "value": "7c1607f315114d179715f434eac204c1f0c4905fa034962bcf49747198909c9b62fff9a1c96e8b409f21b6379c0810d3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833573, "uuid": "7a447571-d6cf-4090-8836-a4c0dbdad0f0", "value": "T1466423E1892C73E0846A10DF1DEA6D6F4AEF474C9FF9B9F8173506D28580983E51ACE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833573, "uuid": "10f503b4-3344-4765-907c-51137bf951e9", "value": "6144:5ChH89dj3S7BFgy3PpFRQAZP8BeyKn4qltoZHPR0l6TV3h0xVE7fcGf:EC3GLFWykBeyK4qUZvR0U3hjfcGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833573, "uuid": "48af24ca-da52-42a1-9597-bdf40324b42a", "value": 334344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833573, "uuid": "ac2aa82e-4d08-4531-9edd-1ffd4111a94b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833573, "uuid": "df326c74-55e8-40fb-897d-e1929e5b100e", "value": "PO #GM88997774566096764664665.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0c5fb9-7861-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698807108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698807108, "uuid": "86fbfb13-e84a-4736-9657-e2e214010d4b", "comment": "Malware payload (RedLineStealer)", "value": "3b4d9c0958b0a08cd744c8504075ce54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698807108, "uuid": "3b1cd8a7-5e3a-4839-aab1-15717413490f", "comment": "Malware payload (RedLineStealer)", "value": "0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698807108, "uuid": "e97f83b7-7af3-4260-929b-6d5694e9bc22", "comment": "Malware payload (RedLineStealer)", "value": "fc32d174db827b4cf69b73daea8c863ca5bb65f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698807108, "uuid": "4167fc7b-886f-4a7a-b3c3-8b4958771fc5", "comment": "Malware payload (RedLineStealer)", "value": "4e2689674276f440d06ef35b6eb611b6d7a0adff7e8b75dc307c7b7df885857fc828b8241cdf74cecf172e2820550283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698807108, "uuid": "7490d2e2-8d52-41b5-b8c5-ed236de6ee4f", "value": "T16C752382D7C80476EDB66770C8FB214B0635BCA499B8D35E31A2D4160DA36F1B126B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698807108, "uuid": "53ad03ce-b01e-4da9-a901-2deb9d9e6c87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698807108, "uuid": "b14c76de-93f0-449b-8e37-d1555bd92f77", "value": "24576:zyhsYKuDWrssE2T8eejAUf0HSOFH4OiZ7Zqx2BmQFViOSIwMYp7ek:GJDWtEsvejhO/iVZvBLgJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698807108, "uuid": "748a309a-f904-4109-9738-74603b474ed3", "value": 1619968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698807108, "uuid": "efdbdb03-505b-4fd9-8b8a-d3ca01df601d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698807108, "uuid": "546dc53c-ce7a-4ce0-948d-b11936203497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e89511d-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819974, "uuid": "44fa7821-6151-471d-871e-9395ba011923", "comment": "Malware payload (Formbook)", "value": "7a790f741eb7e40d2c0035f09473dce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819974, "uuid": "ce5a4e5f-8cc3-4b87-af3d-9866c9649fe7", "comment": "Malware payload (Formbook)", "value": "017c3d4416680b3466ee6b40d06e71c2ba015ef9bddd2d6139570181d52f865e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819974, "uuid": "c1035d34-d31d-485a-aef1-368a01998f28", "comment": "Malware payload (Formbook)", "value": "64a350c8a5f0143251c7d66c0e4d7bf90d06c13b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819974, "uuid": "32ea617e-5caa-4dc0-9857-34744f7a096d", "comment": "Malware payload (Formbook)", "value": "145caf1db25f9fd06c4d9fb17fd3f7fb4cf7490cfa93d5133c4b0b0f6e007e3c5fd966def17e285e4a539f0a709b625a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819974, "uuid": "883f9a06-a9f9-48da-87f1-16d1bfb2cb0c", "value": "T105B4016D1485EB00D3AD77F4C8A1A24931386C7BA198D2050EF2756679B330BDCDBEAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819974, "uuid": "5dd52f9f-df22-48b2-b26b-c0d1265cdb8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819974, "uuid": "201d0b4d-6d6c-44b5-95ef-4b8c47897686", "value": "12288:a1fD2S+nR8+PKE5kXjfxT0qGcpfvk6ceXcY:CbzgR5iE5moqFNvk6LMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819974, "uuid": "036b7374-63e1-4281-a0a5-b9da65e04a94", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819974, "uuid": "b60f3bf0-dc2f-4bf9-9c3e-e9e81039ca70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819974, "uuid": "5806ee42-0ea7-4493-98a4-c4c04da9c710", "value": "XHK098909PO00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b83d4d-787e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819442, "uuid": "aa794586-24d3-4acf-b5e4-453addb9a722", "comment": "Malware payload", "value": "29e5d8ccffd187b6311f0efa886956a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819442, "uuid": "32918dc5-b8d9-471c-bfc2-9a083a0e7f6a", "comment": "Malware payload", "value": "02bfc35c02d4e7bd4ae5cc0867de4b656513e6b1335b625c13ba06ec78f5c4e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819442, "uuid": "e17a7e11-00b3-44ff-bac7-9bdf281d0fb0", "comment": "Malware payload", "value": "2548bc9696f9c26f5bf42f1065677208e349ad17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819442, "uuid": "eb8a83b9-da61-437b-b316-15f073af250b", "comment": "Malware payload", "value": "1dd0afe6b96b74a19f0b8d1abe62f9ca1decce982500152e97c0987dcfd73880682a673a3706ce28d4da2654d8ec127c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819442, "uuid": "24b238d5-2298-4b99-91d3-94789a496675", "value": "T1E3D4E52C3B456E7ADD2C4631584C0B3DA5367A632200DBE2A3DF26CB8B2F5676D44CD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819442, "uuid": "87d59888-c157-4d47-aebc-46034e33c556", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819442, "uuid": "b153ff20-01fa-4d6d-9436-eb80f539590b", "value": "6144:qOTwkk65ywxtOLH3F7382G9chNFg2QGZ9LjalFi8Xs2+zIKt5lCFzvdl7tCrQDGv:qOTPJwH3R82QQ9QyAlhc2+kFzvcrCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819442, "uuid": "0c403de4-1cdf-4a53-b318-4f5bcd8009f8", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819442, "uuid": "22851238-cf78-4929-b7d4-84915d1f74c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819442, "uuid": "7caf4621-ddf9-4edc-b942-cd19fc7a08fe", "value": "29e5d8ccffd187b6311f0efa886956a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee5e014-78b4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698842818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842818, "uuid": "8ae43f30-21a4-4899-ba41-80fddf4c81d5", "comment": "Malware payload (AgentTesla)", "value": "5483c4d5bd2f86ae17a02583ca1264c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842818, "uuid": "1db065b8-ce02-4430-9104-189955aad22e", "comment": "Malware payload (AgentTesla)", "value": "0352d3068460a1f9e366d76d3bc508449f0fceaf5a73a45e821cf11ba38bf6bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842818, "uuid": "37b42983-5f83-43a9-91aa-e347a1cc2d7c", "comment": "Malware payload (AgentTesla)", "value": "2fe0ad2983ee1f8a71aca5727c65d3ae9e54fdc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842818, "uuid": "0b2ee040-59b2-4676-b575-db8943732d7f", "comment": "Malware payload (AgentTesla)", "value": "7c603fc0a8d6dd11ab9c0dccc12dce69a359d2d593f78162e2336e293ad086f6f2caa755b8551725265a3c07ce3be6ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842818, "uuid": "70c9f748-688e-4c2a-8bb6-01c1b34fafb3", "value": "T19434346DC34B11A98FA6137B9B1B1D4982BCBB2EF34411B1306C833533EAD3956256BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842818, "uuid": "d7f46432-7281-4fcc-b971-c931e5e367bc", "value": "768:gwAbZSibMX9gRWj75vSln/16AiMqcho7tdn6MRwlz07ftrLI0:gwAlRIvSln/6Mlho7tdn6Xlz0TtrLI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842818, "uuid": "dab42951-caea-42a7-a9ab-b4abb01e9def", "value": 232841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842818, "uuid": "ac2f6f73-2633-4cd9-a3b4-71d937aba54e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842818, "uuid": "1f616e8d-bb6e-4bc1-b6bc-2f7e51cdd6f2", "value": "ORDER 00.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18664534-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698833519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833519, "uuid": "82b246d8-c468-4bf5-9465-772aec3517ba", "comment": "Malware payload (GuLoader)", "value": "953a52c4e4db38ce1d15aa373c381ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833519, "uuid": "9a2f38b3-98a4-4d5d-9441-2693736f3cba", "comment": "Malware payload (GuLoader)", "value": "03e374f22f0591a4e879b155e864ad96dbbde861852a5aecc7fdffc6e8ce82ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833519, "uuid": "64eeb74d-8d0d-4540-a870-19cb3a96223d", "comment": "Malware payload (GuLoader)", "value": "fe13080403769e011c0ae72fbf626116c498579d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833519, "uuid": "ea355e07-bccd-4102-9dab-8c75a72e1509", "comment": "Malware payload (GuLoader)", "value": "62044afedb58934838159259a8f8093094867814ec440326a2c17b79808083e0cf81bd7f73f879781aa4dc326e5b7244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833519, "uuid": "7c453cdd-5ad9-42e0-a823-c89441fec529", "value": "T1A92523B123A5E8AAE4081AB1DB7582F5233CFE51D4A4135F02B2FE1CBD7A2419D4D3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833519, "uuid": "28af5ff9-fdba-481a-a4f3-b0e763c0d34f", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833519, "uuid": "2e290cb6-d509-4172-afbe-a22d2dd2d95f", "value": "12288:hxI8uy2M7XK5UcmtKNokGXD7bI10jIb/JbNmyL3MCDLPQ3zg2PIMf0Ik5kNplP4m:hi8unM7QYHI6GSy9mgXMf9+u97oo3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833519, "uuid": "037db825-33af-4d9b-b0ff-7d2099f8b9a6", "value": 1005520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833519, "uuid": "358b954b-68c9-485c-bc82-398aa2b96dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833519, "uuid": "3a24e95d-3ac4-471d-b145-0bddf217bc08", "value": "ANNUAL APPROVAL LEAVE FORM pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6e5f64-7891-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827701, "uuid": "20fe1e6a-5160-459f-ad33-68b3227019be", "comment": "Malware payload", "value": "789b780e7d48f0ddf530e5f255ba75e0", "object_relation": "md5", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827701, "uuid": "db57ca8c-188e-43bb-be47-45d113541fca", "comment": "Malware payload", "value": "05cb6de8190a1f016694e92e9481cc5e7566e1f7dd3a951fa87158b089a6903c", "object_relation": "sha256", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827701, "uuid": "e6023e07-8013-4bc6-8c4d-c94efb437c71", "comment": "Malware payload", "value": "069b086675354bf72faa031f887e53ca80b51e75", "object_relation": "sha1", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827701, "uuid": "7bf2c1f9-40b1-4ca7-abc3-fb5142a64b75", "comment": "Malware payload", "value": "9a68fac60fd456e9af6875599b8b6cfad9c8131d3b363e8e1bbf2bcc6893d098afab526d606ed9604c19c0c67f4ca77e", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827701, "uuid": "89f4acae-206c-49c6-876a-b05ea4ae9ab6", "value": "T18E35519C765076DFC857C972CEA81C64FA60B4BB930BD203A46322ED994D99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827701, "uuid": "38edc0e3-cca9-4d45-83f2-2892d5cd53b9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827701, "uuid": "6edbb19a-ca9d-412c-8eda-4a7831f1753a", "value": "12288:odhj0B28qvEq9yzRssJm4yQSbkxq8FhlmlnOT2mfelzOcpIuyPI1f9OAu8BVc+en:GM1hJm4yQSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827701, "uuid": "1472fb61-d4fa-41d1-adbe-36a52da68b8b", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827701, "uuid": "4ad4bf95-28ff-4bc1-a4d2-3c6d779dcb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827701, "uuid": "ac1f030a-26bb-462d-ac53-7acbdab186c0", "value": "nwl415x2fc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc60f1ec-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820078, "uuid": "ef19b86d-dd13-4ce7-a405-4f6dd4062bd9", "comment": "Malware payload (AgentTesla)", "value": "da2f229a1ae0c35cf5229a798a8eb8ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820078, "uuid": "dbdff9d1-052d-49e4-884b-4c87f6993491", "comment": "Malware payload (AgentTesla)", "value": "060f2417c6b1f17a0ee1c27ed1ac672cfde33c91bd5c6a4dca2a8877b97aff54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820078, "uuid": "90fcf8c7-1106-420a-b582-755718de5bfd", "comment": "Malware payload (AgentTesla)", "value": "707065b2c32c8efe8e518cba603b597c00e42baa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820078, "uuid": "c2eda110-1479-4662-9f22-60a3a3584135", "comment": "Malware payload (AgentTesla)", "value": "b4af0b1fb00c889100732cf031223aad9eb98a8573af4d1b28e1057eb95e5a43f96b949dd5cbc6ea59623ca50536203d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820078, "uuid": "172533f9-f6b0-4e65-9141-5225bac36fb7", "value": "T1A614AE9AB55775CEC997C533C98A4C245B70B6A6A317C20BB04B238D8E0E79BCF150E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820078, "uuid": "4f7c1f04-cbbd-4d22-b935-8098b1e42625", "value": "3072:PPSycMOOSLf3M0rYLKRTj3G+pFHkpXqqxUeFSUrGWJtyosfxvPXj5:PPz9O/L0cN3rHEpXieFSUrGlvj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820078, "uuid": "4e93e2d7-edee-4446-a227-955b56d624f6", "value": 207424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820078, "uuid": "00bf1133-5ee4-4797-a64b-e45688f142f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820078, "uuid": "17b8dbb8-00f7-4dd1-b41a-e7b2078092cf", "value": "TALIMAT23-01085 -01062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cf5b3d-78c6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698850566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850566, "uuid": "4c34f22d-55ef-4122-bf2b-9a6ed59b7294", "comment": "Malware payload", "value": "77c0aea68471e0e2389ed206ad50dfaf", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850566, "uuid": "bbc3baae-e9d1-422a-b814-1503090c5891", "comment": "Malware payload", "value": "067c9df0d10e74dee52333ce0bace20de4229ff992039cc9f4d02ea10aae72b2", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850566, "uuid": "1b50a905-d06f-4679-801f-c469aee1af8a", "comment": "Malware payload", "value": "e6456d33dbb3b721fac77bcf30e8aca3e0d99ee3", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850566, "uuid": "3c7f6e99-cd7f-49fd-8889-b11af85f5b32", "comment": "Malware payload", "value": "e0e4e244a3a1a0206ee3bd190f3d4e8c0eed2c211fee96dad8aef3f8fefd712724e96229cd6629544eb1e7aa6cc232da", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850566, "uuid": "59a0d8ec-5097-4d27-8b40-c157446ee237", "value": "T1D4744AC7CF808DBC411C70332616D79E9A9CD8CE7B56019DA60924BA91C2DEFA4E7B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850566, "uuid": "ca26bce9-0d7a-4e51-9735-102270c4185e", "value": "3072:YWKyxqdKatp1kL7Om3lMRaaXYbsF2NQs+3emLNGFvWS4ddJG6fNC4dnyHJ:uyMbtp2PJ2MOYbdQr+WbzfzdyHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698850566, "uuid": "08f7cde5-fe8d-404c-a8a6-2ca6cc706aed", "value": 358476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698850566, "uuid": "6893f803-8488-4d35-b6ed-8e0b7f93a1c7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850566, "uuid": "18b65f2f-575e-4340-bc28-b152f305ea2a", "value": "doloribusjb.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a09cdf9-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880740, "uuid": "058df7f1-02a3-43e3-80f4-dd79207785fd", "comment": "Malware payload", "value": "b3fc086c0eab4366ad0bc4878ec960f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880740, "uuid": "a5f3d57f-55c1-4450-bbae-72c5d3b50300", "comment": "Malware payload", "value": "0712a021e1d6cd35d7dde01d7dd7797a270581f3a81796e5922ff1b1b51d96f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880740, "uuid": "439c3569-3613-4c61-b2f7-2ced952e6461", "comment": "Malware payload", "value": "f8873f4254ec3e3fcdbd5ebef1aca34fe0e2d22c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880740, "uuid": "f11b4f7b-9247-4a4f-9129-db179e0a5aa9", "comment": "Malware payload", "value": "e72d6713d6eeae3e89f235ef7b0b73ebd02597e21a9f9ce46c92b772cd3ae4cd66fb5a2840f13a866d28d38d0f933730", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880740, "uuid": "a75668a2-0236-49b8-8c22-cba1e77691d2", "value": "T152558E06F791C8B4E19C013144A2A779AB755942DD12CEC3F79CEE6D7F322406E3B26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880740, "uuid": "a5250de8-c941-409a-94fe-ebbbb7f06198", "value": "5a77be8e616c7bd1b14b7e4c09d10531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880740, "uuid": "df83d2f3-9d5d-4558-bbb2-e57659348129", "value": "12288:C03WhIfUc6xFGz+f97ZPEoqrUSBFqPtiIFjaybgQJIxcG3Vuu:CMR4nGif9tPBqrUhPYxxcG3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880740, "uuid": "b2178ef1-2313-47e7-b651-70e026370f22", "value": 1313157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880740, "uuid": "e296860c-3cc3-4988-9b87-d86fee402dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880740, "uuid": "f49f9b16-dcfa-46aa-9de1-a1faab82f1fd", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.2308.5680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1625c24-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880699, "uuid": "113b74cf-189c-496c-8831-e0739b489581", "comment": "Malware payload", "value": "fee6008db5a761dc482c1a4f28c480c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880699, "uuid": "6e404c96-6c5a-4749-a1ec-7c027e0554c4", "comment": "Malware payload", "value": "07e5d4727012c3dfb1aef5d7fd8ff68a177f5b377d8eff83b4c76cacf4806b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880699, "uuid": "bbb872ac-fcdc-4b97-a192-0e463af40420", "comment": "Malware payload", "value": "403b21e507669f12da3a125996770d2073637b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880699, "uuid": "ef53b2e8-00a6-4c3c-b7bb-6c108a2b29c5", "comment": "Malware payload", "value": "c5e75e9f32fa52a160e3d14df3939370ad89dcf75e08d7185d5ecb58550b446c6505dd5f8a8330cc498e93de82d5b03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880699, "uuid": "0b9614bd-b412-47d3-80b8-aad8260422dd", "value": "T1C58501C1C6045377E2AA9CF0642B51CDEA6D0DF2123DE4B913E3564378222BEB53B5DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880699, "uuid": "1912a538-ab72-42ec-9a13-913264c74853", "value": "1cd84ee1ac0f54efb9a65f9a6da92cd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880699, "uuid": "192c0423-9e2b-489a-b2f2-7e1fdce23336", "value": "49152:giwIJaOnxJ420BlLeeVRXUh9vD4sVbse7JoWeXhA/eDMOBughcAEajR5mz4xLVC+:cIRnxJ4nBleebXovva42OAq4x+UAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880699, "uuid": "960d3c24-0179-4370-bc15-68329ab5357a", "value": 1765376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880699, "uuid": "86917489-9001-4ca4-8250-5af93ffc37b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880699, "uuid": "5fb1dbd1-84a9-4524-9ce8-11730cffb761", "value": "SecuriteInfo.com.Win32.Trojan.PSE.EYAKTR.547.16622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c088f7ec-786f-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698813186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813186, "uuid": "debdbbc8-026c-472f-8f5f-30cc7d75b1a3", "comment": "Malware payload (Amadey)", "value": "06462b0ebb7e7d3b68e9f047e1042a22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813186, "uuid": "c930b169-2dec-413c-a2f4-812c3567c817", "comment": "Malware payload (Amadey)", "value": "082ccc8b7a7c0490466c2889403b5d590b524ba46d8417419b38a7abc2c1c381", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813186, "uuid": "9f273dcc-a3d4-4612-af38-29c2795d0269", "comment": "Malware payload (Amadey)", "value": "e68835dcee5c3ba6ab213e3486cde46089b4acfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813186, "uuid": "688f06d1-2487-4272-ab5a-25e11d8f984a", "comment": "Malware payload (Amadey)", "value": "89ae13e3afa45f88888285480268bd07b149c1079316a228c3006036375b7d8d7c873d2c4858e5da66dfbc3a55dd41fe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813186, "uuid": "5208290d-9f3b-4627-bc6f-914e7815d660", "value": "T11875232266C88473FCB0FF7148FA12A713317CB14AA8D3AF3B25991E46B6554A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813186, "uuid": "36e13ec9-abf8-45c4-a9b9-dba2fde621aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813186, "uuid": "e6847560-f0dd-4b4c-a3a4-652ea02f25b1", "value": "24576:ryD2sWqL1scnIJ2khW8iYESzTwF/rC8ttiE8RIwY/AshU0neB:eqsrnlyfiYEtBrC8ttiPRPEUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698813186, "uuid": "d8d4a1c1-86df-40ee-9f9b-be0314921726", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698813186, "uuid": "9c42674e-9e39-4483-ac7a-3cc5ee57b8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813186, "uuid": "954b4b83-a9b9-4aa5-81f9-682045194966", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fedad7-78db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859371, "uuid": "98ab32d9-3ff9-4329-8800-7acd55a6c222", "comment": "Malware payload", "value": "a5aabcebf418cb21625fed14d52dd47e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859371, "uuid": "c3e0fc4f-bca7-45ed-903c-1ec9a625dc50", "comment": "Malware payload", "value": "0a86234921d338a71aa9d875c4201925e5882f154f7905bf8ec8cd12b4de22b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859371, "uuid": "38c136ab-cc2e-4c02-9cde-4d56bfd9e685", "comment": "Malware payload", "value": "df446c2a39952a0aaa250dbd63e0140722394536", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859371, "uuid": "bf16f9ec-4da5-4c7e-be62-41e4bc2b9b0a", "comment": "Malware payload", "value": "fab7ca464ccd8a0458c77194ef13363d6dfc6c9d52d79dfdfb553cfc66008a89f6738bd03661ba823df2aee98e3ede5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859371, "uuid": "30075438-89f0-4991-af2d-1052fed29831", "value": "T11E1633053A8DFC67D136577EA6A382744333FF1407180A6B71983FEE953AB72198B948", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859371, "uuid": "e55472f1-0f6d-4c18-98a9-5c98f840485f", "value": "50c90ecd2211904194b8e4d38f962ff7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859371, "uuid": "8d6b32fa-3100-4160-a09f-20a773f33f17", "value": "98304:Chmmp5iMwZK/jUefSA995+rmNv8KP7ELIKWT4TWs:UNp5i12jXSA95+rev8O7ELIKWTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859371, "uuid": "46f93b05-2bb4-4c9d-a95b-cd20d798b2d3", "value": 4368145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859371, "uuid": "49a1780f-7379-4baa-a88e-097f1072b7b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859371, "uuid": "c87f54ec-edbf-4ded-a9ce-1b2a1d21e2e2", "value": "SecuriteInfo.com.Trojan.PWS.Wsgame.50488.2813.10001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ae624e-78b4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698842878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842878, "uuid": "fee335b1-df27-4fd7-814a-15211b5f02d4", "comment": "Malware payload (AgentTesla)", "value": "5df0889ecdfad6a73ccac25b30d25a4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842878, "uuid": "259f4bf2-d29a-4c5b-acfd-aa3d77f0e065", "comment": "Malware payload (AgentTesla)", "value": "0c21fd40425fd9f22814fdd019b69dad64538d8e4a49a38cf0211301d053a2d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842878, "uuid": "3213cd58-0ece-49f6-885a-f2b9558b4243", "comment": "Malware payload (AgentTesla)", "value": "28494886466e3bbd42b5ebf91066c604d7aacfb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842878, "uuid": "60dea7e3-267d-4e82-8476-c6236bc1f0a6", "comment": "Malware payload (AgentTesla)", "value": "b4eced1bbc00b04e91461661a242d6a25011651d78c6d91934ba215055f9b2e689bf23ce9a5653cbe7219671786a6250", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842878, "uuid": "a9638d87-675f-47da-ba7e-6b41b402cdbd", "value": "T12E05125977792FABCABE83FA7125651003F6A43E2472E7449ED1B0E72135F600A52B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842878, "uuid": "62646432-2c19-40b5-ae30-9e846d9802b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842878, "uuid": "c703bec1-4c71-45e7-90be-42c1f7edbd56", "value": "12288:CeoaugyA+qNrbkk8DK0TWAkZpPdwzGinkEZF8D44nRad5VR6Ko:egB+qZkkCVCAsPdIYGz5VRXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842878, "uuid": "0ab5a852-cf45-4574-85ae-1a23f24dcc8a", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842878, "uuid": "176fc007-a3c8-49e9-b868-1d02fae9005f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842878, "uuid": "2bc7b46d-078a-4586-9543-76d910d2c74d", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80180e94-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819950, "uuid": "26c6313e-294e-4c19-8b2b-54ff3d0c3844", "comment": "Malware payload (DarkCloud)", "value": "c2bba753ad470c158d94cd4271dd604a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819950, "uuid": "1fd75d7a-b6a9-44fa-a54e-a405d431f0ca", "comment": "Malware payload (DarkCloud)", "value": "0c810509ea618f1d25ae1e2d1c01f2ecd3f20907dfd726610e97fe7c7116274f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819950, "uuid": "30cbae0c-4eaa-4bdb-b5a8-0dc77294ab9c", "comment": "Malware payload (DarkCloud)", "value": "f2bd2d5b22db0d19c3ae8d3409dc4cf66a815a60", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819950, "uuid": "457edda5-a1de-4f10-a46c-ff9d290ed03b", "comment": "Malware payload (DarkCloud)", "value": "cd42c84e810fb1a4e511498c5031911da3401ccbd926734209495ffa9c5a86abfe23bb1a37b1aa11dbd48ad12c58449f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819950, "uuid": "703127bd-6792-49be-9a0c-361d54544cf7", "value": "T14A157D1122F19B24E07A7BF49A75412187B92E65252EE31DCCE0B8D91E72B13DF8760F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819950, "uuid": "41263a81-d5b8-4d5a-a9e4-803e4630d420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819950, "uuid": "6268aa5b-d112-4218-a801-06a31d899be2", "value": "12288:OODphClGCxeAipzqlt8HhHVX+z9Ii9G92pLXf9ogFPZIl0dogW3t35dxCA:O/lGYM92FloQPulbxl5dxCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819950, "uuid": "f1cb7f51-8d2e-4457-becb-e412ebf8703f", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819950, "uuid": "1c0fb9c1-bb20-4597-8e4d-e77547a6f984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819950, "uuid": "5ebdab14-592f-4e93-a117-5ea4a342ae3a", "value": "76543454567ATA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d80273c-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698819891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819891, "uuid": "dce79d99-fc87-4f6f-900b-6a52e6beb1a1", "comment": "Malware payload (RemcosRAT)", "value": "35b2bedc646bce3e1b5a7d12313f5416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819891, "uuid": "b729b40c-12e9-4fb0-b3a1-a7e677b5dac7", "comment": "Malware payload (RemcosRAT)", "value": "0d4a4a3430176fcda02b7d2d9ad7dddd71540f3613a53d89dc77dffcd9344361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819891, "uuid": "c8aee82e-67d7-48b6-97e2-61a8f909b3a5", "comment": "Malware payload (RemcosRAT)", "value": "1c941cd24f9a5113347fb44de9fe2c8d73df6f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819891, "uuid": "d85f5bba-4b17-43a0-87ea-553e6dc7e40f", "comment": "Malware payload (RemcosRAT)", "value": "4db1e0f7f05498fc376445d8391b84ee4f133efcd528f3fcaa9c10959f3c4a347ca1b492c469974afc6a16d8438540b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819891, "uuid": "b9eb02a3-9f29-4ab3-8e49-54c1bc19d13a", "value": "T166E423859190885BD4D2BAF03D74E2575561EEA20924026B57F8BE39FC32327DC8E7BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819891, "uuid": "eef2c026-a104-40ee-8f9c-77faff553f44", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819891, "uuid": "9d1b5891-e6d1-4646-8c1c-a00aad80ed5f", "value": "12288:KYrYfZntALNn6/2H853S2LT9brn5aGO4/jNLfrgny5L13WA0/ldITsaIJixdSO1K:KYrYfdtALNxH2S2Lhbr5C2j1frgn2tKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819891, "uuid": "7233f527-79a1-4a88-95b7-a6f160c5ffd9", "value": 712754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819891, "uuid": "e39f5e1a-1c17-425a-b478-df3282a07389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819891, "uuid": "57895251-ff0d-4918-b5c3-ceda0e5d738c", "value": "457898765456REM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cffb41b-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833554, "uuid": "ff32c7d4-d0c7-4e94-9bda-b63be2a48b06", "comment": "Malware payload (AgentTesla)", "value": "1c22403939e8563ed5439ee977dcd4bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833554, "uuid": "af0168dc-f183-40fc-8b35-1f2ff8d371a4", "comment": "Malware payload (AgentTesla)", "value": "0df07d743d2b9a725f075819ce9aba1e2139494ba3c97c1d7a38936c2d6012bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833554, "uuid": "0a5786ae-e99b-40f1-a6dd-ff8725af571e", "comment": "Malware payload (AgentTesla)", "value": "36e0b7110daed067077b1f42b6af5407c78c2365", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833554, "uuid": "ad15200d-7279-4dcc-bd5e-7736cd138105", "comment": "Malware payload (AgentTesla)", "value": "60c004cecb21a42b1c19a0a726fe61c281cebf1db4cba7365b2ae8ee078a10208c5bae6a2f6769a6dcb54ec24e80c0c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833554, "uuid": "164dc630-e32b-47ef-b352-ff01a057a400", "value": "T1C705E000A6AA0B11DBE473F64F11E63457B25C6E6866E24D5EF17CD336FEB430A02A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833554, "uuid": "6ba7fc8f-d33a-43f6-9b37-e7cc9d5af81c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833554, "uuid": "b39300c5-5f99-47a3-876f-52955a9c5487", "value": "12288:E4rx3tdTJtEswi6Jxk4XWC1FD+M+QjIyjhoafB:E4tL9tEPQCfb1jxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833554, "uuid": "ccc3b5c3-2ce5-417d-ba3b-81cf5b983149", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833554, "uuid": "07659ae1-7e98-427d-acd3-7aaef4c43f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833554, "uuid": "dbbe96ee-d014-4c82-80b8-8f519acdfa27", "value": "Payment Advice-BG_EDG9502023090801020018_4483_950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004a1bab-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698854524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854524, "uuid": "a457dfee-ae89-4ae5-9987-c79fa816753e", "comment": "Malware payload (AsyncRAT)", "value": "a8464148a9e655ac8fc3322cba0dd686", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854524, "uuid": "e4ed6517-d9e9-4725-be96-a6886535cb01", "comment": "Malware payload (AsyncRAT)", "value": "0e85db8f57ab16ecfa1ff1b7c629b92804803c675235510e846761561c0d6986", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854524, "uuid": "c39d8f4b-8782-47a4-b165-0f3bb85f85b0", "comment": "Malware payload (AsyncRAT)", "value": "789c6c8b84c6de4ce419c6dc45d7a026a8bd4487", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854524, "uuid": "c7817784-ec27-4060-b6ef-168cd7f39b3a", "comment": "Malware payload (AsyncRAT)", "value": "d6306e1e09e1c279b6b785fb5877016a8cb864268cce5c05a51bd5dc3acd2bb2662f7a32a7a65afe8f36b7cecfd7d0e3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854524, "uuid": "60ec5d8e-7df0-426a-be6e-88bd7d8bcdb9", "value": "T127235C4037D8C136E2FD4BB4A9F3A2418679D6676903CA5D6CC814EA2B13BC597036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854524, "uuid": "7a6cea3e-ca08-4174-81d4-41acd9565876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854524, "uuid": "963a595b-7454-4bff-8b12-9b42b020da6a", "value": "768:taIO5VILWCyh+DiPNsKU89yI//ica8Ybhge6sFPWvEgK/JzZVc6KN:taPNFrTopzbOEPWnkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854524, "uuid": "71cf6ff7-a74b-4105-aba6-6a9108c627da", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854524, "uuid": "4ed7b5e6-a259-4647-a131-1f64b0aadfb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854524, "uuid": "3f4b5d1d-1db9-4aec-81cb-7b7a40407f37", "value": "a8464148a9e655ac8fc3322cba0dd686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ef12c9-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698854341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854341, "uuid": "e600962a-ba91-4f24-b04e-db852396d369", "comment": "Malware payload (GuLoader)", "value": "90a44fd9f939928d5327267959b8fbf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854341, "uuid": "e8c2d472-b211-443e-aa68-cf493da9eaec", "comment": "Malware payload (GuLoader)", "value": "10939036f7771bbef57e61642ac2f2ee1d8a811a85cb2712ef2439954d788f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854341, "uuid": "4b765076-fa63-4541-b462-5682dd2b900e", "comment": "Malware payload (GuLoader)", "value": "9281a3c7453a0ba297f23394258f13536eae2961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854341, "uuid": "ef59a5fa-83db-4543-abbc-23e4cfff532b", "comment": "Malware payload (GuLoader)", "value": "2dcea6db69758b498f264e67e12c7d3882d8939bd2654df9af71c347cc29099a2995cf5452abef33f06d5ec12a2f65f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854341, "uuid": "d2e23105-a71a-4376-9a9b-bce590af82ce", "value": "T1EA6523185AD0D683C38129BE446291F6A6B19D45FD1092E3FF38BE4DB87A2C0BF097D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854341, "uuid": "f5708175-1aa2-4134-b57c-3092217fa795", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854341, "uuid": "6b3e2fbc-464a-47b8-ac85-d1448b531df9", "value": "24576:4Kk6ZDUDqj+QJSX/SJLwbpclU12Z1owyMsMtBH9I9QoP8YfyWhk2xRUASHJcPW8P:9kYUDer8X+wbylFZ1l7wQokD09OuPWHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854341, "uuid": "850f7746-779e-44eb-99d7-f5137e7e1def", "value": 1514812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854341, "uuid": "df84b78b-1deb-4153-bf1c-73dae7272ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854341, "uuid": "5ba35664-a950-459d-8809-e2e1a3e57bff", "value": "LISTA DE COMAND\u0102 NECESAR\u0102-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29268a6-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880701, "uuid": "7fc98bcc-7072-4c3c-92c3-5a75b9529ed8", "comment": "Malware payload", "value": "357742ba52f76b94ff6bc583cd6c72c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880701, "uuid": "1b3cfa20-8ca7-4cbf-a054-9e761354bd2a", "comment": "Malware payload", "value": "123788be8131fc99a4a1a4dec8633b08fb448c7a0a4d301b6814f9d936320085", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880701, "uuid": "99ca7af0-b6ca-45f4-bf70-31c06cbe90a4", "comment": "Malware payload", "value": "0525b12df6d027945d11dc9459c15518d490d173", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880701, "uuid": "4dd20e3b-2b80-4e5f-9b15-0f08da12d033", "comment": "Malware payload", "value": "37568ab217fa9966d920fdd4bf942cf9bdd8be002350758bf6c01b5356cb0d7c1baa2a75bc250ab568a53d470ebec8e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880701, "uuid": "09aad878-ea1e-4983-b714-24ed184546ec", "value": "T1F3B4E505F684C62BD2A51A324C9BE3FA6B39BC059F86C3273294332F3D73B548A56745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880701, "uuid": "100aa88c-afe1-49db-a8bf-2258fc6dfa82", "value": "6144:Ow8mx0MMSD46k8CluCQ2liUK2/8ib1E6z9Nr5YbDYN8wp1EcdN+UhFG9afrs:v8m+8Slit2kihEUpj+U/cwrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880701, "uuid": "32d9d2e1-2ee3-4707-9bdb-d99093dfa7ad", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880701, "uuid": "26d2bfe6-7ac7-46fa-b86c-9f2088221c8c", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880701, "uuid": "4dd43d1e-9e10-4169-a297-06adf9e630fb", "value": "SecuriteInfo.com.Heur.29544.12030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbbc90e-78e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698862759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862759, "uuid": "66381c80-c493-4459-b5dc-52ca637398e6", "comment": "Malware payload", "value": "41a3c120ddd5bf56103d400a385d8146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862759, "uuid": "7c5e9716-d6a1-45c5-bea0-60532a4608ab", "comment": "Malware payload", "value": "133f62f51bdf46af75a3b9936457b473d8ec6b6d7b9df45851e5f06cf85c83da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862759, "uuid": "476e0873-cdca-4045-b6ce-0ba820c527df", "comment": "Malware payload", "value": "52241fe4a01bfc57cea717856aea6f3d98810e0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862759, "uuid": "56f648ab-02b5-4562-8a76-4a90a77e2e1a", "comment": "Malware payload", "value": "400d5329a61ad1bca1ce7a96e8428c75a842d4fa300a1ce2315c4adfe4bd9ff8572e4b59fa7c8e289342416ea5f2c1af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862759, "uuid": "0acde3c1-d533-487a-b857-b2d80b8b4273", "value": "T14DD412283BF8C665C8AC77F6A0A0015403758B651A93F3AF1FD5BAF249B3B54CE144DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862759, "uuid": "e9617597-ebb1-4a3c-8957-35819698dc89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862759, "uuid": "d8f7e701-44d8-47db-ab5a-5e9c06e970b6", "value": "12288:f1Bao2pULM9NrDi0pRou9QAq5YP/gMdLUIFxRLwp1BaqIgYXW5FDKdGF+:D49N60pRxQAqKgMdLUInVQbYzXW5F8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698862759, "uuid": "4327a6af-d62e-485e-b75c-3cf99db56bab", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698862759, "uuid": "ba03f882-437d-4768-84db-6a68f3435ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862759, "uuid": "ec73d232-0612-4609-97e2-0140ee64a00d", "value": "SecuriteInfo.com.Win32.PWSX-gen.27831.31298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edb7eb7-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855488, "uuid": "0c7ed67f-e337-4146-b16f-cb667f57b590", "comment": "Malware payload", "value": "47e88c8e89c1e99ca76ec3d8bab8c3d8", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855488, "uuid": "4af38cb7-8af7-40a2-abe3-65734a767ef5", "comment": "Malware payload", "value": "13d499124f676b7d0e326c36a6af6d9968e8eb6b66f98fcefb166eae22149b7c", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855488, "uuid": "e0117f7b-8efc-476d-bf44-21eb3bc782a1", "comment": "Malware payload", "value": "2eb0d2ad0730adaca7a4a8dd32715cd4b3809721", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855488, "uuid": "a216c5a5-b617-4bda-a211-fe5238d14b84", "comment": "Malware payload", "value": "5856146734e098728cace011c8a3a4b72b624de1b85bcc54a77e731146697f06e3048862e04b035c90ac62678434fb63", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855488, "uuid": "65014711-a429-4986-bd1d-043029471a81", "value": "T18B65CF52B6C244B1F59201B516ABE77F6E39B1416720CAC3D3E0DC281D526E2EA3F35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855488, "uuid": "c6005f4f-698e-4c7c-98b9-23993d33bbac", "value": "1bcee876dfae5e68c3451c29f9217c72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855488, "uuid": "9bbde1d2-58e3-458c-abd8-a33ffbec11a3", "value": "24576:MNbP9SNg9nmKu2HhIYjAY6RTVSTPkSnexozZTQAvTWjYIZTbRFPUN0gLuweIDak:6TRnU4/FQAiFxfPkao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855488, "uuid": "ff1342d1-5751-407a-a4ba-a294afd7e319", "value": 1483040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855488, "uuid": "b7a6a99f-e623-467e-9cea-d19c546a3e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855488, "uuid": "f273b31d-6797-4303-906a-03c328e2b30f", "value": "169885548794f8bb76ec81d41df212c31ad17aa6d18ca0f49573858e01f7d03c15f1daddac868.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216bfc40-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819791, "uuid": "e10e82cc-8a70-4d4c-8f22-8286488d8c91", "comment": "Malware payload", "value": "a8ed4f13bbf672c88a7bb537c37dc51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819791, "uuid": "e5198213-72cc-4107-8470-1f6b4f6764fb", "comment": "Malware payload", "value": "1442f710adc6a27d150feeb6a48bff64e7a85a3172d97e6a04a7033e7303e7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819791, "uuid": "d48e2bd0-6477-4ee8-ae65-df3f6949cada", "comment": "Malware payload", "value": "a93c7aaa7afc23a9a1df0879f66eab7f43de9e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819791, "uuid": "0691e02f-e9cf-41e0-aa06-06c2c50b7b35", "comment": "Malware payload", "value": "fdf70b60416ece1a363db1e3b36604b8d15be8a9c8ea39a91f7b7d597a099b7623f5aea5d86e797c25eabe5fcf31b056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819791, "uuid": "f29c379e-77c2-4442-a2e5-b0b4658fb052", "value": "T110535C662C91580ACAD47BF829F091572A31BDE11520C1CBA8FCBF259EB3313EDC51AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819791, "uuid": "043dbde9-3ad3-44b9-8641-b9c2ff51bcd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819791, "uuid": "aa2720e4-a591-4f7f-b312-e1cba0d0ad22", "value": "1536:Py3L2PYEa+su630VDcM7TPxdF8o75F943hh:Py3L2gEa+iEVDcMfxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819791, "uuid": "e8e0f3d7-a01d-41b1-bfa6-2f16aa07ea7d", "value": 65608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819791, "uuid": "2472c5ed-6c25-4513-a90f-3692f486824f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819791, "uuid": "54dca3d1-9d5d-4ab1-801d-d7e127aa22b6", "value": "Factura 20394747_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e738735-78e2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698862440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862440, "uuid": "88023aad-7820-4e23-937d-00253c95c30b", "comment": "Malware payload", "value": "f6cf3e7a47b6210ef89855787c9625c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862440, "uuid": "8d3ab6e6-001e-4e95-ac51-bb39fe285824", "comment": "Malware payload", "value": "145f7abe9abffd0422f1c1f4cf429e89fd9d3be93e6c3a0dd852db708992c4ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862440, "uuid": "b2d5521d-cac0-439b-b704-e592e1274634", "comment": "Malware payload", "value": "f5f4b1e38bad2f9aca8617c04cf04c62330b401b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698862440, "uuid": "59f069cc-a811-40c3-9d29-92beec419aeb", "comment": "Malware payload", "value": "2c16453c44cd5f2973a762f817e633e3223faeddfb422601143d6622759921906b60968e975eb5c2a6ff9e0691c48acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862440, "uuid": "3c449a85-4079-47fb-9bd2-e3a7fe001e36", "value": "T1655622A9ECC1B584D06FA1355B32F83DF4F52E74496C0818B13D76FA993A2B01C671EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862440, "uuid": "d43feeac-f8a7-4c0b-8106-cc8232f935ea", "value": "46afc61b34fb8e20ac7399f0df86ba31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862440, "uuid": "e20b3807-a44d-4212-a6eb-c9ad41688eca", "value": "98304:XbQoWTf1qlsg6Ni7suYi8i+9GWYjE0t5mKBw64zqaasQQBUrlS0TGxQ33z44i4qQ:r071g57mpi+9kIk5mK74zBIQSrE0rz4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698862440, "uuid": "e9236f4c-94e5-4b66-a70a-7920ad2fffc6", "value": 6053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698862440, "uuid": "166ced6c-8791-455c-a491-6d50a00f65e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698862440, "uuid": "db2a7cc1-7756-4e7d-9003-ac4e793379ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93fec8c-7891-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827750, "uuid": "4c016bc8-255c-4a5c-87ce-d531fe3e58e1", "comment": "Malware payload", "value": "a90236e4962620949b720f647a91f101", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827750, "uuid": "f983a875-bc59-4643-83c4-41f4394aca2f", "comment": "Malware payload", "value": "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827750, "uuid": "b8123d7c-239c-494c-8461-0332e47f177a", "comment": "Malware payload", "value": "7f7d144cc80129d0db3159ea5d4294c34b79b20a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827750, "uuid": "d3cc55c5-fccd-4b40-ab50-6d64c9bf74ce", "comment": "Malware payload", "value": "ba14bbff25788c78bdd8945d8a2a2730b6c967309c23a5a58458fc91a4bec680365041174f85b01b8e6b41e21081a692", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827750, "uuid": "d20beb80-aa35-4e18-a234-b93a945bf32b", "value": "T17745BFD961903398C01F88389533BE49B2F5950F4BD595EAB5DBAFC0BB6F810E905F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827750, "uuid": "8c6f5370-d9e5-45ac-9d1c-ba6b4ab9054e", "value": "65ccc2c578a984c31880b6c5e65257d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827750, "uuid": "3f77bfc4-add5-4e60-bf68-17811a627e2c", "value": "24576:RGW7wanN/GJBKAHHKMdsDNGfbuJi5BHcAfj28ytpd0N3dquK:XkmtcgoTgfA/3YuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827750, "uuid": "6309cbc0-51ad-4589-9fcb-937f7ebf026a", "value": 1185336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827750, "uuid": "27518126-9aff-4481-9ac8-db0ae5c95399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827750, "uuid": "99cd299e-6cd7-4d1c-809d-117a093243f6", "value": "WinTapix.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f510c8d6-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698842480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842480, "uuid": "79a5e971-27b3-4f01-b743-ceaee486f1d6", "comment": "Malware payload (DarkCloud)", "value": "a7b5739e0c3057b565702afb9d505fe5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842480, "uuid": "efabfba8-55b3-4677-9ba0-19559cd10384", "comment": "Malware payload (DarkCloud)", "value": "14f7d680ee8feaf9228580eefe136fd081dba809db4f72063d1c4e3e503a3291", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842480, "uuid": "a7d64854-7c4a-40e5-86ff-2146ddf057ff", "comment": "Malware payload (DarkCloud)", "value": "662a0d6deec17c229ffa5dee283ef1c06addad34", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842480, "uuid": "a14f9f13-8851-4094-9bae-e4d075afad46", "comment": "Malware payload (DarkCloud)", "value": "7dc029128963c5858dfe11511741869de6401067e3c097227ab691c22334b88bc7c5c4ba9dd32e5d19f7edd2f47d7ac7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842480, "uuid": "a08ce971-0ea6-4446-a947-925696bff781", "value": "T161251280B22905B7EBB904F548A14D0107FD19B7B495E3D95ECDF8C284F77CA86A3A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842480, "uuid": "68b55731-d608-4adb-9858-2cede56b7476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842480, "uuid": "92878c77-c470-42c8-87a0-3f9ebec1dd61", "value": "24576:6UN0fOozHZcCrI9aaivMfXvoW7Na0Nyx/L5:lNGjz5VrbUfA4w/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842480, "uuid": "749e251c-2658-4966-8c95-5639e7e5b2b2", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842480, "uuid": "38b39f81-33f0-425e-b8a8-e71a4ada1eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842480, "uuid": "84c8fe88-1957-4132-be10-cf8e9ef33835", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45990c58-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833595, "uuid": "bd3bf3dc-350d-47f1-a27e-d651d6cdd0bb", "comment": "Malware payload (AgentTesla)", "value": "7e05e729cdf73e8e8da416d127110a63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833595, "uuid": "f654b715-6cd8-4627-81ee-32a0109fe156", "comment": "Malware payload (AgentTesla)", "value": "15f8390b37fb35a6ee1d47c60914fdea8db15bbb8137135c05bbddfa2c6c2c0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833595, "uuid": "9288880c-e31a-48a1-be87-0ed749a71bd9", "comment": "Malware payload (AgentTesla)", "value": "04e3c6e31def446209a18f04903fa9648bdb61ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833595, "uuid": "f28e780f-9d54-48ff-b215-303ec2416c0a", "comment": "Malware payload (AgentTesla)", "value": "092567ac035ce88c7de0a86a949dc22b94b681312bb8e039218db59170abe3d599c97236d546942f7965ac733a91d2e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833595, "uuid": "8320d0f5-b9ce-489c-99de-defec6050324", "value": "T17BD4232033BC4BA1D0746BFA90AA26570373B21F4946F7A91E9BB4C91927FD00E61F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833595, "uuid": "ac2febc3-cfce-4656-885e-a3595bf5b4e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833595, "uuid": "cf703e12-9f24-4d97-aede-c0d32c60c83d", "value": "12288:rU+qoaGcuuCr689v2QeTZECL4Mdyus8fsqwMPySKyMT:rbZGavFeTHyubEqwoyOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833595, "uuid": "6786b166-7c68-487f-81e4-1914432d539f", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833595, "uuid": "c29cf52a-82a0-459c-9c8e-1374dfdac505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833595, "uuid": "a2a0261b-7a96-4ab3-8a6f-182781400c58", "value": "xGgJk42G7Sqo7zi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839e8c17-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819955, "uuid": "d5317c93-f0bd-4e02-91bb-556c7f300dda", "comment": "Malware payload (Formbook)", "value": "ab42940ac139ecb001ecb4069eaeca10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819955, "uuid": "875882a3-3043-47cf-90c2-5e2fda96e375", "comment": "Malware payload (Formbook)", "value": "163918e075f9f05489c3a68bdc7fef36651632a3c8b59817f3e0cbd1fb172b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819955, "uuid": "8a887353-9114-4b1d-b643-8c1a865820d3", "comment": "Malware payload (Formbook)", "value": "cbc3519648660e4645c4845d59da3c4cd398e3b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819955, "uuid": "40ab42b4-e7c0-4e46-8fd7-0989a42b31a4", "comment": "Malware payload (Formbook)", "value": "97d8e746e104e7a5983b655621c04715a5b44a5f090ee6fa4cac40a1b5a2776f9b6d3648207fe532b078b75e005240c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819955, "uuid": "e6ea6805-cb94-436a-9ff5-3f181b5184bc", "value": "T13734F21565A1D526C4E17BF05DB426536BB6BC621128C24B6BB47F28BA33313DCCB32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819955, "uuid": "626ed7ae-776b-4aa7-b3a1-a64373e16943", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819955, "uuid": "79f1121e-4f3d-4f9c-b05b-d25f0b4ac7b5", "value": "6144:AYa6pEVDnUE2PtG6HzwclJJMTayK+jzso6HPzXoQMQxLA:AYT6ItG+wcXmKChcbXNNx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819955, "uuid": "c16082c2-ade5-403c-b29d-0f27633ff5dd", "value": 249256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819955, "uuid": "d47fd7d6-9f92-47a8-b500-c9b9662b66b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819955, "uuid": "a8fb4399-20c5-4ce5-9175-555650dec26c", "value": "T10987654568900000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1176f61-78b2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698841909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841909, "uuid": "023d2659-582d-447c-9d8b-c06f0f2887bd", "comment": "Malware payload", "value": "69668c6f99437573e6d5603476c34421", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841909, "uuid": "6e6af985-2b73-4574-9d5e-eebaf5d1c8bf", "comment": "Malware payload", "value": "170a98b485ccf23969b2d5260101f437f6190f6be7512749d46e0c1fbe2ef61f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841909, "uuid": "e38808c7-534a-46e8-94d9-b28264fb5456", "comment": "Malware payload", "value": "55d362897b67bde5c56ba1e98f4900cda04d2f09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698841909, "uuid": "5883e081-063f-434d-b09c-ae1f0deeb12e", "comment": "Malware payload", "value": "96794d128becac4db9cce61bf71c72b63f0ef8447b9711be5a66c4aac4ad97f78fa1aa9c4b6f2c9d21cc6082bc813bbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841909, "uuid": "28abc8f8-6c6b-4785-b8b8-35ba478ad8bc", "value": "T16F75E0327995C83BD3BAC67D589C635914E7E8730E322D0B21FC379A5BF89861318E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841909, "uuid": "2163af3d-1951-4250-91da-929f2852a560", "value": "4454df7b8d68533ee996d945d002a4ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841909, "uuid": "9647c3a8-a297-4c65-87a3-ef787ad463a1", "value": "49152:1rDpAhLZmsgaKaq6Kaq6KaqoDb393A8etQbz1T6/YsrUSKP4J:5UF3ucB74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698841909, "uuid": "8479d392-133d-4fcd-99c1-d36c9f736d59", "value": 1579352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698841909, "uuid": "361d09ed-26ca-4f90-b1c0-1238abefc092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698841909, "uuid": "24af62d7-fc3d-42ab-bde8-1a3acccf7bfe", "value": "AJl.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c43c817-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821232, "uuid": "655f1a1b-1ba7-4de5-8100-46d3d98f2091", "comment": "Malware payload (GuLoader)", "value": "a5f67d4e0d1b4bb24c96f9ddcc1993fa", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821232, "uuid": "b1ed56a2-622d-4a87-8f75-9d5cd69c6a6c", "comment": "Malware payload (GuLoader)", "value": "17252fc23483253e84d9eba1fedbade5298dd1e8916ffb031e268c922ffba153", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821232, "uuid": "9e2a650b-0a9c-4d92-a72e-f902817ef42b", "comment": "Malware payload (GuLoader)", "value": "e338c767fead47f380a652ed5e14a1dab8458942", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821232, "uuid": "04d7edc4-d98f-4c1a-87d3-b953f151a9f6", "comment": "Malware payload (GuLoader)", "value": "ca7c24bf6e52d5e44d0d649997f644fd49daac1f29fadbf71e6e240afb49eb45eaef41cda5d578fbb1349365c92c7dd4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821232, "uuid": "580067fc-c9d2-422e-bfda-d9f658078e1f", "value": "T194936DF2DB94161D494B27BEDC424A62CD7C802D7627063ABFED078DA10B45C93BEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821232, "uuid": "1ad67568-8a3a-4057-8759-168c90043da8", "value": "1536:DtWVAKDxxVzcPljwVHvJbbZlwI3+XWAwXQCO4XSP1MiwvoOFeBLjpy4:xOhxxtc9jwVHxbf3+mtgCOESPyiwAseP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821232, "uuid": "ed501da9-3801-4a40-9278-d0c88db12fc8", "value": 90839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821232, "uuid": "62b90d73-b587-4b09-b17b-59fc3d3534a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821232, "uuid": "103c2d33-641d-48e0-9ae0-cced9250cf89", "value": "197600681N-PTE-01\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0625e2-78c3-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698849011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849011, "uuid": "c5f9635a-b354-444f-9db9-be6b047ad45d", "comment": "Malware payload (RemcosRAT)", "value": "82c0eeef97e7997780f7b116bd80e852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849011, "uuid": "13faa1bb-e9ac-4271-9124-3e20048c3e3c", "comment": "Malware payload (RemcosRAT)", "value": "17d12e966b6e89c0c80d7d03e7a665b5d52801a5256a3e0fd1c96a11fb8828e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849011, "uuid": "41be62bb-e907-45e7-8e08-64e66529841e", "comment": "Malware payload (RemcosRAT)", "value": "35051652d31dcf2641536f0dd88ff11eadeec1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849011, "uuid": "6e33b55d-5b2e-405d-895a-f2595361df06", "comment": "Malware payload (RemcosRAT)", "value": "8d28cb1d4eaf1938a2cfcf7e54a5e7a0d770169b4dd7ace395c6f22b299019005bf5b151a568256a1041fead8d4c811a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849011, "uuid": "041bb657-0900-4ce6-9911-aa7938cf3a27", "value": "T11FE4231EBCD6769AC9D0B3F4A1B0A567B53A9CC52124C0478AFD3F27B632057DC4A1AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849011, "uuid": "df12a487-ef32-4489-8d73-def7762d0002", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849011, "uuid": "f7fc7f74-4ed9-4d9a-a028-6cfdc85f512b", "value": "12288:fwtnb6QONy71XH2e8en9JbHE0tIhMqjXQ2rZSmzTXkjgiPFd4riMQr0:fwtnb6tU71Xrn7HjtyrZrwhFd4riM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849011, "uuid": "58fc496c-e2bb-48cf-a6e6-63c540d1dd86", "value": 682281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849011, "uuid": "33db6397-5a03-482f-8a08-e350256f3cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849011, "uuid": "983f601c-92cc-4c9e-88a4-ec8160b2c419", "value": "FAC6899890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b359e6b1-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698855254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855254, "uuid": "8e7fc9ce-5a47-4dca-9168-ea436261865d", "comment": "Malware payload (AgentTesla)", "value": "59914c978891a061e2870c3f14b2a108", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855254, "uuid": "176cd275-42c4-468a-a133-fa3d2414cadb", "comment": "Malware payload (AgentTesla)", "value": "199e6a04393765cb8c52797906db84536abf7ef4b25406ccbe008bcc649a4a45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855254, "uuid": "18aea350-32dd-402e-be26-e1adff889157", "comment": "Malware payload (AgentTesla)", "value": "a4811c1437da8a14081002802f20ee7c1c9760b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855254, "uuid": "4b89fe1b-50ed-4bfc-8df4-364eb883118f", "comment": "Malware payload (AgentTesla)", "value": "03253767c62ee6f3ca9544cdf3ec2c34973f4f179d11edaf3cf14f08c4f2415aae58e4224001343b8233b3e304780589", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855254, "uuid": "b7f877cc-94a9-4912-a6e2-ac7b2ab4ea2e", "value": "T155A3DF1DF212E849C167A87C8DCCD1DB621DBC619E92EB0F3580B71E19784D38B9B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855254, "uuid": "764ce412-14b7-481b-a3c6-216e9864d5cb", "value": "1536:EpQDyT9HK9LKt9+CNtVnwkpIatI8yhcDYZUeNBc/qw6/lhH:3awKt00dwkOmI8yht5xb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855254, "uuid": "8d58e040-30fb-418c-a42b-059fdda17b7f", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855254, "uuid": "60aba670-f973-494f-9b6b-34d96268b836", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855254, "uuid": "a9a74f27-de2a-45f8-a78e-197ce29843a2", "value": "Swift 01-Nov-2023.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c24b67-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698833594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833594, "uuid": "1c556d69-28e8-44c2-a6f1-952fb8512b60", "comment": "Malware payload (SnakeKeylogger)", "value": "330ca2b7317ef6e82d8868e6c713b26f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833594, "uuid": "4bf8ae1d-9d7e-4ea1-b0e7-53cd8e1a6082", "comment": "Malware payload (SnakeKeylogger)", "value": "1a0b400c17de9e90130c9ce738389e3371f72e20c72bed672b732a3fc6bb1b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833594, "uuid": "29b1ff45-bfdb-4ea4-9d9f-83524b84bb2d", "comment": "Malware payload (SnakeKeylogger)", "value": "7bce0ab5f04ddb83c5c9c2c7ead4c786fd0e4d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833594, "uuid": "f464d957-a521-4944-84a3-d3c561d375aa", "comment": "Malware payload (SnakeKeylogger)", "value": "104db250a73bf4ccf8baf7fcd4dbd992ebaaacfbe9de8f01f0b6476c67bc91dfe110932f69b875925f3f9060eff08940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833594, "uuid": "af656362-319b-4d93-bd1b-2d8a09b084aa", "value": "T17CB4025433F82B65E2FD2BF598B050554F76B61A7AB2D24C1DEE24CE2573B208A40F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833594, "uuid": "60074bb5-005f-4428-87d0-8bd87c8d96b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833594, "uuid": "ddca6d8c-78c6-4939-95b3-7cc91a61cec9", "value": "6144:IGtShSALi0YhM1I51H2AUX+fVB3K9FkyVKWQQLZJR03/bbOMj5LgaVzxtdX:IG0ghTDsuf29FREILmvPOMVLgaVzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833594, "uuid": "4e10f67b-d506-458d-8bc9-aa930d5e4ea4", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833594, "uuid": "b146d758-9c0b-4bdf-889d-5a57b76bea04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833594, "uuid": "5969e788-9ab1-4d06-92ba-55ba46cd6e8f", "value": "Swift.txt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87075363-78ce-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698853891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853891, "uuid": "dd91e9d5-90cd-4223-b609-0d92e17fec4f", "comment": "Malware payload (SnakeKeylogger)", "value": "abf58920ed73ef807269982b4e62fa9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853891, "uuid": "1bcb2a73-1d8b-4a62-b9ab-dbe1fef96014", "comment": "Malware payload (SnakeKeylogger)", "value": "1a43ce284eeb6c62750e67cfd710109ea3461e0fdb4e3ef6df64b159e78f8fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853891, "uuid": "7aa51ccc-9d77-4ba3-9ec5-7273ca8cb498", "comment": "Malware payload (SnakeKeylogger)", "value": "03e66fb10269f7ba6fe0bc8200ba5685f224ac7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853891, "uuid": "ffd376fe-1a8a-4045-93d5-b77e7279a56a", "comment": "Malware payload (SnakeKeylogger)", "value": "45e6e3390f3856b15f9f3bf4e0538b97bdb815ab87c718e51905bc7b5e79b58276fd046a367145004745d56580922810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853891, "uuid": "9a1fc8f9-bf96-46ce-8e8c-7d4a7f371f27", "value": "T14C65AE3658650A77C07841BFE72CBB08DEFEEA61B250DC2A4952E8D74D2365218CDE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853891, "uuid": "ad90d042-e4df-463c-8ea4-58b07c441f70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853891, "uuid": "9413213e-97ad-48bd-8650-1642824251b9", "value": "24576:qrEb2grO4+yKPoJHZ6gLl2FNY0wxOSkMoXwwaP7d3BFMukWMG+gcXh6dvrBV1ge+:+Eb2FyKI5wNVwxJk7XvTG+g+h6dvrBVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698853891, "uuid": "16f825d6-9bb9-4c8e-a5b2-8c10c2ab2c18", "value": 1479680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698853891, "uuid": "77b65c35-e147-45d6-9e0d-02f9c82c101d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853891, "uuid": "5a6c0678-fc15-4c91-be72-94cf85fa6acc", "value": "abf58920ed73ef807269982b4e62fa9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85563fd3-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819958, "uuid": "82be4549-4983-408a-ab20-eba9e4a9cd08", "comment": "Malware payload (Formbook)", "value": "cd8726e3db52383052d278bb7f85c373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819958, "uuid": "48a2ed90-410d-4971-99d5-242410bc2e4d", "comment": "Malware payload (Formbook)", "value": "1a941be94a0e9c18ee58c591ea897f8252b93988a8c87f79949d6f61722a752b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819958, "uuid": "c728318d-463e-4fa8-894f-78142708331c", "comment": "Malware payload (Formbook)", "value": "0d665153cdf3ee85cc7fa5e9909de80bf02a531f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819958, "uuid": "5bcf1523-7897-40c3-b531-a348b1cf909e", "comment": "Malware payload (Formbook)", "value": "4885fe93239bfc3b6e6910cba50b08d776c9193580c4b1261ed63db874cd011903d335985ce6e1d973b8cea47b257c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819958, "uuid": "180f8db5-5f32-4c74-8635-932a1059bb5e", "value": "T1319412422991C416C9917BF49C349A92ABA53C63516CD24B8FB83F292C333B3EDCD65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819958, "uuid": "ab10da6e-bee3-4ace-a952-e3c7b1f2aa07", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819958, "uuid": "49fd0371-cefb-4cdd-a39c-f1d309eab31f", "value": "6144:UnPdudwD/EVDiVZfZJ9PcX20f14Kgg5TZswILsJTTceOz4b7lELAsGaIfUwnUVWJ:UnPdLbVHjcXrmM/GETnOz41CIf9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819958, "uuid": "c5f75761-d545-4719-8188-0af50764b52b", "value": 420327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819958, "uuid": "274d6414-17e8-4436-b2c1-8e6694e36678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819958, "uuid": "76bca7e9-255d-4414-9d7a-21a2486baf16", "value": "TWQP0956789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b9a9b3-78c2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698848625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848625, "uuid": "d4569f1d-3118-4219-8d7f-71827bf21b2b", "comment": "Malware payload (RedLineStealer)", "value": "bd86d5159f0c071e2fa04f6f6c3ced11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848625, "uuid": "10ba495a-f8ac-4d70-a32e-54d540649efb", "comment": "Malware payload (RedLineStealer)", "value": "1b0e5847f75b8b3777be352bfab786cfb5c412d83f77d9470c830d42596d3cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848625, "uuid": "e100fe4b-c5a1-4af2-992e-3b6f21cc0a41", "comment": "Malware payload (RedLineStealer)", "value": "2e68404b707ecc7566c737e050c6071a8f65e2ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848625, "uuid": "81d367a8-798c-4116-9922-302cdb0eba15", "comment": "Malware payload (RedLineStealer)", "value": "d5b27077bb6484eb84b30d8cc5b881b4775d880799d90e4b5d833e14521c7ac23554aadf10209e580620e7e1243b34ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848625, "uuid": "e92bc301-0204-4572-ad84-c9e09f26fbc9", "value": "T1C1357C223993A525EFE210B383BD7721557DD0A407166DDB5BE5B6FEC2203C1BA362C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848625, "uuid": "012992a6-24b1-46ec-9ada-8f977af05fd4", "value": "b11c9cd467b185b2c3a0a894930ee4ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848625, "uuid": "40de5f34-74ba-4dad-9b34-f9bffab0a7ce", "value": "12288:cC9QZgYxMa29AS087kHCqZ+bwRO7bUjkgkruWSOHwWEQiii8VPfEw/TziDQIRyKK:ct+Yd29AX87kHCMVROfuhQiiiuPGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698848625, "uuid": "a5ba7c29-44f1-4f63-b3de-4a96bbe01976", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698848625, "uuid": "ae9ae3be-793b-4af4-b17c-73994d8f7883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848625, "uuid": "110029e8-1386-4291-9c32-b9f96311f827", "value": "1b0e5847f75b8b3777be352bfab786cfb5c412d83f77d9470c830d42596d3cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb902d3-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698820053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820053, "uuid": "9922bec1-84c5-4e47-90bd-4db85ba4180f", "comment": "Malware payload (DarkCloud)", "value": "d8d98d78068021e4e92ba6b88dadd495", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820053, "uuid": "f9f9dce5-51bb-492a-9d48-c10b9e8ac502", "comment": "Malware payload (DarkCloud)", "value": "1bef6e9201c4c290b30a66be4c6aea4492966417eb5974f26b38ba9ed732bdd3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820053, "uuid": "db89148c-171c-4861-9e9f-ac8de974c518", "comment": "Malware payload (DarkCloud)", "value": "676f666086198cea98e6d7c9193835481e3f9a70", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820053, "uuid": "84fa6a0d-4985-44b4-9dc5-4701f9d537f7", "comment": "Malware payload (DarkCloud)", "value": "bc1aa8aee18f24b3007dbcd9292a4e4d41106a31dde3e1dbb88d5dd09249e1a46bd675060592aec73b2f176ce50f58dc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820053, "uuid": "72a8f735-43ff-4d70-aa76-7115d11e705d", "value": "T1ABB4EF08D1CECC36F19EFBF6814F4DC083A91C7D513AD11A5A8121BCA1AFE6A6593772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820053, "uuid": "f963eb1d-f1d4-4713-bd58-3359dcbe0d2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820053, "uuid": "f30e148a-d525-4f11-9683-f96e5579b01d", "value": "12288:8AiQyxY3JNW0Q0t39w0VPieIKd5U1YzOx8DG87CMgqq:+Y3JwIwp/KdJOx8D/t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820053, "uuid": "1512b047-c089-4917-a712-abed8456938b", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820053, "uuid": "6e1c8b9c-0e9b-4743-847d-f4f1bce1e572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820053, "uuid": "5a54bc78-4923-4134-952c-f2b746b59ee7", "value": "INVOICE-098654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e91b1a-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698821335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821335, "uuid": "d32c8286-0d16-4d1e-9fd1-a139e6f7cd03", "comment": "Malware payload (Formbook)", "value": "7beb0ca296f26ea70d8ced37a537733c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821335, "uuid": "0673ad3e-0fc5-43b2-9de5-171229d75c8e", "comment": "Malware payload (Formbook)", "value": "1cc327be5ca8d7bd4cd244e9cd90454611559df4e971c3bd6649682413582c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821335, "uuid": "3f5f342f-5d7d-4706-bdb8-6ba2cd99a870", "comment": "Malware payload (Formbook)", "value": "be5701a63e3f80336535bba0901b0fd26ea197b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821335, "uuid": "1c108f41-473f-4533-9827-6ccbf112f1a1", "comment": "Malware payload (Formbook)", "value": "b36a67e0a857224f15e7cf4ee9da0ac61c50af544dbba5fed400adf5e1a0b2d99eac67e28fdb0fab86a1fc06ba169daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821335, "uuid": "93f14251-eb01-4947-a7f6-ac9f5aba7a98", "value": "T13105122976792F57EBBA63FAB028980007F8B56F1535F3588EC171DB6634F900A16B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821335, "uuid": "0ea33b6b-e25d-45e1-8a7a-a7782a3fcc41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821335, "uuid": "81d33fd6-b0a3-428c-a96c-01db0815b7b0", "value": "24576:orPNNqCqzwv32tzidpt7UYLtJ82sQw29/rH:MgCUwvcziL19hsT2tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821335, "uuid": "7c6b28c0-cf2d-4434-af6a-35728de7930d", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821335, "uuid": "53fbc544-756b-4603-94c5-680dc91d1c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821335, "uuid": "dac5b80f-1f43-4c9e-809b-06b1acb19f91", "value": "FedEx Receipt_AWB#817434841264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53a27de-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698855257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855257, "uuid": "4db1b0a8-884a-41a3-9a29-affcf5e1b303", "comment": "Malware payload (AgentTesla)", "value": "139484f5b19f9346210130e6bb9c7ee5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855257, "uuid": "18899831-c6d7-4597-aaab-20abe7c8a340", "comment": "Malware payload (AgentTesla)", "value": "1d20147a8f91e215e20ef9027d4a24fba8bb8ab11120adbf945273624dcc4d95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855257, "uuid": "f8993986-24be-4a87-9ba6-b7bcac91b107", "comment": "Malware payload (AgentTesla)", "value": "dde5c9ff0d2ba4de919875b12512a7320c0df12f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855257, "uuid": "a59c8a7d-8edf-4c8c-a1c1-3b0799ab82f7", "comment": "Malware payload (AgentTesla)", "value": "ba16df2ff9d90e31f2f2291d0a69ab0aa060420c0b030b4e0b5aa0b4905d128fd4a12cb8ec51f02e6aa09ce58f719b90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855257, "uuid": "20d1774f-ae2c-410c-b3ef-cf00bed9bb40", "value": "T18AD423EDC073CC6AFC9F2639D570D0412515B8A0E59FA219D621F4BECABB16B40BA41F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855257, "uuid": "b614b8db-16d3-4118-9daa-e998d4608a3f", "value": "12288:fI2BQbnXCOTiXEJLhwNhfI+fExr/0x8Ye0SQt9Df5vhI+2G1GA:g2BQ7TWKZbB/SBj9DfXvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855257, "uuid": "f39511a9-87c8-48ff-b0dc-ea95e99d7bf4", "value": 611631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855257, "uuid": "0eaeb577-529d-46f4-ab90-faad64ae954b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855257, "uuid": "0c36138e-ecf1-4948-b88b-4ea20afaefa4", "value": "PO-210119.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2410ec62-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833539, "uuid": "5b69688a-4ae0-469a-9fcf-016e806d21e8", "comment": "Malware payload", "value": "c53a32bdf177c4445711a5e8eca5bc5c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833539, "uuid": "3a19670a-6701-4e98-852a-d43f36ffa9b1", "comment": "Malware payload", "value": "1d29e037a16f86a0216fd42fb0660f436ffe53f0aa08f9a99f4d4e03b98d93a2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833539, "uuid": "38733e57-db31-4c49-b3e3-a0b6e496be85", "comment": "Malware payload", "value": "30bfe38ef691d69f7ae65be78ed334eb027239b3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833539, "uuid": "d5617aa1-aca3-4c6d-8924-e477ea9e01ed", "comment": "Malware payload", "value": "1c6036218eeb2e3a7e28d66040944b9291cde224ed3c0c45b429624ee7209ed4528f5f88566b927058bb3ab81702a463", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833539, "uuid": "c8dae137-a60b-4b8a-856f-5b511257e6e7", "value": "T14EE31394E2A94C5A261CF4827B54D0A859CDDAD0D13D38D37A7FBE893C8F95F6130E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833539, "uuid": "e329bf5b-7345-4def-8970-84958a6738cd", "value": "3072:/wgrmIwYcXwgkM+YLLSfKhSrCYMQkwhh77IQK6jb59kBGV0xCVl:/wgCxYFg92rvMQzP9bXkBSRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833539, "uuid": "00c8c298-4293-4f46-8242-e90e008f5645", "value": 149580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833539, "uuid": "a36bbec0-2dd0-436d-9ec2-2fb9d9d50438", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833539, "uuid": "dc8a6a81-a93e-4f2a-a446-359eb5b3a142", "value": "Inventorehh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eb52f5-7909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698879064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879064, "uuid": "a6d51683-caac-4ee8-8295-50904ecd957d", "comment": "Malware payload (Mirai)", "value": "8e09c6e685cc8c5f19485012f67593f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879064, "uuid": "d571cc97-597d-46a3-ba85-e5467daa1a33", "comment": "Malware payload (Mirai)", "value": "1d59f9466a4f551b3f6e8809000da75ba9457544bafe7339a0d052e79065185e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879064, "uuid": "476e0ac9-086c-47c7-bdf2-bfe0377ea5b9", "comment": "Malware payload (Mirai)", "value": "4fc8ac99ff5cb2fbc2419bac7861da5d4944bf58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879064, "uuid": "7b0319cd-3a01-493d-8da9-cc6498c2f36b", "comment": "Malware payload (Mirai)", "value": "870872d4f60998818a2ffd77b3190256d6ff04d1e5d67102d3954fc529cf64f869db181bef68fc6abad7b3c7110b078c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879064, "uuid": "75436deb-0aa2-4bbb-932d-03373728671b", "value": "T114C2D0FDB9B72B8BD903123AE56DAD3381B0E095E319728722C1512664032F5A736DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879064, "uuid": "68815ca6-92ff-48df-810c-2bddc15f91b1", "value": "768:5MwwDZHFbBy6rn21ZTTq1l5eTwRis50NG:5w58T/sRsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698879064, "uuid": "93485e30-43c7-49e9-ba6d-0875b216d611", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698879064, "uuid": "a6f513a7-7463-4366-9a94-e969b98f9eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879064, "uuid": "861f26df-8e36-4211-8444-9c6440843845", "value": "8e09c6e685cc8c5f19485012f67593f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f000999f-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880696, "uuid": "21bcf478-b141-481e-bd6f-2d2b7f5b1bd7", "comment": "Malware payload", "value": "206d9f529cff4cd41a9e5592baabe229", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880696, "uuid": "3f846b80-c854-4bad-aff9-ec79e022760b", "comment": "Malware payload", "value": "1decfea1035ea74d84f391c73e8bf71161ee62e1c633ea4d7efd93aa5cad4865", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880696, "uuid": "1dca0e70-5996-494e-be11-54c1635a3ba4", "comment": "Malware payload", "value": "5b3571f68d21f59e7d33f0ae51d570e8a879e3c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880696, "uuid": "a56cbeca-f4f1-4d6c-b799-faab20e7844a", "comment": "Malware payload", "value": "c0f71e11b503f324784ee8d2dcfbc41a3ec9ff50c52a9888d9c0819dd94edb281fcdd1e1b9855af5d013632968e29367", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880696, "uuid": "a3a01702-d45a-4d1b-add4-6b9e81a3231c", "value": "T1CD95174277D8C031D1FA02305815AED16DBDAE70BCAA411B7A0C760FAFB7AD1A635E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880696, "uuid": "c33f4fa1-3dd2-4be1-a279-aace30e7f23a", "value": "6ae7a38b7b305ae6ee2f7da26c6e862d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880696, "uuid": "eedcd476-331b-45e0-82e8-74d20d9ca92f", "value": "12288:dI0aZz+AO72eL36ykVC3q0JQ7iTkAcBSpXnT8Srd+kKgKSx4/JWsnswR4/pJbUvb:MzwexAtQSx+HwxQJtswR4/DAHP1zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880696, "uuid": "0b710c23-63cb-46d7-aed4-fc024d21d039", "value": 2006957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880696, "uuid": "80220f8a-48e3-4880-bb46-8d03cdf2f0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880696, "uuid": "d68d3494-21eb-4624-bfdf-2c71fffb0b02", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.31102.11632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce99e8f-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819971, "uuid": "ab6b634b-6737-447e-9315-81cf9a32d164", "comment": "Malware payload (Formbook)", "value": "5ae1bfbdaced5cbc6a6fd205b71838ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819971, "uuid": "11f620ed-0abb-42e0-a0c7-cb3bc7e4357f", "comment": "Malware payload (Formbook)", "value": "1dfaa6416d16dcf8262acf972f50414e76b9c8e4231ac3f33d03753454de32b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819971, "uuid": "beb174c8-d10a-4ee2-bca8-a6b0f0f2d1eb", "comment": "Malware payload (Formbook)", "value": "7ba167929191280716dbef866e439108c8edef11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819971, "uuid": "4e57bacb-f974-46e3-8b31-1430cf45991c", "comment": "Malware payload (Formbook)", "value": "63291c4d7ba563ce0ab14d5a26752a6435a81f95a97c8d0b6f2bcae0bb799e4e57d4dc14734d4fc4e5e909548ad3ab75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819971, "uuid": "79b7dd02-b4aa-4d9c-8d8c-b59e9495c164", "value": "T15584020679E0843ED9D43BF459B5659369676CA20128824FCBF4BF38BA73233DD8A11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819971, "uuid": "a91056ae-738b-4838-bd00-c752be3381be", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819971, "uuid": "dca9f0ac-729e-4b8a-8856-a2bc8bb51ace", "value": "12288:UnPdLbyU0sOlnESaz50SYxsjZLniLe7tGBY:EPdLbyUQESaz9/gqtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819971, "uuid": "6529e4a5-d506-4f88-8178-b431429a7cd7", "value": 400441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819971, "uuid": "ef8ae298-3ff3-40f0-a0ca-143044c1bea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819971, "uuid": "53ccbf9a-c8ca-418c-b832-29cbdc8cc5c1", "value": "POH86568998655680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc03a37-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833525, "uuid": "d766154f-babb-4474-9ac7-0d047cb01d47", "comment": "Malware payload", "value": "ff6b81f9a73700db1286b200f3559965", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833525, "uuid": "53f86192-0c67-4b85-a8cd-83f81efde3b8", "comment": "Malware payload", "value": "1e15d9c42b5e8fd7859dca64347d3fb270f5eaa132fa007b63075f9b805c93a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833525, "uuid": "6677c427-f971-413d-a908-f8380e1441a5", "comment": "Malware payload", "value": "d690f20777b5a5b98ceedfd65359f7c6cee52b82", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833525, "uuid": "582bcb86-b074-4d1c-bad3-9ec14bf1095a", "comment": "Malware payload", "value": "319cf6924c7ffa21e03df864ee97dcc6b9045baa53e5a86a14beeecf68a18e90c781339963ab7c19ae4257c0c19731cf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833525, "uuid": "388b42a9-0c2f-4288-b462-1065afd0599d", "value": "T1EEC302FD33F3455EE50BA1317A473370680B9446EBC22B09A9CA786BF24BA511777278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833525, "uuid": "bac5f5ae-a018-4c5a-88f6-b5ae08943e73", "value": "3072:yJd9BEeR8gdLDY2ppdn95ynegdeBki+wz5Ue/8o/:yNRhLHrn9b5Bki+wz5Ue0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833525, "uuid": "06058089-8db5-48a6-9f56-565eb6c2a42e", "value": 118637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833525, "uuid": "4cb92b1a-60aa-47cc-b501-8c7b30e7a16b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833525, "uuid": "f0949e1b-9aa6-4da9-8e89-fa7f354e17f9", "value": "Aperiamzr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57afd45-7890-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827367, "uuid": "e2855709-924f-4e1b-9edf-2090447969b1", "comment": "Malware payload", "value": "2e803d28809be2a0216f25126efde37b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "httptunnel", "colour": "#6202E0", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827367, "uuid": "5dd512e5-bca8-4f10-8e4c-98e9adae69e6", "comment": "Malware payload", "value": "2097320e71990865f04b9484858d279875cf5c66a5f6d12c819a34e2385da838", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "httptunnel", "colour": "#6202E0", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827367, "uuid": "f988aba2-d451-4ee4-891d-f891f0abe305", "comment": "Malware payload", "value": "4c34d1cd875e39a8fa854eff3b520cdc68275f9d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "httptunnel", "colour": "#6202E0", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827367, "uuid": "6986ba52-91f9-446a-ab31-ee926055bf0e", "comment": "Malware payload", "value": "59e5cba3139a578c4d10af1cf3977870ddc04bf39de265c81138d1a243ae67ca9d5d88e6286b0b69cad0a11b9ed3ae1a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "httptunnel", "colour": "#6202E0", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827367, "uuid": "2da6f03c-6d42-47b9-acce-4442272c693c", "value": "T149A22F314E54DD67A3B72B3AFF62C448EE3B222F12A54399BE4C46911F70420D762E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827367, "uuid": "efbf6888-354b-408c-b52d-974a5c1d6bdf", "value": "192:xiArl85O7bHtJ7x6IB497eS3b+9eGbTvMBCbsZO4lq+bbZLTk5xZdz98J5U4KjB0:xLBD0eS3b+0Gb7MkbQtlqWWdoiLmLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827367, "uuid": "6b868a48-77f3-42c9-a728-08019500867b", "value": 23284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827367, "uuid": "eebf07e7-6fc8-42f7-971b-631b8f1c0757", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827367, "uuid": "803396d7-3bb4-498b-b241-779ac34a02c5", "value": "2e803d28809be2a0216f25126efde37b.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615995a0-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1698855546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "f7187b1d-1822-4caf-84d9-9ad5e21d6803", "comment": "Malware payload (NanoCore)", "value": "4c0c5481ec40235ad91fe6e8492c2d46", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "44709783-c0ae-472d-95c5-2dc03fe9b264", "comment": "Malware payload (NanoCore)", "value": "20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "dceba4cb-b566-46a9-b213-61d92e3c5c23", "comment": "Malware payload (NanoCore)", "value": "d58e4b2f8dda6f5b3e831383773de1a5195cdeb1", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "9959e5fc-0cc0-453b-be30-73aa3a2c7434", "comment": "Malware payload (NanoCore)", "value": "44b7b48b2dd4a11cce92b7e545f4da784feb2a2d74aad3825a6cd91a7080b3b6f59669a7eb4a2bad454c785709851187", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "f29f27fc-37f3-4c4e-99db-d09a5fed3a8f", "value": "T10914BE5637B8492FE2DE86B9611242479379C2E3ACC3F3DE28D850B75B267E506071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "5a124f52-0cb2-4b0b-ac1f-3604522c46a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "b31d0a54-8fcc-4d16-9b7b-2ed8c62488d0", "value": "6144:QLV6Bta6dtJmakIM5V6xUtdHfBTQxVqtjrez:QLV6BtpmkPkd/FcVqxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855546, "uuid": "4dba53b9-f57b-486f-8f5e-5afab7272edd", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855546, "uuid": "361ad699-0748-4df1-80a0-49f64d0fc8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "1de93596-9941-44a2-811a-828385debb45", "value": "16988555454d794181e0e1fed734f20c841575956ffc53e9e10d28072eb740c807aaa0f8e0833.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631be0f9-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698819471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819471, "uuid": "f6a38346-4f65-42d7-a953-a3d43a5e1414", "comment": "Malware payload (PureCrypter)", "value": "bf579bfd47c5f861e7e02f36589c9865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819471, "uuid": "e1e49f47-18a2-4512-992f-4f81c0139696", "comment": "Malware payload (PureCrypter)", "value": "2166a3c30a87a50ffc91cb97b01dced1065261d3f2c6fd7fc26d0cac189966b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819471, "uuid": "6f315cb9-87cb-4ad6-a87b-429b5b253228", "comment": "Malware payload (PureCrypter)", "value": "d6f09fecda26803fda0e7b1dae9fa44334adec61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819471, "uuid": "925ea6f2-742c-45c2-8c86-8f596d8901be", "comment": "Malware payload (PureCrypter)", "value": "0c9c5aecd9e75c008dec115097387d4eb61ecd18de78534ba9303fdc271594a33c89fb73b14fafa1a33f9b9b81cc3c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819471, "uuid": "4ac02e6d-c554-48e4-ba72-f710a3333a81", "value": "T15042F811B7EC8236C6BA0F7655A342014376AF85B836D71E284F73171F73B808A62B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819471, "uuid": "1b3c1ba8-37e6-4cea-865f-d487b4aa1aef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819471, "uuid": "8ad8920b-23e8-4e7d-b408-f9a182ad6768", "value": "192:1hD6bjkkpd2D57HU40LRrJylehKAOXLOb:m/kkpd2DRmLRbh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819471, "uuid": "07e2643c-3abb-405a-8257-bbe23c72f206", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819471, "uuid": "1c7b695f-41a5-45ce-89e5-b1945faf18fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819471, "uuid": "bc955a93-c695-4e6a-92c7-297c63cf70f8", "value": "Ankfr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6f4ca4-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698855268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855268, "uuid": "47daf947-894e-4d43-98d8-c7262060eab2", "comment": "Malware payload (RemcosRAT)", "value": "ed54efe673cbebc5c8bf022dfbe85d69", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855268, "uuid": "4b28370b-2785-4610-8e36-9867609b05b5", "comment": "Malware payload (RemcosRAT)", "value": "21a977aec8b2bf7ee1631fcf7cf4e9164c6e51d28db47747d1c66ba7eec39fad", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855268, "uuid": "ea384531-fd72-464b-9dd0-2863869835fa", "comment": "Malware payload (RemcosRAT)", "value": "8755d1c0daa90bc1cae1250adf11289577f871a4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855268, "uuid": "8821952b-c0a7-4685-95ce-ffabb3a520a4", "comment": "Malware payload (RemcosRAT)", "value": "c77873a904cb67ab2a6cbefd12e20534222494f129f295732121d58e46d57a162c927c7be2756081628f70c9179d07d2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855268, "uuid": "de7029cd-c251-4f96-b36f-b31d402a1052", "value": "T1A4033F1069FF610C71B3BF521FE976E98A6FB7716639A06E1508130B4763D40CEA2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855268, "uuid": "ff7fc117-d501-4e96-9cef-50125ae58a47", "value": "384:r30dyEJfOJfx7Jf82JfqBJfRF8+bzdykavcE21kONFjTJrXBU2FjedyEJfgkSOD/:r37E477qHyU81Pch9hEmkVMk1ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855268, "uuid": "9d340b15-2ce9-45fb-a860-6266dd9e6a91", "value": 40480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855268, "uuid": "8bd5a7ea-67ab-4f99-a485-15550cbdb113", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855268, "uuid": "274bbf59-12d4-4192-90d1-b0ec2655f347", "value": "Payment 01112023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9ec37e-7889-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698824423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824423, "uuid": "3908d8d1-45fb-4e44-8922-a49669dba3cb", "comment": "Malware payload (AgentTesla)", "value": "e5eacc6813db4c03d159f18be31934b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824423, "uuid": "0ec6de64-3303-4f0f-9f4a-9673f083f911", "comment": "Malware payload (AgentTesla)", "value": "21bd09ec713ebf8fb9cb08c9ea48021833a4da327a9f3eae35483a70f6a85abe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824423, "uuid": "9defad3e-e9e6-4888-a4ce-41c2ba9ccd73", "comment": "Malware payload (AgentTesla)", "value": "206b65d923423cbf3ecfd4ded3ed1da571a79312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824423, "uuid": "c2dd9de7-1db5-4fdd-be9c-12b245212c32", "comment": "Malware payload (AgentTesla)", "value": "8876319cebd8e243c82e4d02562ec74ec7a51ef4a7fd6da8d7e9e6551d0100419431aa2835fafd178b63a42c0b4dfdde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824423, "uuid": "16d1363c-7866-49c3-af7f-199d1b7fc2be", "value": "T17FC4231A18753302FD39B7D55B62BF23E4E44E9168C5C3691386E5B60F36CF23A38A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824423, "uuid": "6228dd21-e613-4baf-a8b4-538470f4917b", "value": "12288:dud99HOs+Ih6vrwW8bUw1MKeu80AlzC0Swc2CdYxnZMcIXCXXkCUb/Ssn:d899HOvjSIwil6p2DxZMcIXCjUWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824423, "uuid": "833da735-a9fe-4d19-9238-a664dd88de16", "value": 584297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824423, "uuid": "a5441531-f2d8-4d7a-a3b9-6f63825154b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824423, "uuid": "4a967689-3c41-4226-a43f-5e16f37e057c", "value": "Requirement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d1cdb3-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855574, "uuid": "881b3364-0f42-47e8-8add-8892a30d34a5", "comment": "Malware payload", "value": "982bafc924010364bd7476194d100274", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855574, "uuid": "9aca4873-6c67-4ba1-bdf6-8a667fdaeda7", "comment": "Malware payload", "value": "23232a1df527b6e23a47634684a3b9f9902f64785ca9d7aa56d8f5c533e6deda", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855574, "uuid": "49c4b066-26b6-47cd-8da1-13709dcb2836", "comment": "Malware payload", "value": "c7b86e8f0120bfcf57eca37a4368c9fec4e74af2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855574, "uuid": "f6232a47-feec-4b91-849e-269092983b19", "comment": "Malware payload", "value": "289cd4b803a032fb360659fcfce3f9a3aa8fa1968e2c3a332af36d6edbb8df387324efdb628daef7d398b4b0b386d3ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855574, "uuid": "443a7b62-362c-410b-93a2-0fa9c0e77297", "value": "T17BD5D052C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB87E1EAB8387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855574, "uuid": "444bf0c4-2faa-40c7-a0c8-d9c3c8988360", "value": "5fb75b2a87c1fa7cc3d7904a0b97084a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855574, "uuid": "d1296cca-3353-4b1c-99ba-c673be580e3c", "value": "49152:/566l2+45BiNYFrz31Cv3D29kd6kDSZJ6ad4Dz9nkWq3S:/566l2+45UNYFrkvz29kdJDSGamDz9n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855574, "uuid": "d4c3b179-20cb-4f64-bc6a-aaa65c27be06", "value": 2823790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855574, "uuid": "73743598-3c05-4db4-a603-a2eb14867f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855574, "uuid": "fde5a8a0-cf64-4414-9c6f-69315519eb1a", "value": "zPS.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76703d0a-78db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859447, "uuid": "6b5380d2-a891-48ef-82d4-f9445461df83", "comment": "Malware payload", "value": "470275eaf344be97f9950c4c42a783ef", "object_relation": "md5", "Tag": [ { "name": "HLoader", "colour": "#773DDA", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859447, "uuid": "fdeb8733-7b90-450e-b31a-adb510020b64", "comment": "Malware payload", "value": "2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1", "object_relation": "sha256", "Tag": [ { "name": "HLoader", "colour": "#773DDA", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859447, "uuid": "978301b9-1f1f-4ace-ac57-e5d89c400b71", "comment": "Malware payload", "value": "43f987c15ae67b1183c4c442dc3b784faf2df090", "object_relation": "sha1", "Tag": [ { "name": "HLoader", "colour": "#773DDA", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859447, "uuid": "613c1bd6-3ff4-4676-8437-440158f0b8e2", "comment": "Malware payload", "value": "fd0f531681109306a806c2aefbaa2f37b55f46bbc461c02e3cb04b413f9bd3356878df064c77deb3d9205332c568faa7", "object_relation": "sha3-384", "Tag": [ { "name": "HLoader", "colour": "#773DDA", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859447, "uuid": "e1850ec8-bc13-477f-942c-a620a6cb53a8", "value": "T190F3FA837F581195C06C913A825FA7214033FF86AF07A2577764E6286EF73755A03ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859447, "uuid": "79942733-c434-4eed-baee-a9168cd1b51a", "value": "3072:nSRFCx9UrrA30VtDs9UrrA30Vtl49UrrA3O9UrrA3:nS+x9UrrA30VtDs9UrrA30Vtl49UrrAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859447, "uuid": "5def5cbb-386e-4f34-aad7-95ce3622e7d3", "value": 157728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859447, "uuid": "3316db5f-56a9-4820-b7b8-633d99ffc388", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859447, "uuid": "2fed6792-c985-49c1-aa6d-7f385abb7b26", "value": "Discord", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb3578a-787e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819405, "uuid": "31e691c0-5ba0-451f-b65b-1f4dcaae80b8", "comment": "Malware payload", "value": "65a2756a52772fa5b94044bbcf36b482", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819405, "uuid": "4c1238c6-d5e3-4389-8a9c-44a77bd9e49e", "comment": "Malware payload", "value": "240ab96d6d68f607108985a4057583ff271fc3a33b339f60e65807742f998121", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819405, "uuid": "5c70638f-780d-488f-b1e3-015493d0d298", "comment": "Malware payload", "value": "8f79c49a260af9c71a4f6d5bf633cb4a2265490d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819405, "uuid": "c1c9b871-0a8d-4098-b629-5b938e4f5dd6", "comment": "Malware payload", "value": "aa1029123dd90d8f84ea9e8bed7262639e3889805377b68833abbd43819971b8f9222f3448c2762a09d23bcd4af7b0a3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819405, "uuid": "da2c00e2-1bda-4ebd-9576-f79202671fb2", "value": "T1DB767D13B344653BC05E1BFE4827A604983FBE612A218D5B67F79B4CCE355812E3AE47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819405, "uuid": "b8483876-af41-438f-b75d-ea6e8feed936", "value": "98304:fym5QSTBe6qjeF5KZthK/In/QMttiJX0E7EkmLtxo6:fnQSTBe5WwK4yF3bm5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819405, "uuid": "45bfc762-5af9-45fa-8ba6-11ea95e4548b", "value": 7818240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819405, "uuid": "c5e728c9-5e9c-44ca-a8d1-9ee124baf1f8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819405, "uuid": "8383874d-690b-4ca9-9c77-59a9a9c0cbe2", "value": "NATURGY-FACTUR-A4-TLLTK_ES30092109309219293932923102023.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ba34c4-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855559, "uuid": "bbe70110-b82b-4007-bbac-fdb90aeb3c86", "comment": "Malware payload", "value": "c947a9520d33becc6fd436d148c63ddd", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855559, "uuid": "b0e0b74a-b2d1-4d61-8e4a-4aedd2e203a5", "comment": "Malware payload", "value": "2459ef847a5d1dbf545aaf30b3758e4cbbfee13a87d1642fcb922f5af12782ee", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855559, "uuid": "62cdeb9e-9313-41ca-9f52-9c596f7e0983", "comment": "Malware payload", "value": "860885eb01a1177b9d7418eee987a970170dc316", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855559, "uuid": "c09b871e-0813-44ca-a3c6-f37a7f902448", "comment": "Malware payload", "value": "7a1cf441ec00513fbf53fdae5c7b61df30cecad9930ee6ef251c86faf85b650e9096cc960ed319a1d0b56fd093e2d97c", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855559, "uuid": "e60a11bf-5e3d-4b51-b851-55eb9ed9abb0", "value": "T15C13F2047D3CD87D3A551BFEB96608135DB1A24185BF2F86CAA3B436B025AFCF518923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855559, "uuid": "8d11e201-b08c-4818-8550-b00ef654739d", "value": "768:+3PRXSp3mgu9ssVuPdCQLQcSDU04kC5Ti3j3frIzgTzSFWJvHBnEhlsEa4RT3:+3op3AGthdS40mE3T4FSHC8EJRT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855559, "uuid": "adbd3dcc-98c4-44e8-bfca-6443f2b3b66c", "value": 43235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855559, "uuid": "13f8a745-1b4b-4ad9-ac4f-8ab044993cfa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855559, "uuid": "21b98f88-f31f-40cd-bd7d-cc04934f2363", "value": "cevpop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d84efb5-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698855486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855486, "uuid": "c6c00b89-4b29-4e7d-891b-4b3647f2113d", "comment": "Malware payload (AveMariaRAT)", "value": "57c76226a25c44ea73d0ffd2b8258a56", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855486, "uuid": "16801512-b644-494a-b54a-f4bb27dbd4d6", "comment": "Malware payload (AveMariaRAT)", "value": "24c31e8d645268f9b40c348887aebe9eacf476b25c52e904ca90967a97ca0165", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855486, "uuid": "518dbaef-4ec0-4a03-8acd-aaeaa030a994", "comment": "Malware payload (AveMariaRAT)", "value": "6bbae2fa99497d1803728575fda78c5f789c3e7e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855486, "uuid": "6d133e1d-3a9a-4591-be5f-785b07cbefb6", "comment": "Malware payload (AveMariaRAT)", "value": "cc4cbe9d88a684200c7b5e978d8fab2753a0b6b817e3e233798eadfe58b99b7962b844faed5fbb1dd48829bfa8ba96d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855486, "uuid": "50043444-7a1c-40f4-bf53-1c94ec85565e", "value": "T1D0A39D2377E14439F27506B06EB8BE7693FEBE350721895FE32411871E36585E926383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855486, "uuid": "e9ba0543-58eb-48d2-9bb3-c31f30558511", "value": "4747c70adc127d28c18f0f7237b1add9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855486, "uuid": "656bdb8f-9e3f-4411-a819-aed1f70c57c9", "value": "1536:23P7aiRdDxXp2yc9q6qT+Ry0844UudNH6GLHWVE0UXD:29dZv9W844bdNvLHWVE06D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855486, "uuid": "4a9fdaf7-fcfa-4f6c-b7a6-d6c82aed7f38", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855486, "uuid": "fc798ded-8124-4e42-98b7-2fce1add49f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855486, "uuid": "1996c267-0099-4082-9448-ed49dc68a400", "value": "169885548537e0c943a22b1fc10ce9b82a02be3f03dc8693dc00621db229fa8b12f1a961f0427.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bb4d65-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698826106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826106, "uuid": "11719356-4f35-41f4-9b08-7cecc0e84835", "comment": "Malware payload (AgentTesla)", "value": "55450e76cfab75af547f391f3a408db4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826106, "uuid": "1eee81ae-6cf6-41b4-a637-3dd8e14bc8fe", "comment": "Malware payload (AgentTesla)", "value": "25906f0bea109407fe8075e581f5d36efc13fb50124c6ad8850be5d32044466c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826106, "uuid": "2cb07eec-64be-405e-b433-f4f36e7da962", "comment": "Malware payload (AgentTesla)", "value": "aaff420952e95a18023d858b3e885551fdba567f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826106, "uuid": "0e4d71a9-e58d-4d8e-9de2-f02020981ca3", "comment": "Malware payload (AgentTesla)", "value": "c39f3e1f0a436316aa134847e91524db8cba51d54b3b793d0c13946fd21d1342fa285b2b4714b9b320cc2f6b9349ab66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826106, "uuid": "f23265df-b130-48c5-ae2f-fc2e8555df3f", "value": "T1A1F423CE234106FF9DB2FE99F57BD5909214E016E89D5E2711C5BFB0FA7630A8429C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826106, "uuid": "acf59662-31fd-4e63-93d7-f4cb0c935256", "value": "12288:sCmKQZPV8KFE5P/O+XlxlEuVl0rDUA5OmOrV9rOE4SqFik/Dfwm4lH/v0IC:Kh5RcP/OGlxlEuVlMUcsrIjfwr30IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698826106, "uuid": "7fe9d467-ac14-4e8c-a29c-a76cdda035ee", "value": 737011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698826106, "uuid": "5cfa1b17-c80c-482c-ae2e-7e99656c2dd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826106, "uuid": "c5e5c81c-4b8b-4792-9d46-38c8186e88d0", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91aa89a-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880712, "uuid": "5019d25a-f15c-40e9-b461-483655765179", "comment": "Malware payload", "value": "4b4e31da2353090b54741806e5583c83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880712, "uuid": "04608435-4b74-4074-9bd4-116d9654e45c", "comment": "Malware payload", "value": "2676316c80fce67e537cf983bdf4e4081f29b92a6481de3ab5d6064bf2641698", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880712, "uuid": "f73494f6-8dae-4a54-a8ed-5f172edf2391", "comment": "Malware payload", "value": "4758f074ec15e39da2773eb47b51914bd767ac61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880712, "uuid": "63506606-93bb-49f0-aae2-e819c5595fef", "comment": "Malware payload", "value": "38aa1750f55c2737d7146d7700e3fe9d372bb7d2273b47b84bac4f2a96f99d6afe43a4467f66cfb205a136c0914e1977", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880712, "uuid": "78a080c4-b5f9-4a0b-9cb6-2abed7507fcc", "value": "T176843906F997EC5FC03829336995A794B6E3BC768C14410B26CCBE9E7AF27016D23974", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880712, "uuid": "926f9062-8b04-4a78-b496-b75a1eb02900", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880712, "uuid": "317d3677-aa7e-4970-949e-e5d6241bc482", "value": "6144:+RR5rhZFQGrsUwF7vlPoSH1pSA8XaMYI9b/7STdHlh4sH4444v4444cPs444444d:+R5nWFpPoSHiXiiKle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880712, "uuid": "73555ed3-8a48-4f59-9e5d-6ef4a4cbea19", "value": 385896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880712, "uuid": "3922e249-9e81-46be-b092-ce98522973f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880712, "uuid": "2eed1646-50b6-4c4c-814c-298352c09716", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.2412.11759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0d62ce-785b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698804352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698804352, "uuid": "9ba8d161-e747-4ada-85c9-2564bda45b46", "comment": "Malware payload", "value": "f87804f12173be8a9d3d0c89d7e948ee", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698804352, "uuid": "aadc4deb-ac53-4485-805c-4870a6a73422", "comment": "Malware payload", "value": "270d497ee41c6864c0a48dadc8e5552b236cb3caf75d963c23cc8a446de49464", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698804352, "uuid": "0111c7b6-39d1-4038-ae37-858b6aac2790", "comment": "Malware payload", "value": "3c29fc202e37c964f8e031541552881baca7f452", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698804352, "uuid": "6ad800e0-57df-467c-ac57-6c810cec89d6", "comment": "Malware payload", "value": "d390144b82288680f0a8a854b94372f6907481a202b0cae42b50d36cff7e35d3eb1faa68015ac70e6057518ad5777adb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698804352, "uuid": "cf12c3a6-a1dc-44ea-9d03-69c8e83dbb42", "value": "T12A2733A71C066DDAC032A039557E2385A876CA1E3AF36B221844DEB7C5F3465CDDDF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698804352, "uuid": "65e128b9-573c-4ff9-9fc0-b1feead9686d", "value": "393216:NZASsJA35z7A79L+XeF1mbgafiubchZfbrT9i/zVN2I+TX05kKpPbNiRSKcs8J1:NZAtJA35z7c5HDmbBffc3fRi/zVN2Ik0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698804352, "uuid": "6526fb66-ee94-416b-9d63-c3d608a6e57b", "value": 21498820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698804352, "uuid": "5f620eee-e506-407e-801f-877b21958c9a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698804352, "uuid": "9f1bbaef-96df-4b49-865f-46339b9b7922", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995bf410-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819992, "uuid": "f16b8286-a7bb-40ae-b858-b8748421111c", "comment": "Malware payload (DarkCloud)", "value": "65a91a4480fd50641a4c35dba3dae229", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819992, "uuid": "d93ac20a-04cf-4070-9aff-4acdb47fa0a4", "comment": "Malware payload (DarkCloud)", "value": "29a08311df4b9c042dd63aa22583e129877ca0546cc40b6d502c1c9ca1d7075d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819992, "uuid": "aa93629f-892c-4f1b-ae3b-9cdcb4f43e5a", "comment": "Malware payload (DarkCloud)", "value": "f20dd83e6fe16a20cfefbefa12b846b345d2edcb", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819992, "uuid": "5a67d5d4-1b67-474e-99b1-659f6d0b6553", "comment": "Malware payload (DarkCloud)", "value": "1d31885ba705cf9d9e67ebcd2a7900f4b85fe413f54ea3f5929ae93a347784b6d59d6d81230f830a95eb15572e114857", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819992, "uuid": "8ca0ca72-b9aa-4eb3-9e75-7a2f52b891ab", "value": "T1F0F4CF1932769F21D67A87F09460604043FA797B243EE39A1DCB70CF09AAF3056D6A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819992, "uuid": "7c8516ed-cfc1-4da5-b0d8-f689d478e69b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819992, "uuid": "018b7d2e-212a-45fc-a5bc-44b99613ed31", "value": "12288:YHcQgJKcwMpr3lGPAisjCCWv3fyKBZrPtuLuC7IrXq0j+WGLMeonX4xcXrnKCzlJ:YHcQdQEiDWv3fvzTUfIradPx0rzzlyk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819992, "uuid": "e2478db1-c198-4697-9722-004b15e8e400", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819992, "uuid": "530457c4-02ed-4045-87b2-c52e3e633a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819992, "uuid": "91d9423e-2b7b-4d58-8e54-e00abb3c090e", "value": "DCAQ008789000987789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa95f1c-78b8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698844234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844234, "uuid": "1b0c7787-0519-44e4-9ccd-19c8cb7bd02a", "comment": "Malware payload (AgentTesla)", "value": "48c08282a0e414a39e951d7d434c9560", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844234, "uuid": "5aac88ad-cbe8-4884-a5a7-27e7f615ec1a", "comment": "Malware payload (AgentTesla)", "value": "2b55f7e957049c9786d8e556542de0e61b069f24578a516884395b154c12d0b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844234, "uuid": "a54a5f81-e4cd-4b46-9545-7b408828460a", "comment": "Malware payload (AgentTesla)", "value": "17931f7aa4a3cad14fdc9225965600e96f13811d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844234, "uuid": "ce435d5f-4505-4fcf-9c02-e9880de18b8f", "comment": "Malware payload (AgentTesla)", "value": "fbf27ea8237831daf2e51114e589fc193bfa0053112592516474f2b7bb2f755b1685ea188532a85420cd695db0cada06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844234, "uuid": "2d676852-ce8c-42b2-86ea-193c3191e196", "value": "T10BF41200F6BA8B36EA79A3F81404B2140BF7706FB665F3599DD7B8D76426F144A40B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844234, "uuid": "02a6e66c-19dd-463e-9fd1-bad38c8645c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844234, "uuid": "83de5d1b-205d-43ca-b325-d3cb6f229c6d", "value": "12288:xFO+Y85twJonK3mKPhX/WWghJsOK7VgAgXuZzSkXLKNmVenm+oaU:xFO+Y85OWihOWgXsR7Vr5Z+/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698844234, "uuid": "d8be0d9e-6db9-4195-8a6a-35640cba7726", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698844234, "uuid": "cdb143b7-84ee-4609-9ea1-22122c70e085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844234, "uuid": "266aa8c2-bb6d-44cd-8607-40009955e6c2", "value": "Dhl Shipment 0106245448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09569cd3-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880739, "uuid": "20db705c-d7f9-4be9-bb8c-b5494e4c478d", "comment": "Malware payload", "value": "734abb4dfff198dff85aff9bbaa42afd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880739, "uuid": "97082b48-35a7-4f06-8f9b-9ae0c3973fa8", "comment": "Malware payload", "value": "2bdcd1fcd5c216e2b4178a896e8e2fdd99cc828ff5be79124ebd43f3cd6e2f5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880739, "uuid": "32d58c10-ef8d-4e10-b6b5-43692fe65e0a", "comment": "Malware payload", "value": "7e7b50bd82c6a4c40f94ddf8f75bad73f1f7409d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880739, "uuid": "3182c90a-5439-493c-9d74-2986e055d871", "comment": "Malware payload", "value": "1f67a870562ec39e889b45311eec6c6ee72fd2305d5f7cd4bd5e1bf6a62e5f443f88ac5388c7bb93872444b837c3b177", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880739, "uuid": "b951787c-c8d3-4d8b-9b32-9659870a572a", "value": "T1BEA5CED533E9C852C6FA523019222DC66E6D8E60BD8F55263E0DBA4F9F339E05772C60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880739, "uuid": "d7fe2e54-b376-4ec7-9adf-eaaefec08203", "value": "34f52b7d977a05427cf03b9aafba9c8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880739, "uuid": "7d51c063-d369-412f-8f90-8b0641185450", "value": "24576:vJBQ3BdlcO8cP6s9LBV2Oc0tQnrifaMp5RmgRnAdQ508jdbXbUJd:A3qOxyW2t0+rINLmgRnA2508jxUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880739, "uuid": "fd0b8ed9-9b84-4f71-9504-fe31028a7ecf", "value": 2105613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880739, "uuid": "4b512a78-5662-4c2a-b039-1690172ae319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880739, "uuid": "d0de4b7d-153a-445b-b3ac-b3bb37d95ae3", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.32568.23824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d645580-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698855593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855593, "uuid": "fdc1546e-85a3-49d8-858a-371a4f03e4ab", "comment": "Malware payload (AgentTesla)", "value": "5b60be348cba3047b32cfb14f23e2d77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855593, "uuid": "5108937f-f301-4fa5-b0e8-6a87277b4af7", "comment": "Malware payload (AgentTesla)", "value": "2c764668d3030a38b2700fd81a1c7efa147794728478d423c99f16f75bf660e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855593, "uuid": "0abf5377-20e1-4102-9249-bdf1f06bd57a", "comment": "Malware payload (AgentTesla)", "value": "087ff339da3b1726351fb6da7d5bb99821171664", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855593, "uuid": "5187222b-7847-461d-b243-fa1c5e203815", "comment": "Malware payload (AgentTesla)", "value": "3265bdd6d93bed0e6b054a042a7266ff4c21241c06b6d914cc834bb55dc2f8508258cb37759763c52bf408aca873bb9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855593, "uuid": "e8b091d8-63ad-467f-8002-50256e085fd6", "value": "T11314AE01FE41861AE455437688F74EAA6325FC419FA24B0F325CF71D3EB07E41E2BA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855593, "uuid": "911716cc-a3eb-462c-8d74-630e1682654d", "value": "6144:+Y35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVVbMIUDdkZP684:X3bVVbMIed014", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855593, "uuid": "a9208f2e-7ef2-4a2e-8391-49af6c773ce4", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855593, "uuid": "7509c866-df4c-4986-96f1-a93923980f83", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855593, "uuid": "7b21ab04-6d9f-4483-b923-90106ed61944", "value": "Our order\u00a0 230606-05 SN-DZNE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0891c71e-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880738, "uuid": "5144966a-89e8-4c29-8b66-7986a2370a69", "comment": "Malware payload", "value": "1319786f6f3866a08e405678bb5f3c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880738, "uuid": "9c031f7d-ddfc-48c6-9006-02548a110163", "comment": "Malware payload", "value": "2c8f5fa018fed528c61b153831cda62833909d43befea86fa8f3df941bd96d39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880738, "uuid": "3d0142b9-c347-4e96-9fb8-76e54159edf8", "comment": "Malware payload", "value": "13afbfd7d1a22c8959a0d11d05f5f8c69f8ff2a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880738, "uuid": "51a78c9a-e37f-4467-87c8-458a56078ff0", "comment": "Malware payload", "value": "ab11ce5088e1d119f87b4707da4337f6e808b6894cfa81334a7b61a15f3d88f1f9193d61a4ee2510503d9df82eea9cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880738, "uuid": "801cc8ac-d872-42a2-ac78-bd9287b27e1a", "value": "T130556C01A286643EC017073A1A7BC7716B3ABFA42A9745DFAFB49A0C5FB52407C39753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880738, "uuid": "4b1f74aa-6b2e-4bbd-bc9c-fa72e1dba073", "value": "24576:UPpGWrsmTZjBvSHYa/42EeV5wwKjxmFSa+kWCf:UuQZSCCuwembf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880738, "uuid": "20eb615f-c65c-49bb-b148-4d93cd0d7d79", "value": 1294336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880738, "uuid": "1cdeec80-1bad-49f8-98f7-60573ca180f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880738, "uuid": "917509be-e382-4925-baa8-5241b7ebb2fa", "value": "SecuriteInfo.com.Malware-Cryptor.Hlux.2.27899.24157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e24341-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880708, "uuid": "12c78cc7-d271-49b8-ad44-9e6ae9812b99", "comment": "Malware payload", "value": "b3899f8ca1512223bd77b79bf4166c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880708, "uuid": "1f31fc73-2cc1-46d2-950a-5397d3831eb3", "comment": "Malware payload", "value": "2ccb142e28e1743af6bc57f39cb3fa2823a685fe8ac20a9c72e49a0c81f06a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880708, "uuid": "0e6cfd5e-985b-4e96-8a19-88ce455ed4ec", "comment": "Malware payload", "value": "8655ed834d41ba9ea0f6144c7a775197c2ac2938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880708, "uuid": "734bf544-2171-4446-b565-b6c487c38fe3", "comment": "Malware payload", "value": "b568f66afd9f5e98ccbb84bc5832b85b0645fba8df129bc5d78132ef74321938bdfb17fb37bf0519927732003cbc2553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880708, "uuid": "e1bdcda3-9d84-40f7-a313-efdad2a04538", "value": "T1B2057D02B6D290F1C7182EBA0C96777576F4EE8A2A14AFC39364FD1CAD37160693721D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880708, "uuid": "4402895e-6457-4349-baae-cc82a10c2134", "value": "8365be30f303c576dc5377cc82b3584b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880708, "uuid": "96f883cf-27cf-431a-b0d1-5953f0b822d1", "value": "6144:DoEEvt2KEE3VC/+ZiyuSKUKbJveQvMKIOQTXNNcbxXjKd+9kjrbGCszKR:DoztoE3V2+UXopTTX8bxXj1C0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880708, "uuid": "57545eec-db16-45dc-b207-e46e3f2962bb", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880708, "uuid": "b33c37d3-a882-45b0-8460-2e305809cba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880708, "uuid": "8b371b5a-3efd-42d2-9b36-20a59a296984", "value": "SecuriteInfo.com.Win32.Evo-gen.22124.1397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7027b733-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819923, "uuid": "b615d6f6-b26d-4451-bb02-614b32d15d7f", "comment": "Malware payload", "value": "f71b8c042c94e7591eb25be56a4952d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819923, "uuid": "ebcd644c-7fa6-4ab5-bc1a-38677e1ecf28", "comment": "Malware payload", "value": "2d10e08f64f4b4c7fc3cb0087e34723f5db5ff64d319fbfd32afa99b831ee102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819923, "uuid": "4c5980a1-4438-4b6d-b133-b1372f28f0be", "comment": "Malware payload", "value": "07bbc683498d9d701623bec94dbbdd4837e668ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819923, "uuid": "cdecb233-2c69-4fc2-aebf-c8f86de3f2a3", "comment": "Malware payload", "value": "0336bc9395497ecaa9beb0e7cf90467c0bb4716fbbcdf439b37f9437d771a7c7d16cc37892cc177b231b232e5887cc0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819923, "uuid": "cee5c6f6-fa05-4f65-8cbb-026e34fe0d95", "value": "T19564019064955600C8E6BAFC95B0B842177CBCB41151D20BDEF5BA796AB3313ECC63EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819923, "uuid": "ace0b2ab-35e7-4686-8f02-d0bd4fe92787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819923, "uuid": "3948ed0b-40e9-4da8-ba95-0973dd350e31", "value": "6144:BAiQyEVnd1bWpdSPMXQbNtAzC95oy9aw3bn/j9gCNYT0JpEVD:BAiQyqdIikXALz2aP9gq02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819923, "uuid": "f3acc242-a992-41a7-81bb-7164e67455c8", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819923, "uuid": "2736461b-24c2-44bf-a121-b77b227898c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819923, "uuid": "c92ee89c-0832-4318-a204-c71b3de9c9f1", "value": "567898765456SK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f641a9e2-78f8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698872117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872117, "uuid": "6031d99a-9a3c-477d-9acb-fdfb3f33febc", "comment": "Malware payload", "value": "cb6169cfc4c87b2bb00f96672eb46714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872117, "uuid": "ae8f3d7a-6704-4a6e-b692-5a29cb59130f", "comment": "Malware payload", "value": "2d532ac3537f2c94740c57c54f046b65952e6af7f2bd7e0af94fb8f830c3fe99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872117, "uuid": "467c720c-8c8e-4dac-90e6-a3c0f6587d66", "comment": "Malware payload", "value": "7e7761c34b239a1ab8afdc607afbe9b6d7517e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872117, "uuid": "d2da5402-2469-4007-8d1c-7c8c715981b1", "comment": "Malware payload", "value": "ac7e56263b43e0589104c63e071fce2b786459c199ad13dbaa8a01e6c9807bfef1308738058a25455c18938bfbf6e9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872117, "uuid": "419f656a-dd93-4f3f-a8a6-0bd9a87f3b4f", "value": "T124246C1352E17C61E6274733EE2EC1E477CEB9608F65679B22159E2F09B12F2C272712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872117, "uuid": "a0363fbe-80ec-492c-a2bc-e38f6606c71b", "value": "986bd7e9a23efe5404746408f2b31f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872117, "uuid": "f8c7b282-44be-4bd7-acbc-ec97ec954c58", "value": "6144:/oEsAsO6CTLnrxUOcMOgAVLCOl4BQhLLEw:IAf6CTLdHEmOl4wfEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698872117, "uuid": "40c12bcb-e3ed-4bb6-a7e5-7a56234d885b", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698872117, "uuid": "8249e009-7f25-44cb-b9fc-7c3969d9cd5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872117, "uuid": "bb3958b1-3064-4b37-b5b3-3f64a1371cde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeec50c2-78a8-11ee-8907-42010a9c0042", "comment": "Malware payload (Quakbot)", "timestamp": 1698837745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837745, "uuid": "8271d295-12e9-4002-a792-ee6390ca257f", "comment": "Malware payload (Quakbot)", "value": "546c68986a894a68a5eaa48a1f2fe8e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837745, "uuid": "d9959678-3f0b-4789-8522-0fb48e823ca9", "comment": "Malware payload (Quakbot)", "value": "2d8b54cfab3e408671b7a9e09d6b4cdd2f32e277013695154ae6a5a7c0977c10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837745, "uuid": "c3401da6-54ec-4668-99ac-f67eab7b81df", "comment": "Malware payload (Quakbot)", "value": "e07bc4b9d99d16ea3f6a3751d8d39c6255325d2e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837745, "uuid": "365ec1e6-7a45-485f-a5e6-e515825326f1", "comment": "Malware payload (Quakbot)", "value": "87f72cb3afff7a85fd2897dfd53f1ae5e485dc9c614b85b6ce18d1e167dccc2f44c5e9120bcc1d1aa8148345324c5d66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698837745, "uuid": "68649a32-5efe-4a6f-889d-2b38e302666f", "value": "T152E44243B2D2789212471BB17B1F72D9FC2E0BE874C845ABD115FC81FAA9614EAF1931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698837745, "uuid": "a5cbf0fb-7b54-4374-b6fc-40f7e52c68fa", "value": "12288:Qj5xn0vVxo1r90KDf1jbxKtCQsqSx8oaI/BrpCP/7c5YhFi8A6x1re91gwu2xM/o:Q1xn0vEj0Wf1jN1ZaI5rpCP/7c5YhFiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698837745, "uuid": "1821c260-281e-41f7-8ead-c52fd345f200", "value": 720474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698837745, "uuid": "737cda0b-de37-4694-9b5b-894313571645", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698837745, "uuid": "120c9f6c-9b34-4ff9-8574-c985e0857e95", "value": "Wupos_Receipt_0012864357174-098876743345134.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bd2362-7858-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698802994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802994, "uuid": "45752789-e931-44cd-a6d1-93b6ad4ebe49", "comment": "Malware payload (AgentTesla)", "value": "d49b62e60e0e42b43f32adf23acfd369", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802994, "uuid": "58ef388e-50b2-400a-a075-d771195d4558", "comment": "Malware payload (AgentTesla)", "value": "2e292710afe067f1065639192d5382b772babbc91d2a6a27fff41f8d110313ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802994, "uuid": "a297d158-e70a-40b8-bd08-30e3f15f4c62", "comment": "Malware payload (AgentTesla)", "value": "a6fad4d81e7995c173121574cfc2dd3d38664726", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802994, "uuid": "f036fdf5-bfc8-4901-bab9-fd298f4678db", "comment": "Malware payload (AgentTesla)", "value": "2addb6f775d29e6649d4f5fabcd7f92a36d21e47819aaa17161e2aa2acab296289909e422f66f5824ea7a5138e1aba18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802994, "uuid": "64f8315a-8cd1-480b-aca0-342d6d028bb3", "value": "T173D42294FBEE0B19C7F853F15A72861123F580265571D70C2EDD22EA0BFFBA8552A213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802994, "uuid": "0eeea2e1-5e00-4029-9aa3-5a365a8d2b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802994, "uuid": "5678fc6a-3c10-4b22-b499-0aee43895eba", "value": "12288:M8i69yqLNLx8+vRGitaX69HYUCKsihFmG20xTY6iKxYtsI8LVn:U6XZi+gv2tCjihgWriTtsIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698802994, "uuid": "7a7ede89-d34d-48d4-bc3a-65f0b393ca63", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698802994, "uuid": "68bffa1c-b0d4-48f3-a2eb-3ce5d36a9118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802994, "uuid": "48b5c8ef-9ef7-4197-899d-20e107b42833", "value": "IGCC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b543fb99-7882-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698821327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821327, "uuid": "356a89e5-4286-4e2f-b2f3-d2c30cf68fe7", "comment": "Malware payload", "value": "81d5fb6715795b0b80991c3fb6db4da9", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821327, "uuid": "7f2173ab-cf72-45c2-ac28-1cf74bcfdd68", "comment": "Malware payload", "value": "2fb09f40648f10ebf8ae4843db34c05b3fc3d9eb879e6076dc4d76b13a90389c", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821327, "uuid": "1e3b1e9a-c5d2-4d86-80d3-dd8e96f5043f", "comment": "Malware payload", "value": "33646038a1cd887b80d409856514bcf1d376d5ff", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821327, "uuid": "3d8d38d8-ba74-49c8-ad83-db7aa69f4819", "comment": "Malware payload", "value": "9200f25963e71ec419966514b543872b6247835d6d3b42fd443b0e4b5fb850b39392db2792a38c3d09a44aa01b94b0d8", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821327, "uuid": "4a635f7a-e8ed-46ec-b093-3f8aa7c8177a", "value": "T1CCA50195BDC6BEA2EEAF51B3C361AA3D111923AD03B06ADF7703059D3955FC2413E902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821327, "uuid": "dd666a65-fc26-440c-b0c6-147ead8799cb", "value": "0d65617cfd2eeeccf3175fc27ca72f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821327, "uuid": "a62a068a-151f-4d4e-8398-5b0d0c3b6099", "value": "49152:TL3+QHsyLcH/B5/bYmoX9mFViA4ivpp/mB:TLnLs/XbYLQVgspu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821327, "uuid": "f99bb28b-9760-496c-a39d-e22509071461", "value": 2205696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821327, "uuid": "de7bbbf4-1a5e-428e-af7f-45d811542a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821327, "uuid": "0c417e14-ca36-48f0-918d-3cb5d6cd3092", "value": "Quotation & Scope of Work.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fba4da3-7882-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698821237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821237, "uuid": "f03eca61-8a9d-471e-9569-e8327b6e4514", "comment": "Malware payload", "value": "95b9617c0a2c7366e4bcf1e7ba49afcd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821237, "uuid": "4a3cd53d-007f-4881-830c-12bce969779c", "comment": "Malware payload", "value": "303cb8d9cf7cc25ef1ae570fe1ca3359fcb4c0c21b3e0835be9e9b87619b1f83", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821237, "uuid": "6496b80e-44b7-46c0-9636-a4a2a033cd80", "comment": "Malware payload", "value": "03bec195a771c733687e456deb1e857b5cb00aea", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821237, "uuid": "560462a0-a9a8-40db-8ce0-b4c5f45c7422", "comment": "Malware payload", "value": "21968f72bbb53003adc4161bc3ac4fc5441684c9b997123dde0d462d739fe02d3a24aa0d8f4c95c00a735177c8a8bcb0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821237, "uuid": "0ffa8b7d-2fd6-4852-9ab5-f5de2344a8fa", "value": "T1C103FF203AFB500CB5B3BF612BE975A95E6FFBB1267971AD1444030A8B53E44CD62B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821237, "uuid": "0a8fdf6f-1755-401c-89bb-73dc7e638af8", "value": "768:7pdZUhkpUOobpoADewH7JpdqFbpoAK1U43OP:twbeQr+C1U4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821237, "uuid": "0b039093-fb7f-45f3-b708-a175e5976dc1", "value": 39648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821237, "uuid": "78136030-8a82-45c7-ac68-9fe2ddb40a58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821237, "uuid": "8299a005-dfdc-4d4d-9b63-44b1e1bc9215", "value": "AW#B0979969678.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad941ab-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880715, "uuid": "3b76ffa8-75eb-4b76-b4ba-c76874241c12", "comment": "Malware payload", "value": "348ebe64a3350944445d8e07a1cd7311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880715, "uuid": "927711d4-f640-4d33-b83a-f1f7b2cbba67", "comment": "Malware payload", "value": "32141d1dd0d89ae6c7737fe9de9d9f8250d2d1e7ddf3372a806624128c671c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880715, "uuid": "0d9fe2fd-d55a-424a-b9cc-42d019bbe932", "comment": "Malware payload", "value": "f43df42dd3759d69ad36ccf4cd03e051f5cb825c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880715, "uuid": "96dbe837-2fe2-4666-94c0-206e5a30265b", "comment": "Malware payload", "value": "aa4191169a83262dfbec180fdaf4ebec9420d1aaebf9baa10dc3cc27e97c61e0d3de90ff92e7c344ae204f2560350f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880715, "uuid": "f9259f16-b11a-46b2-9768-b5540df60b24", "value": "T1AAF63351E34D55B4EB31D83CAA9B8108EE5AB26C49CA29732FFCD90F187DEC2047A5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880715, "uuid": "230cbb4d-1b33-4e30-9617-bab0457089b5", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880715, "uuid": "c97c846b-2c93-4f9a-a90f-0ebd99f13d5f", "value": "393216:7gCMnIVb+1C6+Pq0rThUMoixhHoyUm42Gv1Rd:7SnId+1C6aTQ0hHoyUm42YXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880715, "uuid": "33c4f0e3-a03e-4538-a19f-cc802d783185", "value": 16171058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880715, "uuid": "85a577a5-b975-4dc1-bcd8-be1ad1af8575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880715, "uuid": "e4e58a9e-8d99-4a73-b2e8-27c4ee018f2c", "value": "SecuriteInfo.com.BScope.TrojanDownloader.Agent.15532.3870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146a7c06-78c3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698848975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848975, "uuid": "96287fd4-6dce-4259-93bb-020419883e4b", "comment": "Malware payload (AgentTesla)", "value": "8aa7f15a75d78a3029a3da0ba80282c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848975, "uuid": "c0a6162f-cf91-47af-bde8-e8cbbfd62d76", "comment": "Malware payload (AgentTesla)", "value": "337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848975, "uuid": "e61bcba6-aef8-439c-b0fc-9f23e03f0251", "comment": "Malware payload (AgentTesla)", "value": "47249bc395517fc6ca5cf0837c6a66d551749a93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848975, "uuid": "4c34bf92-8b7f-4710-80f0-da0b22fa44b5", "comment": "Malware payload (AgentTesla)", "value": "fc7b4059d9c45120363bf7b58bf19d31f4aeaffe8764462a85b4b455b25e6f00a1037363a96debd640b9b79e44ba93e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848975, "uuid": "2f06f658-2cb4-4064-aa20-d2f636f2f98a", "value": "T151167D02ABD901D6E467D634C61EAB33E2B1F85A4732C79B0554D35E2E339D18F6B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848975, "uuid": "0e2fc601-c790-46ec-9e21-fce0aefd9f87", "value": "ddd521167e2359cb7ccbd033820b1a88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848975, "uuid": "82fe8dec-796a-42d1-af94-bbd214f10a92", "value": "49152:9eA3k5ul6MhfuPQoCGUiKxdszvdAQgFPhEyzYKsG6sVet39OOK:f6kAz9GM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698848975, "uuid": "aa8303c6-aa79-45bb-939c-584a5f364fb6", "value": 4084224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698848975, "uuid": "3708cfb9-fc35-4541-a74b-87080b33f8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848975, "uuid": "f2d0a697-a14f-43e4-8083-5401458747f8", "value": "337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d90d1c-78ce-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698853992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853992, "uuid": "0994a7b4-9f8b-4c62-8fe5-d3242546608b", "comment": "Malware payload (RemcosRAT)", "value": "403aac398b6e70558bea3ae9daa84460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853992, "uuid": "36f13cfd-b5db-45c0-95b1-b5e612e11fb7", "comment": "Malware payload (RemcosRAT)", "value": "3400571ead34d9cf175d0f208823103bb3cb70097bebda17e263f255cf4c7c74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853992, "uuid": "17e711f0-bb2c-407d-9ffa-ff6be570ac3a", "comment": "Malware payload (RemcosRAT)", "value": "ef19bce9d99c91a5cf4c2084679dc9c7e2f62722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853992, "uuid": "cb28c4b0-a28b-413e-97d8-7b4859edf5a8", "comment": "Malware payload (RemcosRAT)", "value": "773bea3962c839ad5b2ef1985bdf37b86065b518b10440cc6a0da20082d7dcda1e1bc5709733a0417ec678b41a2c139d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853992, "uuid": "2b39b644-d6f8-49db-950a-bed32607059e", "value": "T18025232069F95B2BEAB6A3F91020974127F7346FB124F3584EE6F0D7A1A9F100A45F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853992, "uuid": "1ddecb93-d369-4b4f-9fbd-dcf3a0a956b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853992, "uuid": "dc5dce15-2d65-42e6-8135-d877ccb889b2", "value": "24576:ih8c8HK4dsBu2mX59P8TupBxouCViRfrPBUIxX0hMw:iic8aRmX59UupBxouMiRfT1khMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698853992, "uuid": "40ef4988-ed04-43ea-867a-c10da752239f", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698853992, "uuid": "fe852ed4-787c-4409-8e13-47e6313fa39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853992, "uuid": "8eba815e-cb05-4796-ba48-d67cdb12defd", "value": "403aac398b6e70558bea3ae9daa84460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29497aad-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854593, "uuid": "9c4bbf98-012f-4166-955c-771dbff60ec3", "comment": "Malware payload", "value": "ca7f043832ba6b22b79900e486db369e", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854593, "uuid": "2f69b7b3-a76b-425e-977d-0e36a904dbce", "comment": "Malware payload", "value": "36d4b2e714d499fad827fa94dee1e2ef073574145b4fb4e4c47768500f8a92e2", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854593, "uuid": "47320277-9389-4654-89c2-804b82d0cc3a", "comment": "Malware payload", "value": "9e9e47404be62940bd104db47901db29e24fa049", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854593, "uuid": "0c586837-e5ae-40b2-b0d8-5b4d7e3c7658", "comment": "Malware payload", "value": "2fab18c8fac771c67991c046203d553325399c6b51c8f2207d60ade8543d09c809b463c18e1b434b6c774c6da469aee9", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854593, "uuid": "9ea2f1e0-64c7-4d76-a6be-aff4f983f19e", "value": "T15E936C1952B002A7D37957318BF34D176576AB93B6120F2F8A8B025D1C65340FEB2EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854593, "uuid": "58e48c6f-95fc-4981-bd22-6be2a8a3cef1", "value": "1536:CCdcURFSzTWNec7TJ8epJ9HnXxqv2hvbsCvZP7YffjmbyL:CCdcpiPpnhquhjsUqm2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854593, "uuid": "47ddeff8-271f-48f4-8680-2dccb87ca65f", "value": 91912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854593, "uuid": "e0e832ff-b227-4e93-aafc-bb4b3c8ef6ce", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854593, "uuid": "8d1c8a79-cb94-4b2d-b74d-8509f9a7daa8", "value": "Missed voicemail 004.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab08009-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698819404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819404, "uuid": "9599447a-3e37-4262-9dd8-1069e0f7abf2", "comment": "Malware payload (PureCrypter)", "value": "5b1a7fb85bb451ed8681da27a0db2425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819404, "uuid": "c0831010-2202-4262-9fb4-eea3a581a146", "comment": "Malware payload (PureCrypter)", "value": "377791b4485710222ac502b3a2c4f247f1d4a9f4b697455f1be51b8f07f50eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819404, "uuid": "c3240114-6bd4-40f1-9a63-22537f1fcb1b", "comment": "Malware payload (PureCrypter)", "value": "9aefe29397084d355332d914a1e1624b584b5355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819404, "uuid": "53f32204-0fae-43b8-9072-fdd129586f3c", "comment": "Malware payload (PureCrypter)", "value": "4dd5fd4d684f953f0d360448b6a1aa8832ea09c69808fa1fcfb7d7e44999e4f084bbad173e898dd79e27a174ef756fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819404, "uuid": "f07faf9a-b8f1-4d36-ad09-39dbf9c11b3e", "value": "T16C42D6117788573BC9220BB799A3D3800771DF14A967DB6E7887B31A9F333900A62B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819404, "uuid": "4e25e530-c461-4a0b-96b2-ed7f87d51207", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819404, "uuid": "e4f9cefd-0086-4d87-b6f8-f8cf940900e1", "value": "192:P9A/xNAkQggJzMruz51pn/L4qGYZ/ISCJcZSAqKBOXL7tp+:V2N3zg51pnTkkgRcZSAqvtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819404, "uuid": "07641e0c-e003-45a7-88d3-3c02603f92bd", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819404, "uuid": "ddcc07ac-7cbc-4170-962c-a422084e3ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819404, "uuid": "e6f72008-4edb-446b-8ec4-abe99ce44fb1", "value": "Pxvotbje.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da0a2e7-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698821502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821502, "uuid": "d9d46e29-19ef-4d8c-bf8e-80b6955fa7c0", "comment": "Malware payload (Formbook)", "value": "61e99b74b2905cb627430ffcff42dda1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821502, "uuid": "b9a81ca8-0cc5-42b8-8368-fb6185d6d68e", "comment": "Malware payload (Formbook)", "value": "398d4c9bea813210e56da3547fc784f0ffee56f99bb8f95216d05c7d06a14d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821502, "uuid": "b059a252-4419-484c-8bfb-fcca639d0f9a", "comment": "Malware payload (Formbook)", "value": "575caf4c6c4d85ed76b60abddbc6dc335ff11177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821502, "uuid": "f41b19be-c78b-49f2-92bb-9aebb599e962", "comment": "Malware payload (Formbook)", "value": "1fe9396c43177a48b3fa36a3c361ba3b247a16a2b8799bca842d6ea32386db91f13fca6b9ad82e21efaa82016b133442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821502, "uuid": "e10d886a-4a16-493a-bf30-bb92725517b2", "value": "T124C422407BBD4B64C77CA3B54BE35148A3B7721B1160EB2D2CC866CE50B7B8A4765B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821502, "uuid": "5779b60f-2707-41da-a2ba-59f49a1320fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821502, "uuid": "b5a4b07e-99ea-4572-abb3-cf8b1199526a", "value": "12288:m8G69yqLKWqieizNNf4OVMY0Wb0W3jUcTSK2OtzYHJ0/Bgw:66XW3PizHNMY0WtUcTCOIJ0/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821502, "uuid": "aeec8278-ae9b-4e73-9d24-fe1943d40356", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821502, "uuid": "5edf5eac-f25f-470e-9459-a96a9f6a4b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821502, "uuid": "83241bea-f261-4ae2-b7af-527a39b5372d", "value": "61e99b74b2905cb627430ffcff42dda1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b488ef-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880726, "uuid": "b435b644-b467-4af1-b192-ab4eb34babcd", "comment": "Malware payload", "value": "190b64f05be506f297d8858ebcbe6b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880726, "uuid": "5f5225a6-6b78-416b-be05-06ba491c4e0f", "comment": "Malware payload", "value": "3a24fc7dcfc6a68c16e16b4d16cee481fa4bfa3a41ba9ee7d0d4e49f0c9ebd14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880726, "uuid": "47834ee4-5003-4b1a-bb0a-b6ef56ad51d5", "comment": "Malware payload", "value": "76a22b4ce04d037c38bff18c0d6bb7f19f7411a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880726, "uuid": "7c1f9901-1936-400d-b085-b7ddb69827ee", "comment": "Malware payload", "value": "00fb7f55ef95a987464c69dec005082f306ca3d7fc827da6752c9145fa298962c3938b9ca2ae8edc978e64a2022aeefd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880726, "uuid": "88d9afe8-8996-413d-8aaa-7692a9533c61", "value": "T1F8B4E81BFA60630EE443C0303566D64A9A26AC727945AF1BF3809FCD61315E399F9B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880726, "uuid": "d692a807-fcf7-489a-bf3c-ae21b16e2e93", "value": "a34979747bb328ea1e72f10957aa0a98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880726, "uuid": "430c1679-4d05-4004-b255-3974686645ca", "value": "12288:0MEgjSsHIsNkiR7TzANr0YQHfACzdxZZGshO30JMmaQezTxSFqk1ksGoDDTAOhRL:HEgjSsosNkOTzANrPCGsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880726, "uuid": "dda2fc96-099b-465f-82e3-0fb3bd419547", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880726, "uuid": "9450a881-6016-4011-9477-337eb2b2d9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880726, "uuid": "e3c7c72b-b94b-4a7c-966a-73d48fccd541", "value": "SecuriteInfo.com.Trojan.SuspectCRC.28945.24878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b9945b-78f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698872170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872170, "uuid": "d8332a76-0737-4762-b5dc-5e8e3a03a7a2", "comment": "Malware payload", "value": "2a2cfd61d4ebc2f4956e9a56815b7c0f", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872170, "uuid": "7c32d43d-104b-4279-b116-bc57982c3490", "comment": "Malware payload", "value": "3a67f1634416de1483327e8cfe38c456f6891512433f5128df07444e44b886cd", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872170, "uuid": "d5394e96-aecf-4ccd-9ac4-e216472585d6", "comment": "Malware payload", "value": "47718e8df5e7a0d0b2c74f10696ca50cf6e1e0b9", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698872170, "uuid": "8352371b-8034-4723-8243-2e0446c8e726", "comment": "Malware payload", "value": "e537719a8f869362aea967854b815a313e9222542f84f682c88fa4a6ee85dc49fd4e2631c167fcea04de44dfd58d7dfe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872170, "uuid": "d0b3dcee-7b53-48a9-8f3f-1de406a6d236", "value": "T1FC9633623DC6DB39D21B10B703B796A026263D270B24E1C737A13A6D54313F15EBA79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872170, "uuid": "fbdd3c2e-07f7-4843-b955-a8b2ab7e91a3", "value": "196608:ikdAirk9zqV8GinTPMoGkd/ROfL0uUmN4in1VAnEVYxVSe317I:pdAirAzqVAnTPMgd+0ogHnF317I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698872170, "uuid": "a2d5e830-d000-4f68-b8ae-23d194e66cde", "value": 8699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698872170, "uuid": "81025fdb-4aea-4221-8e05-b4d185425fe5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698872170, "uuid": "2f1ec8ab-8e57-4a43-b4c8-da898d490bfc", "value": "juhygr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb7b238-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698842331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842331, "uuid": "9e235415-b349-459b-9c04-fa2ef2c097c7", "comment": "Malware payload (AgentTesla)", "value": "12912f7dfc9298d4e40829bb4d58213f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842331, "uuid": "97c8f65b-c565-401b-a932-8988df7b7b42", "comment": "Malware payload (AgentTesla)", "value": "3aa3a71ec52a2476df7da2aeafd0a1e3bdb19dd4d962c51c4ebde0555f6f143e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842331, "uuid": "2e26594c-5548-4e6e-acf3-fbddfcd635c0", "comment": "Malware payload (AgentTesla)", "value": "eacac9c298a674a419928256a40ce5fc64af5c4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842331, "uuid": "c170b2d1-e213-48a4-aee6-ba920a403618", "comment": "Malware payload (AgentTesla)", "value": "4df071a757d5a1ee903c3cc4c0f56c4f3db8d07b51c34985a5801762beb2eccffbaa2ecfd805983f03ca93e742b890a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842331, "uuid": "f36b1f97-bffe-429d-9870-f874be5371d7", "value": "T1EC24197E1741BE02C6EE417D0136950826F09507873EA34F6FE248FE1F566CAF91AAE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842331, "uuid": "cfb451c0-51e7-4ff6-9c74-61d8b16ca304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842331, "uuid": "4c5431b2-9a80-4de7-9520-a1fbeeeb244f", "value": "6144:HXxjmnJ5I4em14y+dRxOuUQDS/qj+T+jo/8MDyCPTM8MryvX:AnJOTTy+gQTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842331, "uuid": "e174da42-9cf0-4d7a-83c0-c3b1d91af407", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842331, "uuid": "300d4de7-321d-4b8f-a76a-79fa95225a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842331, "uuid": "a5b9ca5f-a79b-4c33-92f3-76660b8fc5a1", "value": "3aa3a71ec52a2476df7da2aeafd0a1e3bdb19dd4d962c51c4ebde0555f6f143e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b7f6f2-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833565, "uuid": "7a901c1f-d66b-48bd-8f0d-476f3c53524d", "comment": "Malware payload (AgentTesla)", "value": "99230335e3cecd42f5d48c2b1c70536f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833565, "uuid": "236c6ffc-e0d6-44a9-b9e5-26c0cc4d8f20", "comment": "Malware payload (AgentTesla)", "value": "3b07f97d8a657d881297b56d5587c76bf647ab0c364cf52ea42cc66ed8d793f6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833565, "uuid": "4e1547ac-cda0-40c4-866f-0fad0f87d584", "comment": "Malware payload (AgentTesla)", "value": "afbce2dc807dd7aa368513e120ad7fe975b8086b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833565, "uuid": "0abd61eb-b2f2-402b-95db-21bd9dc7a16d", "comment": "Malware payload (AgentTesla)", "value": "d27243b59970842b13ce3d1d9a101110106e13f059a8b83c2c8640a0619c40632a83f8109dda334dc85b715d9390432b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833565, "uuid": "16ff7b68-7f6a-4452-96e3-1110feb3321f", "value": "T139B4231491E07A1AE909E07DC10DEBAF57F203D6E99D1ED3DC4AAE000A70DCF5DA9DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833565, "uuid": "63649b5a-0a20-4e44-ae87-efe024a95188", "value": "12288:RetHW5XOZw6LC+Lv8GW7axSqrs8kyC2c4RM2HEpW5LdJTezWx:st25eZw6W+QGWWxSil5G2HtdJ6zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833565, "uuid": "0a5f5815-0a4a-4841-94b2-553db64156f2", "value": 518155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833565, "uuid": "5436964b-0f0c-45cb-9ba4-e8dec624a756", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833565, "uuid": "115b8c87-2919-4daa-bdc9-bf725ec11631", "value": "PO-32221126.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce91a3bb-784e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698799036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799036, "uuid": "db05ab93-3a1f-4dab-80e5-98af48fc35c3", "comment": "Malware payload (Mirai)", "value": "018db6868558872a527754c14d9c5701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799036, "uuid": "4d13f979-9e02-4a3e-9bd5-8e96a4d7371f", "comment": "Malware payload (Mirai)", "value": "3d335049e43d212934a200276784e739c662f659654ec5014f670dfe7bd33c10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799036, "uuid": "d6fff03a-69cf-4d96-bea5-d71f86829b9d", "comment": "Malware payload (Mirai)", "value": "c2898998821f785f0ab3679209b7b2fdab60df9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799036, "uuid": "7872497f-dc6c-4bca-84c1-18052f811134", "comment": "Malware payload (Mirai)", "value": "2eec56f158f3681d125210cc23ec5ca59d18c8cbcf25e9e378cd706fd99ea6531f84a1bbed6e65266734c70ec5b8b3af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799036, "uuid": "d0f6e929-5817-43fb-b004-ae61da471bc0", "value": "T163434B5172280B17D0931A70353F4FE09BBEFAC025D0F686B99F9B968935D330546E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799036, "uuid": "8f9d5310-59f2-4d4c-ac17-7d388ce58364", "value": "768:zaVVRLWYgnvRYDCi1jAZZkXSoPiqmPdGqthiT+eN4b9qKnZY10UNf:EVUv8CiNXG6TH45Vna10Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698799036, "uuid": "da2786a1-1497-49e2-8b12-59ebe128bd1d", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698799036, "uuid": "dd29b034-3d37-45e2-8aca-eb05b37a9e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799036, "uuid": "3a6cf28f-e841-47ad-8cd7-640cc7fe9cab", "value": "018db6868558872a527754c14d9c5701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a9a93e-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821251, "uuid": "5bce8abb-6be2-46a7-a3bd-0eea7d97e304", "comment": "Malware payload (AgentTesla)", "value": "f557913411cae176b85b3640e374256f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821251, "uuid": "a1a6c15c-a28f-4736-99a2-47cebb92ab54", "comment": "Malware payload (AgentTesla)", "value": "3e10f79c0386212e215674b4cd5ac19c46c616f655fecfb75da5fac47fcf9a22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821251, "uuid": "97bc2d4b-3dcc-43cc-a82e-6d4b82bb491a", "comment": "Malware payload (AgentTesla)", "value": "86c622b6a5dfae9f2d7c67c31d645f97c988b9b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821251, "uuid": "9aea04ff-c987-4793-ba23-af487c939f88", "comment": "Malware payload (AgentTesla)", "value": "880a358245f3c00daee6f18ca6123de87c47fbc3820475ddbcb02a7d5a6412642bf0b3eefff6944f3eec7b124a3eda8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821251, "uuid": "353536b7-980a-43ba-bea5-ac00de4cf1b1", "value": "T1D2335BA2EE94161A0E4B3BCDDD821D8185BC9019193B4166BEF903DE930B59CD3BDB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821251, "uuid": "94cabe2d-c6a0-4ad6-9b5b-79c445a1de09", "value": "768:PVQvk+YMiysnD1FgWFehwrMe+q1UzxFThh6W409pWDFkFo2AaOEEypr3t6AiFj0:t3LXn3gUehwrMe+q0Xd9IxKArxCiFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821251, "uuid": "80509f69-3f0f-48af-8205-c114315ba487", "value": 53645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821251, "uuid": "a3636fd6-8f93-4fdc-af67-c64c9ecd15b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821251, "uuid": "6f7a1df9-d168-4d03-8cf4-5ea0b34b06d8", "value": "RFQ20231031_Kommerzielle Liste.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ae2ed1-78dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859719, "uuid": "0fa05887-3c32-485c-83e7-35b9132fba66", "comment": "Malware payload", "value": "9ca5df575e5bd60035202dabd67b7af2", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859719, "uuid": "eb5a2e98-bec0-4f45-a25d-63816bf6fa65", "comment": "Malware payload", "value": "3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859719, "uuid": "89c427df-0094-412f-8c12-3dba9acc9d4f", "comment": "Malware payload", "value": "d28830d87fc71091f003818ef08ff0b723b3f358", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859719, "uuid": "7ff6192d-7475-4b95-a08d-1d1f717b0c47", "comment": "Malware payload", "value": "e397cc8eee2ca3210e53a5230e235ac4818d6a95344dd52ba8ab179e93e78d76969c0b5b6c27f90ac99d9f12f4c4beb2", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859719, "uuid": "c6ddc28e-a4ff-426c-b026-7314a1b5403f", "value": "T12E26225655D953E8C0C38B706287129E30E47B5A86B98C2D3ACB7C03FA91D5F458BEB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859719, "uuid": "58177645-2217-428c-8655-993532d8c00c", "value": "49152:6orfgIrBidk+CUuU64iSALmwQVEDLty14RXUzPgdsDabHhsoCYiibOPnSkwugUfJ:6ordnUViKVJYkzPgSDmhCYu1fpp4IZSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859719, "uuid": "ddb06953-d15c-4ad1-bed2-ac88ebaf8b4d", "value": 4592664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859719, "uuid": "28aaa75d-90e7-480d-9315-873cbdd4af3e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859719, "uuid": "98b78dc9-b544-4b5a-90e0-dd1a9717a708", "value": "log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07e8303-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854417, "uuid": "af002493-48ae-4626-8756-173ccf459594", "comment": "Malware payload", "value": "de08756be0f3fe2b28762062b3f20af1", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854417, "uuid": "22a76fea-54ad-4f7d-87cd-1e699bb231cd", "comment": "Malware payload", "value": "3ec6adaefa59cd6905cd9a48df107b775a3d2bc7b8515b3102c9cd23cac3e03a", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854417, "uuid": "4b9fd517-3cc8-43bd-bd22-dd68cef66aaa", "comment": "Malware payload", "value": "d8ab64b4cea3f43b24630cde302a71c3c6c41244", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854417, "uuid": "7f269f75-3816-466d-ae82-2a2cb7630479", "comment": "Malware payload", "value": "352dc6a8bab744dce03a2cbdaf49d56c74ad79180de94cb58a932f8a98173c58ba43a7d8e255c173dbb3735226fbf661", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854417, "uuid": "de811b01-9c4b-47ca-8894-5b58b52dffe0", "value": "T1DBA34A1952F002A6D77D57329BF29D0326B69B83B5110F2F9B8B124D1C68350EE72E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854417, "uuid": "32465a31-ca2e-4edd-a0c4-70e6b3304a99", "value": "1536:JcU6FSzTWNec7TJ8epJ9HnXxqv2hvbBfvZP7Yf7ao:JciiPpnhquhjBpID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854417, "uuid": "d6b472dc-22bb-4dba-b14b-d4077406966b", "value": 98672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854417, "uuid": "8d21d7a4-67b6-4b1d-a605-2e7487172980", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854417, "uuid": "5cdcea65-3be3-4766-b996-74ec822756f6", "value": "Missed voicemail 003.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1dfacc-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880722, "uuid": "0e65cd4f-b999-4825-8e46-a68264f62eeb", "comment": "Malware payload", "value": "46b176a371ce3f61625492c029bb0200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880722, "uuid": "0ffcedaf-0ed5-4b29-8803-e30ab9439a76", "comment": "Malware payload", "value": "3f24be0fb9f643b584aa2af6747035b8e9539b8e219177ae4ea8b702602a79f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880722, "uuid": "c9a0eaf0-2ef9-4213-9b96-9021a6d01d27", "comment": "Malware payload", "value": "3cb88bb500abeeaeb3152c30443109f4e9bf6dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880722, "uuid": "26c8c9e1-ae89-40cb-a4b3-6125eb4b0904", "comment": "Malware payload", "value": "148f84901206bdd6fcc456ed4bceb4d000a61f708a3f5c20c73337fe0720b7ac09dbf5dde6525bd4773c1415f08ce84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880722, "uuid": "59697555-b8a3-4c3b-bee6-e0af43b968e5", "value": "T160B2B663E67C99B2E29C8A7309764FBE44137C726610CE0BB8487E5D2C766836DE1317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880722, "uuid": "bf4107a1-cedd-46ef-b602-87c0f29b148b", "value": "201ef1c8790d6bd4aadb84a29ff3a5c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880722, "uuid": "9b54c43e-8077-4bef-a87b-f1f00e3df240", "value": "192:/TGafIcEdExHdUCC5CIbDhW2fjKwm3PSh22aI:/TGafZS09Ibo2LKwKSh25I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880722, "uuid": "9c59d5f7-18b6-4e51-b6a4-ce6d9234ebe7", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880722, "uuid": "669ff96c-ec37-4d48-86b0-7dade3071c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880722, "uuid": "ef0103e7-1859-485b-a58c-84561b0584d2", "value": "SecuriteInfo.com.BScope.Trojan.Constructor.W97M.Lime.30662.6101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a7a959-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698821385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821385, "uuid": "85a73156-634a-43d1-b8cf-e80e26282744", "comment": "Malware payload (AsyncRAT)", "value": "7f6f7813507abe6bf14ff6c06987f859", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821385, "uuid": "f56257e2-a685-4cf0-9dc1-aa107dcc3dda", "comment": "Malware payload (AsyncRAT)", "value": "3fe2880aae35f7663397321b402144435ab4afbad1b103007c5999ebad636b0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821385, "uuid": "71b152c8-8d45-4236-9512-f39f3fbd331c", "comment": "Malware payload (AsyncRAT)", "value": "53a6fad31e5063b360b4891c8939016e822abce8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821385, "uuid": "a933b4f8-3ee0-415b-9d33-821fa7ff9b1b", "comment": "Malware payload (AsyncRAT)", "value": "73d0c2644f856e2572e326fb3d5dae58b0c70a1e4a4ceaec6cebf1cf13687f61da9680727c20f1bff4a73e36d905fba4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821385, "uuid": "5f54d07e-e467-4a3f-a014-9f2888bdf43e", "value": "T1A4C4F101B7D784B2E5721D36493ABB21A97CB9601E34CE5FB3D44E6DCA30581A634BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821385, "uuid": "0c7ee975-abf5-4c2a-9994-a36d494638f0", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821385, "uuid": "db27e8a6-0b43-402a-9768-4a0736956c93", "value": "12288:AcrNS33L10QdrX6r1n37RDvjd2CgWLmVqC2lEZustyLB5:jNA3R5drXq137RDv/gp5WLB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821385, "uuid": "0b38bf7e-9805-47a7-bd91-c2a9569d08b4", "value": 548861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821385, "uuid": "92233236-a6b9-4d46-bf51-98ad55a100cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821385, "uuid": "d4eda042-d1a4-4e21-a0b2-134a138388a6", "value": "Odeme_Belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0458467e-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880730, "uuid": "67104de7-2ca8-40f8-b13c-c6c1c462a0cc", "comment": "Malware payload", "value": "2fe6c86b0b386423c9ec298e4dbe65a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880730, "uuid": "3a28996a-b1f6-482a-b0be-aa13c369a7a2", "comment": "Malware payload", "value": "40136fb95ef5fc318f065e2863eeacc3fa52e6f74c0270ef1ebea6e8c71a9622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880730, "uuid": "66deac69-3f2e-4744-8317-2a426c9d279c", "comment": "Malware payload", "value": "ef90efad12e5139d78fda2a71fa52e0ca0210abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880730, "uuid": "203fad89-e6da-4741-960f-214ce56e23d1", "comment": "Malware payload", "value": "32e31122a58cc019e47772b94f9c9c7eaa667182968ef2a147aa848e2f8fbbb63d9588cf6e3e23450e951eaea1639f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880730, "uuid": "2b58425a-3330-40d4-9bbe-87511438723b", "value": "T1D6926D4731E2C470E0A12DB652C16C608BFA7D312E6F8E97BB954912D930A9AFF31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880730, "uuid": "5a2eee7c-2726-4d02-a8b5-6cde55d7679e", "value": "095850f98d1dfe2715f4a1e43333f01d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880730, "uuid": "18c10f60-cb9a-4919-a121-e7a2c14a2b84", "value": "384:Cvcx78YJts8uZ9LCnp0Y/NF2YN81J34qt0DJ+YZQ8Wr6Q:Ckx78atoenpd/NFU1J34g0ljq88P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880730, "uuid": "c786c527-d664-42ae-9ac7-2840de45c75d", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880730, "uuid": "779ae620-f738-420d-bed2-60f8ad1ed46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880730, "uuid": "e3adecee-0bfd-420d-a10c-30f855ad72a5", "value": "SecuriteInfo.com.Application.Keygen.ABA.13622.20083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c66844-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698821375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821375, "uuid": "4b9ba820-11d3-403a-8e49-df547f0a1864", "comment": "Malware payload (Formbook)", "value": "e5eeaea04dbf03c821d5504cdefa8864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821375, "uuid": "ca5880f5-9915-4d06-8669-467b8a522acb", "comment": "Malware payload (Formbook)", "value": "40190c0801a99bf18a64e72bdb6cd35a0b098f25c16420e15c67a324594b8f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821375, "uuid": "91fd8112-7256-419a-903e-3e8603097c44", "comment": "Malware payload (Formbook)", "value": "763ba3758a7880b38a724dfb932885884f5bdc9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821375, "uuid": "2f1bba11-c19c-4778-aa72-4e11795cdfa0", "comment": "Malware payload (Formbook)", "value": "cbbb224a8e14d01a1055862f1a915e2d9bf7408c3859c43492f4a6a05963d8126cba700f4c856a3f2d72013662d136d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821375, "uuid": "9d41d5a1-5cda-4464-ac75-85fdd7c905db", "value": "T14675120BB633C0F5DAA903F3F9C6E5FB1D9DA9AA6C84998857D16AD77410E30D70E060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821375, "uuid": "8d434014-c185-455f-b01f-876f1b21238a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821375, "uuid": "f341477c-7ca2-47ed-97ed-3878f234a200", "value": "24576:f5rKBuExRpXVgRJRMqljuMLGv6kALPr7ByxKcTLGHeCBs/q:KxfXunRMqVO6kALfAEcTLGHfSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821375, "uuid": "532336d6-5e1b-441b-a3b9-705b96aec7f0", "value": 1592219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821375, "uuid": "a83500c9-0a48-43ea-95a4-30e920578a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821375, "uuid": "586cf60c-328f-4573-95e8-ec92b3d9840d", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a893b5e-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821229, "uuid": "6e88259b-9ea3-4abd-98c9-e81c9abc92e5", "comment": "Malware payload (GuLoader)", "value": "f5a20b0c439d901a7b9d183ac04227e2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821229, "uuid": "c8e34255-1710-44d8-92eb-de2b2aa4c36c", "comment": "Malware payload (GuLoader)", "value": "404a9d49d8522e19080af0cb183134fc058120e30fa38f5b8234eeb583c6f079", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821229, "uuid": "33218789-2707-469f-9b16-dd212507ce50", "comment": "Malware payload (GuLoader)", "value": "8e22c38dc0e4f075d8e4e0eb780b309c764727c2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821229, "uuid": "db07e2bf-b8f2-4d44-8a82-58ceb82c8d04", "comment": "Malware payload (GuLoader)", "value": "7a90c0002138825233d6efbd0a389aecb49cce5be274a4012a01c6c773b0fb7f3c99af14da9f9e58e16d9476ad20f252", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821229, "uuid": "4b95629e-f11c-467c-81c7-dbecbf0c91ee", "value": "T185336BA1DE990A1A0D4B37CADC421AC1C6FCC05909375125FEE953CEA24B6BC93BDF19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821229, "uuid": "0b561d99-73aa-441b-a2de-07005745e316", "value": "768:q3V5vmiIciyssD1F6W0IXG4ju4fQUAo10JBT40TFfPXkEhC2XAi3t6AiFj0:eoTXs36TIXG4ju4fcxd9kqfXAhFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821229, "uuid": "8e6fb148-eee8-4b5a-adc9-10dc95e71803", "value": 53765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821229, "uuid": "20301be1-c05e-4d9f-8ac9-f2fd63cd530b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821229, "uuid": "1de76c34-3f57-40a4-99cb-8d183e76526d", "value": "877004753788_0314131700_14181.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b4dca9-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833562, "uuid": "727a7049-833f-44d5-9243-cd971778d8d6", "comment": "Malware payload (AgentTesla)", "value": "97fab2fba8a4e0336bb7e9232fa61293", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833562, "uuid": "4389b464-c2a6-4911-8c55-db31fd91889e", "comment": "Malware payload (AgentTesla)", "value": "41835852575298a43dd5c52de944a1c29039c88ec13457575bd9c138c10e4a49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833562, "uuid": "aea50dbf-2a21-49ba-a1e3-50cfd913063f", "comment": "Malware payload (AgentTesla)", "value": "79a6eb2a02ac0b4b477666c3ba697ecba0557d99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833562, "uuid": "17e45d0c-5397-4cd3-81cd-845a5f08b4e5", "comment": "Malware payload (AgentTesla)", "value": "34da32c3cdd2f4c220bb042d5870f6f317afd09581c25f26c0cfc060f76e49f4444ca3cfa9beecb8f0bc1756395511ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833562, "uuid": "676e874f-df83-4432-a447-7f39b26f6c0f", "value": "T1CA542323C14089F0D7DDD56D8D7CDA4B4DC9B40FB262AA0F4F8246A59BDA39BD03718A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833562, "uuid": "231df3ad-80bd-4fc7-af28-422ede7cd8a6", "value": "6144:MykraZrdaiWD1ckJ4yb5ZpNsON36kbJ5wBO/I/3oe8XTQGv2kIRL3ppD:Myk+ZrdU+EXNso5wBT/4JDQGv2kIR1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833562, "uuid": "43055b08-8466-4036-b689-2feef1505cb5", "value": 289522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833562, "uuid": "25e6c11f-ea1c-496e-bfd4-874c3b3927aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833562, "uuid": "41dc749e-5373-4cbb-aa3f-892f273438ba", "value": "PO23100022_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1047838f-78c3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1698848968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848968, "uuid": "a1b911d1-c398-4be7-ab44-88df17fc9c70", "comment": "Malware payload (RiseProStealer)", "value": "c83a84ce9634382d9dd0381e7372ed83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848968, "uuid": "435ef3cc-30ac-4d75-a1fa-9ffae0347eac", "comment": "Malware payload (RiseProStealer)", "value": "41e5084e24a81588ddfee0469c3c8eac1461add1f7efd862e6491bf26eff971b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848968, "uuid": "3048325d-9c56-45b8-bed5-74bfd0dc05bc", "comment": "Malware payload (RiseProStealer)", "value": "790cc1c679baf5616d8602e4454fde611824d1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848968, "uuid": "292466eb-74a2-4dc6-82cf-9325518fb4e6", "comment": "Malware payload (RiseProStealer)", "value": "c1208e9e9a67a600afb94ee159ab5e2bc60d68c2adb707be1d1ecdc9768b313a5bf6283c80a9bae49d276ef0b3964459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848968, "uuid": "f2b1b2a8-cdc8-4064-bded-355a5f149b6e", "value": "T189558D71B402D037E1A101F5A67E9BA611ADBA3017AB08D7B7C05E7D94F19C36236F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848968, "uuid": "514ce2a3-f0b4-4a62-b652-a84561bdf4ff", "value": "25c8ae30cd1820a1b5b2591280c2ac98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848968, "uuid": "782ec361-e263-4bd2-8768-a07e89ea8d53", "value": "24576:MF9uwNfSKYFODIbxDtU9jyuSmsLNvwqsbQJWBMFbSFv/XsTRYc9W54KycnnC3:qgKal12UpkbQJW2FbSFXXsTZ9W54Kycm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698848968, "uuid": "e9f445a9-2fc4-4c9e-b42a-04a7afa203fb", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698848968, "uuid": "020449ba-ed2d-4347-bf5e-b95801ccd6b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848968, "uuid": "2edd8c67-ee03-4cb9-9b4c-b016150bf952", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7a1100-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833578, "uuid": "44223d69-e907-4202-8e1e-6db854b92efa", "comment": "Malware payload", "value": "9706f80c1f112cf074d531e1a091adea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833578, "uuid": "c6f28dee-313f-4b95-b16b-2a2aab05bd18", "comment": "Malware payload", "value": "42257794927178294940480322ac73dd3347a736da19f2d07068844d312f377c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833578, "uuid": "7c73c5fd-8863-4412-8537-5dfb59b82d03", "comment": "Malware payload", "value": "b65ce29f664bc1a1424fc377f1a8d538b3e91da1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833578, "uuid": "36b8b678-1997-44a2-b13b-7931ee2c2b09", "comment": "Malware payload", "value": "3b20240764030a92d5d9e04c2e3c58092568acb2802473a6bb57a09fa6f00534b92d5c5cbd21e5d50297b3a10055b76e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833578, "uuid": "bf1aa22e-504b-4f19-9691-5d7c5f0dfba9", "value": "T1B3D312FEF3626438AD15751DDCADA38A269CC1DF51CE4A11E981CD94FCECDEA7198800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833578, "uuid": "c4e336fd-7742-4878-a3fe-79e466c28d68", "value": "3072:MO3H8/e7dbH+lZFzgu1G+4it8reZptKjrVIzNq:MO30edavBj8yZfKjSNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833578, "uuid": "01468370-4512-4271-9188-021a188707e8", "value": 132951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833578, "uuid": "c015018a-7ccf-4a0b-9303-57f4bf3d4311", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833578, "uuid": "7a828476-f6cd-429d-a7f9-6b3bee01393b", "value": "Quok.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2729686a-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833544, "uuid": "67bb60b5-0f7a-41bb-8866-697bd0f6d8ff", "comment": "Malware payload", "value": "d3e7cea6886f6ae6b433f5169d11943b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833544, "uuid": "304e4562-dec5-433a-b336-b78486d80e20", "comment": "Malware payload", "value": "429db3598921c271672ec8f11df4dc876d9a04bb9c0efd30a737a081126c88db", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833544, "uuid": "863a0325-ee7c-4f93-b93b-a11ae3f5bf29", "comment": "Malware payload", "value": "e0bacefea41465a9283997e571ded2d95afbe582", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833544, "uuid": "fb2ea8ed-72da-469b-b1a3-b85621e98250", "comment": "Malware payload", "value": "be84e8192c40eb0a643400f776d42dd65854858beb251489dd1674163c0509a571626900e0ff8fbb0a128ed4b8624346", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833544, "uuid": "2316b23c-51ee-4e7d-93b1-d53fd63433e1", "value": "T17B04120A731D8CBEE3A9D7A215466FAF1FC826950A192C7BAC8211F4D3D13F4413E74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833544, "uuid": "72a666f5-ae8c-4524-a73b-34f8f203a0e0", "value": "3072:w2+B0sDYfqxvCgg/i/nZ87s2bNjNevxRWKchbp6OIZX6kj8:wp6fSo/eZ87lIvDop6Oiqko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833544, "uuid": "4e4264e3-62fb-487a-af00-e4e23883b5fe", "value": 173388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833544, "uuid": "2f652a78-a6ab-401e-be5f-a882ef9bec54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833544, "uuid": "52a17ba3-fa3c-46ea-971e-fca36e4905e8", "value": "Modis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec9a2a5-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821504, "uuid": "5facad96-771a-4860-9876-8d3899ca889b", "comment": "Malware payload (AgentTesla)", "value": "c7c3c527ba9482077d2e8d02d3261f80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821504, "uuid": "d503e4db-02b5-4768-a714-729327508250", "comment": "Malware payload (AgentTesla)", "value": "42f53657f1fa3e1a832805479fb96f941870e7722c577f7a201a81543dddb878", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821504, "uuid": "960b79d8-0aef-42ec-b90f-0cadf88d1725", "comment": "Malware payload (AgentTesla)", "value": "e41bf4d773ee36b3f037d932536167e1c8785a8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821504, "uuid": "dcb20354-bb4a-4ab6-a994-b5c8cce492ef", "comment": "Malware payload (AgentTesla)", "value": "7d1b7523f3c45d24a35cd3afbe7e283f1b0e085b25ff55c63bed3e1e96bf14e3485b7b7abc5d774f26667bd26e96a0ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821504, "uuid": "3fec0c2a-c05f-42fe-ac1c-6d0db8d1a587", "value": "T196051119B2BA1F53D67A83F9B460794003F5B0AE6561E354DEC6B5EF2134FA04A42F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821504, "uuid": "88db2247-cb31-4189-90ff-9df01db65ff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821504, "uuid": "1a8b84ac-8993-43bd-a798-eb67f40fcd05", "value": "12288:ssoaqVJBT7yb6a6F3Oi6JN/V0JFjtj4j0Sv1hPAoZU19P1OGZ2j0YZ:eBKS1gNKrtjUTMoe19P1v2YYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821504, "uuid": "2b850083-4441-4464-9d0c-d84ee9ec1d45", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821504, "uuid": "9346fab0-c905-4a97-a74a-37c5e0a1e1cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821504, "uuid": "f45f13b3-0aad-4097-b665-b9410fd0b448", "value": "Hesap Hareketleri 1-11-2023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d1856a-78d3-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698856065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856065, "uuid": "4cf9d9be-db9b-4367-b29c-c4ad14857ac9", "comment": "Malware payload (zgRAT)", "value": "211c3aecddbb97738943a1d9471ba7c2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856065, "uuid": "b1f3a850-85ac-4bd9-af81-9a133338cd60", "comment": "Malware payload (zgRAT)", "value": "44083be323ff08f7d4291a4b13a983ba680e3a793db7bd123179378e39d2a31b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856065, "uuid": "96f7acbe-b630-4f7a-bc72-e9a1f28f9744", "comment": "Malware payload (zgRAT)", "value": "739cde98ae0761fb6e88fa548af75ea512631655", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856065, "uuid": "fb50c4a7-b405-45e3-acb3-9e04e2ec6e45", "comment": "Malware payload (zgRAT)", "value": "6e60818df4747bf1eba6eeb739a08508a39a833d1f6cff396a8b38b4b7c2d4a21d27b4dc613ea60d4043301738a35717", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856065, "uuid": "11b6501a-74b8-43fc-9368-59911a54d58b", "value": "T11646124A8F4BDE13CE400271C14AC6F72A09CE9E9616D3735BEDBDB371877499398298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856065, "uuid": "d48f5f28-204f-4596-b9bc-b8725f74c579", "value": "98304:ThM4FP72iUsD1nMx7tHcCWQzWXMw5qOzV3Mr7jt4SNnVYm9GkAQ+qvkAKLpLjH9j:tJ1Yu1Mx7tHcdQzMljx3C6SDY/kAQ+rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698856065, "uuid": "0e158900-a874-4235-9268-820397c0c5d5", "value": 5731840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698856065, "uuid": "9139e0e9-e543-4530-b02a-401060715624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856065, "uuid": "3da178a2-f500-4289-9eef-8d20bfa0ffe3", "value": "211c3aecddbb97738943a1d9471ba7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129d2bf9-7889-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698824061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824061, "uuid": "52051d53-ac37-4e2d-869c-f5fe5931b3b6", "comment": "Malware payload (Mirai)", "value": "7d86b02b5d48e3cc54feed42ccda8000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824061, "uuid": "6c1d7baf-c66a-4575-8fed-a7849d73c495", "comment": "Malware payload (Mirai)", "value": "443d5e6de7351af30757e0f595e43fc6f06e3b2d5e973e748462bde9edbe9af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824061, "uuid": "0f4106a4-b6dd-488c-946c-6ba6a5268c81", "comment": "Malware payload (Mirai)", "value": "834dd3d1169adbc6b777c5d85083f2b03435ff96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824061, "uuid": "4d2346a6-8016-4e56-8134-a4950a92531b", "comment": "Malware payload (Mirai)", "value": "cdf59d5f4c7541b259f0fbd9aab9354dc7cf174222e7a05e3016ae7410cf01580da2286942a4e316c1fc77436425d491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824061, "uuid": "99e8e8ef-c19f-442d-93f0-32fc52f28a81", "value": "T11D935BC5BA93E5F2CC004A7C31ABAF325D73E07E2026DEC6F79899776984642C00769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824061, "uuid": "65156584-fec1-447c-bcbb-ce6bd7379a77", "value": "1536:rFTeQ6uZ7MCQivBp1ZSYrEsJJrHQDHGIzF1Z9LtOjt05mFUtACvCPTwssoVQ+cH0:UQ9RM0vBDZSYrEsJJ0DHGIzF1ntIOvtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824061, "uuid": "39ccdb64-1322-4430-9de8-2a6717a7f7a6", "value": 96176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824061, "uuid": "f57fae16-3ae4-47a8-a6b2-51714e33bc0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824061, "uuid": "48982a7d-fa62-45d1-bbef-fa2e06c9bd96", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a9b5d7-7909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698879068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879068, "uuid": "57ac09f7-2fb4-4d6e-89ef-681fad8dadad", "comment": "Malware payload (Mirai)", "value": "ae96fc6cf89d151cd3fe5fbe10dc6db9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879068, "uuid": "4548f39d-41c9-4e8f-bf43-71fdab099873", "comment": "Malware payload (Mirai)", "value": "45254b778e8b93cc3bd39341c29db7d9de5d079613980dd1ef36280f39f45f2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879068, "uuid": "31f0da5f-0c20-4526-b31f-5b75f7ad6001", "comment": "Malware payload (Mirai)", "value": "df3488334b92cd1f07356211f225f066770860c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879068, "uuid": "d4e82e2a-c8a3-43b2-ba35-4c20b1311fbf", "comment": "Malware payload (Mirai)", "value": "8907083dcd013c389c0a869ce06b5fc51dcdfdb553a1352a49d4a5b13e5da1b63273acd6cf0d13fc33339554fe8b5337", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879068, "uuid": "313d979a-3b03-43f4-92f7-6d0eeb12a671", "value": "T1A1D2D09CD556BFE9CA8D987C09EE01766EC434837A9D468A076348483B7EA47BC1D234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879068, "uuid": "131363d9-6a7b-4a7c-8f3e-78b03e415226", "value": "768:r1uUtLrVDsAp6tLkFqok//xDMfWChJbaWUV:rbDs06t4fYpwRhOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698879068, "uuid": "99fcd95f-94a4-4065-841b-2d8654262dcc", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698879068, "uuid": "860d7cc0-495f-4281-8205-f589e7e6e877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879068, "uuid": "8b4b9ab2-f470-4aae-bf14-a11cd9d124c1", "value": "ae96fc6cf89d151cd3fe5fbe10dc6db9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386f26a9-78d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698856337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856337, "uuid": "12f5caa0-11d1-450c-a39c-e8a4feca94ee", "comment": "Malware payload", "value": "0111e5a2a49918b9c34cbfbf6380f3f3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856337, "uuid": "09f59384-2056-4bcd-a59f-d9d330b1b8c0", "comment": "Malware payload", "value": "4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856337, "uuid": "7ea3dfe6-254c-432c-8dc9-60da7c02cc00", "comment": "Malware payload", "value": "81fc519232c0286f5319b35078ac3bb381311bd4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856337, "uuid": "34ffb0ae-f713-456e-bb08-462834982429", "comment": "Malware payload", "value": "da034abf044bbd7a39b38964306154c6a27965d328a6ea42ef2b478ab4f63fdf289e7ca8205ed130c72e112eaee1bad7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856337, "uuid": "675ea25d-4a9e-4af0-80f6-904c5a7a0848", "value": "T15B457D1BA36541BCD4BBA1789A235947E775700603705AEB07D04AAA3F53FF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856337, "uuid": "24b6efe4-c788-4bd8-8b60-e6f0e49c09bd", "value": "8f6370a79dbfb20620081d91ded2b029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856337, "uuid": "e49ec283-881a-4852-a6a6-f56025953036", "value": "24576:RAwtSMdHL4+3MQL+RoZk9LZ/zedfjMTUmXbc5Pf8Vd3rsx:Nc+3MQLQoZyZ/zEfc6P0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698856337, "uuid": "1d195758-eb2f-4998-b1c1-588ef96fa539", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698856337, "uuid": "b83a3165-b636-4618-aa41-722c5d8d5ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856337, "uuid": "930f0f48-c6c6-4e71-817c-cb49524ee756", "value": "0111e5a2a49918b9c34cbfbf6380f3f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1e2ca5-78b7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698843941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698843941, "uuid": "780771a1-1b9a-4d5b-9d72-fab2add38236", "comment": "Malware payload (Formbook)", "value": "4cb44bd5d786a7f2b53fd6d9602a2b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698843941, "uuid": "2e0936d0-b28e-432c-b145-70d1da98c0ee", "comment": "Malware payload (Formbook)", "value": "46b721c436cd339be63937ca6b9912831af85f8fca25d0e752e900683f073a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698843941, "uuid": "db56f55c-3d6f-4289-8b8c-de100571e75b", "comment": "Malware payload (Formbook)", "value": "de43c7e836752af8e8bf4a58f89b3c965e650ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698843941, "uuid": "df20a14b-29d9-4981-9c4f-baa319abd050", "comment": "Malware payload (Formbook)", "value": "8f6857a9c0d83d55e176906979f17090db263ff82ec354336547f1a1b1d9e32bfb161f2e3e5aa91dea622c96c8b22a4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698843941, "uuid": "d84ae9e5-eb93-4ce8-a57f-a1e5520d7e62", "value": "T1B69412073AA29567F3E29971483AC73AE77B0E280322A1470BF43E7736255D7F90D652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698843941, "uuid": "bd501ebe-ea49-46a5-b615-07493208c7a6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698843941, "uuid": "f6ec9353-d25f-49b7-998e-967416abb36e", "value": "12288:urCFFvOtnYsaGQY4HFCaCCQ49nya09R/3W:UCmtnq9CaCSyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698843941, "uuid": "6088a3e3-a1a1-41b5-b2ff-b478ac9e0e25", "value": 421106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698843941, "uuid": "6d9f6119-fe82-4300-b451-abe2c7585482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698843941, "uuid": "9b72321a-2e93-4c43-b8a4-10a70d0464f2", "value": "strakonaj2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adda266-789e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833201, "uuid": "eef22703-fdf8-4b9f-bbcf-61bba93b8b47", "comment": "Malware payload", "value": "7e6f4f34b23b707c3d122d510becf0cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833201, "uuid": "41a5a22f-03d3-4ae6-8083-57766cbabe19", "comment": "Malware payload", "value": "46d307398adba2667ebc9f90872650b89ee2892134d035299d010cd372ebf567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833201, "uuid": "256a5334-481b-46ef-8939-a060c9a451cb", "comment": "Malware payload", "value": "6fd9c7fa57a18ebf98fcb090dc5a4730a7859464", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833201, "uuid": "e5418217-f564-4de2-a30a-ab720bbdfdec", "comment": "Malware payload", "value": "cc9716cc7b87176d33afde7f271a11053578edcff39e2c3897bc8c11fae163b4c585f157075f2983377868ec3db1fe6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833201, "uuid": "64687add-8737-4d89-834a-ab830397e74e", "value": "T16983B41E6E219FADF36C833047B38E31A769339623E5D285E1ACD9105F6034E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833201, "uuid": "97280379-51ca-4a29-b3a5-1f8abab0fe1d", "value": "1536:h3ekYEMqQweNgncgntVnSoSSJjvtn9TbVW4Q84Z+rm99b1FH+:hukASpZhblGYmvPH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833201, "uuid": "7a6f6ba9-0d3b-487a-a472-881abca852c5", "value": 85816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833201, "uuid": "686d4de5-f20d-46c5-9a30-3d642ce60045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833201, "uuid": "90c3b6ec-4443-4a05-bd44-dca1772a7b72", "value": "7e6f4f34b23b707c3d122d510becf0cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0fc37d-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821313, "uuid": "22e407f7-b02d-4b67-a75b-6d3a2ec4189f", "comment": "Malware payload (AgentTesla)", "value": "2f138f4db3d27ab89b420a2566f2823e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821313, "uuid": "1ccbe93c-4e4c-49a0-b3be-ee407cc1ddaf", "comment": "Malware payload (AgentTesla)", "value": "48f798314a9a0c0015c5913df92ae68d3b85ca1872201b68528d18017176a0f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821313, "uuid": "ccd986bd-6a58-4663-bd45-e73363394ddd", "comment": "Malware payload (AgentTesla)", "value": "789bb601c9a9fd10137eec9990f0972273fd9b38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821313, "uuid": "dadbdc38-9bfc-4c57-b533-70649eb83acb", "comment": "Malware payload (AgentTesla)", "value": "f47f7de4a9b34de2adefb7bd9d1ec7330908ea6a3363b6a2b4faa068ee205fe24d74fb394ecceac5cfe318db70cf77ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821313, "uuid": "0c0ec216-c494-40eb-9ba2-b37d8223b926", "value": "T14AA3D02EB315E899C167AC7D8DCDD0EBA219BC658E42D70F31807B1E0D76683479B24E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821313, "uuid": "f6336ef8-78b9-4416-9d58-b235557306a0", "value": "1536:ApQDBYhZ9NvKt9+CrVnuq9jI88MR/UMM38RAc34w5s9BWc7tXL4sDjd5jJpb:TmhJvKt06duqdI88MR/U73IoV9L4sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821313, "uuid": "cd151ae6-4bf5-417f-b3f4-be7ddba119a4", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821313, "uuid": "5d187340-0313-4da3-b980-fcfcde710869", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821313, "uuid": "23d8856c-cf90-44ee-ae69-61029bbc3746", "value": "Annex 65689-PE.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498c2cd6-78b8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698844339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844339, "uuid": "58eb4f09-3f73-449e-8fd2-5e29179e60f5", "comment": "Malware payload (AgentTesla)", "value": "d6a96992b306f31e83a8254d62b45fc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844339, "uuid": "b38b2a1f-8cb7-4eec-b086-cc2ed5b29ae0", "comment": "Malware payload (AgentTesla)", "value": "495c9826ec56d32fa8ded966e3d6c461b43bfb042ff9e227e75fdb8f55435208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844339, "uuid": "127c8f0f-aa6c-4d28-88ca-45670c65d844", "comment": "Malware payload (AgentTesla)", "value": "bae6f20a78a5a5ded24076703cb043b265447b74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844339, "uuid": "b0deac6b-6874-4aab-ae18-f20a324d8304", "comment": "Malware payload (AgentTesla)", "value": "214d7b45a54f8aa853f341eb449ffc0f97f7490dec56d0129c607169d1db16bf62a2e7d0c800fe5aca50e6c6adf41a57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844339, "uuid": "e52e7d84-869c-4537-aec5-c4de5d4a8c65", "value": "T1A30512497A791B97DAB943FBB514684007FAA52F65A2F3049EC270EB7134F900B42F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844339, "uuid": "2d1018be-26d0-4a28-b2bf-53cd5fffdfb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844339, "uuid": "335463e5-b60e-42d5-a7f6-034f95c3cdf0", "value": "24576:bKlVCu7365TWMdl5bLts9zPBo9e87q1wqD:elVF36RWMf5yGb7ewqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698844339, "uuid": "01416e42-4630-4907-9e47-1fdd91c1f195", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698844339, "uuid": "4cafc6c2-bf39-45e8-8ba2-5ddc318fe682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844339, "uuid": "fea420a6-3237-4483-b2d6-4021a0b0f15e", "value": "Urgent inquiry_PO 20627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08edd9d8-785d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698805147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698805147, "uuid": "38dda693-dccd-4a23-9dd4-508473543778", "comment": "Malware payload (RedLineStealer)", "value": "9b26ac2eb83eb4406e47c57fb23d28e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698805147, "uuid": "55cf4a22-b482-4c79-9c39-8d100640b619", "comment": "Malware payload (RedLineStealer)", "value": "496d69da7ce05e925122e94de7376d4b637d080867497bd9f5c5d65358d65056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698805147, "uuid": "b4434041-e78a-4794-9ad7-56bae179f558", "comment": "Malware payload (RedLineStealer)", "value": "b6d30b5452a4c05037b7d0ff38f3c979e24a730d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698805147, "uuid": "01362f89-8982-47f9-a22f-a0102be2e95c", "comment": "Malware payload (RedLineStealer)", "value": "5ae122a7cfe7a6d619bfd6c27877ef4e07fa6aef76604fcd62566f12a8e86e13c700a3ec9faba0ff38393174bd3424d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698805147, "uuid": "b6bfd748-5b4b-46c6-b184-5f431b2fa963", "value": "T185752346EBD414A7F5F02B745CF213830A38BDA1187C923B3B93582A4D32AF55479B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698805147, "uuid": "494937ad-d521-47c6-b1f7-3a1ab115dc0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698805147, "uuid": "09a4c008-8cf0-4648-bb13-bb56aadd5ec0", "value": "24576:Gy9ABxJCx3Z+9S06ntChOx4hEgC54pGrlHVACROKZyd2WTjvewf9Q3SJEyM:V+CxmZu9qhEgS5OCm9FloS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698805147, "uuid": "10660d6b-01d3-4466-96f9-37e5c8c52cce", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698805147, "uuid": "eefd8f0d-b607-49b1-860e-0b0390209112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698805147, "uuid": "7358c570-8f69-4af1-814b-1b5345cf2cd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5fab59-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821530, "uuid": "2b627852-45c5-44d5-b251-07e1a83e5cb4", "comment": "Malware payload (AgentTesla)", "value": "5be4473b0646e44e8e0c8b7e22cecba8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821530, "uuid": "ffb959b3-6da7-48e4-bebf-d053cf161513", "comment": "Malware payload (AgentTesla)", "value": "4aae07dfebb1599fc9783df2211d20c60ab3cefbc0a62f036d965a58c017a582", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821530, "uuid": "4b292219-27bd-4ea3-a896-63d946a1b489", "comment": "Malware payload (AgentTesla)", "value": "b024bef9fd5f9ed533ad8c508c8963d8dff00270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821530, "uuid": "4cc8d5d3-b095-4ac4-bb9e-3964c6094fea", "comment": "Malware payload (AgentTesla)", "value": "60c1ea8e132d29517891bf75b9db860fc695492227e07513d667afe4fc69bb57c9ab0bc4dd193f15f536f4e0f9c43c07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821530, "uuid": "83b9409a-372f-4519-8b9f-88ec2aa4d6f0", "value": "T188D422457EB60F55CAECF7B592B6810063BB99262222DB4F0DCC32DD0997F840A54F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821530, "uuid": "14009deb-2d4b-406f-a485-000c0e8166e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821530, "uuid": "87b96013-0d81-40e0-8621-546a00464e06", "value": "12288:m8I69yqLJmTBI3u7zzpOerfu2f0yYsX6TisUFV+BWVAJSnSnf4DF1N:s6Xl+nvFOeHfbYn8IBmySSf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821530, "uuid": "0422706e-ba89-4a6d-9983-dd8f200aaf2a", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821530, "uuid": "aa1839e6-25d3-4636-babc-6151e4ac1107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821530, "uuid": "9f2c15d5-c7c9-44bf-91ff-9ed30bd718c4", "value": "Transportlabel_4714212217.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cee98d-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833567, "uuid": "84fba6bf-07f4-4a03-b856-24fb2c9ea2a3", "comment": "Malware payload (AgentTesla)", "value": "85b21b780b5d3c51ca50a44e81d36429", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833567, "uuid": "f78a9113-abc7-4f38-89bf-16eeed1da08d", "comment": "Malware payload (AgentTesla)", "value": "4ac2605c528602e4762b48ea363f41702341d183d311b292824d66545f28d2c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833567, "uuid": "b6a3fa6b-8786-46ce-98a4-48a671d1b0c1", "comment": "Malware payload (AgentTesla)", "value": "90c219c7ac7e8f0ccdf2e6ed725272b1b486c026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833567, "uuid": "cb3e6416-8aa6-4934-916b-eae8e58226a7", "comment": "Malware payload (AgentTesla)", "value": "15b17f20f6b75529bbe93c1a3328962a1dd08e7a09f0d49ae6a0fd57bcc869defa6ba218723677478d5f7f406e89460e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833567, "uuid": "fecff224-3dc3-46a1-9a2c-3044298b1879", "value": "T1FBE4010051A41722E7D873B94F29EAB043B15EAD6835D69E8CF6BD833BFC7870950992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833567, "uuid": "ef363fd5-a53a-4e44-b47b-a29542697a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833567, "uuid": "3669508e-5890-475d-b691-8582b3557026", "value": "12288:ZJoaG5ISZV6LQ4Lg4G5NaxSqrg8OyV2cQ6N2REpocLQ/UUzcJ:E5ZZV6E4PG5AxSiu5s2R4Q/xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833567, "uuid": "b6fc00c3-017d-4b0a-873d-e0dc1f4113a4", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833567, "uuid": "308aa2eb-c1e4-4798-9316-830e4f5e26c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833567, "uuid": "731cb7b5-e11a-43ef-9c6e-f9381ea1e430", "value": "PO-32221126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab4d788-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833577, "uuid": "eb580909-6b8b-468e-83a7-8cc6afa09333", "comment": "Malware payload", "value": "6402a37c35dd84e528b4b635cd7832ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833577, "uuid": "1925a0db-7be5-4747-949c-c51750f81dfb", "comment": "Malware payload", "value": "4b9c7f4b37ae6c0c90be12685d32e5abfdaad2e21992a725c57bf2a08b0dae00", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833577, "uuid": "b31e6f97-b6bc-4982-b727-2b3e6d1fde7e", "comment": "Malware payload", "value": "f07543b7ff9d4bb9bcb554e69bf6c0f7d7c1f659", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833577, "uuid": "9c1c207c-9628-4fbc-b023-c0bc48186bab", "comment": "Malware payload", "value": "0f63108f21546f9816742e4f8ba194d91ba114f4709cc9e750749badab59a1bcb0b8bead6e064d09e37f3e83acba356c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833577, "uuid": "9e7f02fc-6cba-4eeb-8d34-e0c8cebd8649", "value": "T108643B9D7160743805C5516D902F1A0BFE37252D286AC45CB36CF4EFA8BCE8931BABB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833577, "uuid": "00080fc0-8863-4c42-9edb-4842eefe332c", "value": "3072:hpPa88UdwPwvP6IoPaxx0zJ+yEQQZz/9dI11AlKwi3b5Ownq+vb/hp:hpPa88UdwPwvP6IoPaIJUzkSyb5Own57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833577, "uuid": "0f9a08db-c9f1-483a-a617-ac8f74ca9869", "value": 333125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833577, "uuid": "4d5d5d51-2011-4271-ae71-965a1d0bc8a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833577, "uuid": "a191a8d3-3366-4103-9eac-325aecc81384", "value": "Quok.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c34783-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821246, "uuid": "ec9c64e9-54c7-4b8f-8ec8-a287543192d2", "comment": "Malware payload (GuLoader)", "value": "47845d9c320d7861b333df3950d79008", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821246, "uuid": "0c7e0c8c-8c0c-4017-b5a7-1faa9bfd8b5d", "comment": "Malware payload (GuLoader)", "value": "4bfcf72d3722001f619f778d9cafbdbd5a9b5ae9b81e1a34a08383af2bbe4cc7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821246, "uuid": "c885ab46-d84f-4aa5-a142-27122943e38a", "comment": "Malware payload (GuLoader)", "value": "fd56eca0729e5e0a500df6c27569f073e7e6a685", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821246, "uuid": "d672dc10-55f2-4eab-a4dc-e9304d78bc3e", "comment": "Malware payload (GuLoader)", "value": "f382ebed5bbc2e580babb4d4e651835fb9b518636b0822d693329c1449cac166dc4e4ff2654d01437c459f835fcff55d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821246, "uuid": "d40b0da0-faaf-43bd-a6a9-983ff8d264a1", "value": "T10F336CB1EE94061B0C4B23E9ED828985C1BD855D05365167FEED03CEA30B59CD3BEB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821246, "uuid": "9a0a14ac-38f5-491e-b776-727c3fa886f6", "value": "768:NVKvHU2/iysZD1FnWOnOzOSY92t+DUewPJttbol40DxgFFMY/pEgWB+Mt6AiFj0:nQoXZ3n5nOzOvUt+nwHtUzQqAphWIFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821246, "uuid": "a51baec9-94ef-4c0a-9eb3-3ce7e6a9e898", "value": 53118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821246, "uuid": "e42ddaa8-3b66-4e10-9980-dd57e6932f29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821246, "uuid": "51883b3b-2129-48e7-a4ea-dfdd2e1564ba", "value": "Mapa Quantidades 81659 - ORC 497_PDF.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905aca98-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819977, "uuid": "800f0060-43c4-4fbd-bcac-3884cd56e30d", "comment": "Malware payload (Formbook)", "value": "047481b9c43b81ed6a77be99e632dad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819977, "uuid": "eb955d48-29f7-40b4-bc73-797f84882e09", "comment": "Malware payload (Formbook)", "value": "4c2a24dd1b030a2514018332c5f9fcb6d884ef62742cf991c5a03803a9245bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819977, "uuid": "74c25ff9-aca8-405d-84e0-67832dc3d878", "comment": "Malware payload (Formbook)", "value": "20396e5ca9eb2f2e08831ef174f94871dd2775d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819977, "uuid": "0a2e325b-939c-45f5-8bdb-724ded95ac78", "comment": "Malware payload (Formbook)", "value": "4f6d48ed0383b660b6ec1305e40f3dc475261d305a8843156448b5501a77f61458c12155d3b741716fde5bed8cc00611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819977, "uuid": "0c477447-f339-4938-8f75-9ba01c559dff", "value": "T124941214B181856EE9E5B3F859B056278A366DA01234824BDBF4BF687873323CDCF65C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819977, "uuid": "206eda55-ffbd-4b49-b389-ec62dd28a65b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819977, "uuid": "27451f06-c73b-47b5-bfa6-c537e15a8a5b", "value": "12288:RfLFbOVL4yIp4o5mvlX0rrtWnAvyBuk4wVCUL0Qfilh:RfLFbyq4MQXqIYyB8wPwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819977, "uuid": "8cdb80b8-69db-4ee1-8d9a-bd5b1821eb48", "value": 425437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819977, "uuid": "fbb527bb-74f2-440f-a79c-02a6ac7753fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819977, "uuid": "cbf34a55-3971-41b5-91b8-86428f82e413", "value": "BITQ09865457800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567cb396-787e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819450, "uuid": "7395cbe9-9981-4fcd-b3f6-96d011766f3f", "comment": "Malware payload", "value": "0c8df241b85a78369b10edced422d80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819450, "uuid": "916e9708-2a57-4ad4-9592-d7f7c24a1cdb", "comment": "Malware payload", "value": "4d136f27189cd9ad1f59f7705c47066afcfdab6adfd07e7ead577209edb8b4d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819450, "uuid": "b7d75c1e-14aa-4b12-9da6-53da6e5eb965", "comment": "Malware payload", "value": "65fda78302e7f17ecb009be25549ec4a497e477f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819450, "uuid": "47619e3c-7588-4e6f-8bac-c20e1990e444", "comment": "Malware payload", "value": "be117a398e22583d2242b6156b14c60e5374cd4d1710f2703cf54c2cb09e8bc6cfdd5aa133c8daf59b3bf4ba9fc88024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819450, "uuid": "b70fd689-d263-4753-9cd8-da9263134805", "value": "T12A92190273985336C17607BB68926651C332CE0B2599DB5E7C8F721D3F7278187A3B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819450, "uuid": "239f2df9-2d0f-4e25-9b23-f7d90e9efb75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819450, "uuid": "223876cc-12ed-4e17-b80c-c1fcb568af0e", "value": "384:abiLJpmcgBgX5rAWsolHOBffffIX91ptYcFmVc03K:oi1fbBlXtYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819450, "uuid": "4ceb6f23-01a7-4ad6-93d6-85c9926df30e", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819450, "uuid": "f66ecd15-0877-4447-a392-0190db7b8cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819450, "uuid": "c402aa9d-b378-4edc-a648-5275acae7962", "value": "0c8df241b85a78369b10edced422d80f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639e40fb-7902-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698876166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876166, "uuid": "64e6f002-4fb6-4908-b458-dc09a252fe52", "comment": "Malware payload (Smoke Loader)", "value": "8d92225608efa622a4e87c8a4589b030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876166, "uuid": "9b84e4bc-3565-41f8-b0ee-ad9f1d9da660", "comment": "Malware payload (Smoke Loader)", "value": "4d311d7c8d8233168a120ce059b0e6376033ef73a2f5504f00f5a288d09df133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876166, "uuid": "f5d145bc-4bcd-42ed-adbf-379f21c31336", "comment": "Malware payload (Smoke Loader)", "value": "e854b48e51ecb5fd14b4e22917dd3e542476b3fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876166, "uuid": "a564fabf-b302-4be4-b711-724068b46223", "comment": "Malware payload (Smoke Loader)", "value": "9450f8b1d6e61df2c9811bd2c34d78dcee585bff5a489c1c2a6021efdece76d66ed69810afb2c91b8df7f0b78d814aa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876166, "uuid": "08a94ea0-95f7-43ce-bfc7-80deb423f544", "value": "T1E3046C4392E13D55F9664B329E2ED2E4331EF5618EA93BE931189A2F09F11F2C173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876166, "uuid": "19afe97d-2dd8-4fd5-9e92-baa0cc523f19", "value": "770cdb8cf8cd4da991843f0525f56478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876166, "uuid": "474b8fbf-f067-4cd3-82e8-a4ffe97651de", "value": "3072:Lu0QodMDpwNCZoHVUGnNcQPkZXgyxtOzvX8WYzT1zaI:W2MCNsoHVUGnNuXXSD0H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698876166, "uuid": "49dc8a3d-ab7a-4437-ba9c-7420a0e98961", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698876166, "uuid": "c6ffb52b-1c3c-4aa9-96cc-85e5dde8e474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876166, "uuid": "88feded2-4bc2-4d36-9e60-2dd30ac66616", "value": "8d92225608efa622a4e87c8a4589b030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1ef877-78fd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698873924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873924, "uuid": "45a6349a-b8a4-48a9-9602-0ff9a9fb64a0", "comment": "Malware payload", "value": "ffa38ff8c434945de11b621958170a10", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873924, "uuid": "725ab02b-c137-483f-9318-8f4328c451ca", "comment": "Malware payload", "value": "4dce8991fb2942cb8443aba697311072aa25fc61b4b4186a54e7956c2bec6799", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873924, "uuid": "f26dfbdf-f948-4121-9ef8-16f44f27286d", "comment": "Malware payload", "value": "6429a10526d4224e5a9d5e4ab9f71cfa3a1bd460", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873924, "uuid": "537a1580-c412-4ce6-8b49-6890e22d63dd", "comment": "Malware payload", "value": "318058ec2febde0bdff9b2c823a4b31d488eb0bf130620ea8607903692d899ede23256cf8941cb1cd6ae343eb1429aa9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698873924, "uuid": "05749403-600a-4ac6-b87f-575c186a67b9", "value": "T14CD3813E659B21224B3372675B6E6018EB6541275D01B240BCAD429C2FFD96C01BFEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698873924, "uuid": "a28ab2c2-d392-4202-a43a-73692bd6c5fd", "value": "1536:BZUTSCM9Cfq7u02PmUVdGXjXl4xc5KTPBoMqS7j8frPWgtZPnCUQrNgZnFFQE/0c:0T9U7hgaX6eerjqlI2IO6Mzqfpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698873924, "uuid": "c8e59a37-7092-40df-902f-4a1e8863742e", "value": 138774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698873924, "uuid": "3b153bc2-3176-48e0-b16c-cb5526ceef8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698873924, "uuid": "3c71c6e1-a2d5-42b5-9284-72466e0f2088", "value": "gentle.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd6d411-784e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698799031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799031, "uuid": "8c3a711a-8253-4b27-9291-f9b7c95cdfb9", "comment": "Malware payload (Mirai)", "value": "3dea2a15c8f4e0c32bdc40a9986c2436", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799031, "uuid": "eacad3d1-2b37-4e40-859f-ad01ce027c0f", "comment": "Malware payload (Mirai)", "value": "4ea57908834a6edd15f8b4f662b9b8cb5262ac1d0d6ecc5126f95fc6c0707b97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799031, "uuid": "4ea442ed-1ac5-405f-8386-5d44055930be", "comment": "Malware payload (Mirai)", "value": "7a61d8695d557e260724f71a60ff328d876ec36d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799031, "uuid": "c51b7e20-85af-435f-ae29-d8704d172b20", "comment": "Malware payload (Mirai)", "value": "aad6f8f8fa7d5a995d05655ea307e8bb5caf1b4ab01cc02295ffba7b1135b8291b2beb87c5b64b6312d0c24aa2ab7832", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799031, "uuid": "a269e46c-a1ff-4d70-84b1-e8a433e95917", "value": "T1D3435B21BA352E17C0D2A4BA20F74B24B5B517DA26E4C61ABDB20F8DFF211506513FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799031, "uuid": "c78e5048-cd1d-428d-8a7d-1a775b6c5c27", "value": "768:6MCvorOQHgTKrdjkoMTfl3u9y3kwR/7eL2w9vpEjmN4gpywO+EZ/Jh+lV0U6YA:pCvtQHGKrdj2Tfl3B3kI7QbTYfiV0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698799031, "uuid": "24f2f08e-8e3b-4e6e-b064-59943a35d88f", "value": 60500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698799031, "uuid": "a703745e-3d5e-413d-8b5e-254400e0f969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799031, "uuid": "1892510c-7d91-44da-a4cd-844a5578a85e", "value": "3dea2a15c8f4e0c32bdc40a9986c2436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb0c0a9-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819546, "uuid": "ec34e077-7779-49de-b657-7fcb59c838bb", "comment": "Malware payload (Formbook)", "value": "1088af1951819e5a5f119c0430b06aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819546, "uuid": "cb2865b6-2c83-4bb8-be60-378440fc7283", "comment": "Malware payload (Formbook)", "value": "4ecc427abbc3efbeae4fc42d383497728056a76951f5bad56a67002406eaca66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819546, "uuid": "8d9de474-f214-405f-840c-4f57c7727b18", "comment": "Malware payload (Formbook)", "value": "22b95a752b4111f0f488e6da2b09dcbd8aec5a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819546, "uuid": "452ba2dc-8404-43a4-951f-00a301bfe42e", "comment": "Malware payload (Formbook)", "value": "c64a3e8a4847643f61542743d7752788439f41fd7ad5fe9ba1810ce08af52b7b16da51ee291d1e5f61f9b9c56c164ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819546, "uuid": "ab762695-07cf-4462-bd4b-e0a765acc5a6", "value": "T1AC942226C5C5FCEBE6D72A708E3FDA7CE37AC740265140838B147E7729E052BB666241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819546, "uuid": "f99f018e-e911-4dad-a367-ceff680a748c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819546, "uuid": "d8bd2abc-7e6e-4516-9f70-b47b29426d3e", "value": "6144:b8LxBqaNy0dwhrDkgHm/2/w4tuER0HEzD3RdjNlQIe2ed8V7DMfQyVsW2DxN0:XjhXkZOJtxRwU/2eBDMb+W2DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819546, "uuid": "ef943487-06c0-40eb-8213-ad251cefe24b", "value": 422181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819546, "uuid": "0f1e8dc0-0e21-4daa-ac8b-0ae23dc1ee8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819546, "uuid": "8d343d64-f9b1-4b91-9d4a-917a83ac0159", "value": "1088af1951819e5a5f119c0430b06aa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ec3609-784e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698799026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799026, "uuid": "234aa024-1b71-4383-936d-2e10c249dd8d", "comment": "Malware payload (Mirai)", "value": "d90b5135a9f746c28cb197bfd4bbdc9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799026, "uuid": "2799b83a-486f-4963-a11d-c841a6df2da2", "comment": "Malware payload (Mirai)", "value": "4fee7045b10987de256de9618ab443547259a4c6c2363fac25686480ac8ab24e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799026, "uuid": "f0bb3a17-f616-4c0b-a247-c3730d4a59df", "comment": "Malware payload (Mirai)", "value": "ccbf1984fa45a89ee57ae0b3003b0a784a5848bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799026, "uuid": "9b32d3dc-4103-47b7-9da9-8684a7225b1c", "comment": "Malware payload (Mirai)", "value": "a57fdb817bd40472fcaddad476d5fab59596193ac8d91ab8ead28bb288bb37a3262534f397bac52774b2ee6c2b15149a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799026, "uuid": "ba8141a9-7f85-498e-9f13-ca4f4f02a622", "value": "T154B3B606BF118FB7C85FDD7706F94B0128CCB99B25B5673A3570DA9CB91A18709E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799026, "uuid": "0d1e5000-859e-4fff-9192-21de9176367a", "value": "1536:dS/058lrCo7sonMuoovWnAySZ7v48BpgZUq08q1bRfasZHT:dS/05M0oySOk/Rfas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698799026, "uuid": "a9bb3aae-887d-4c53-a63b-f94deab2bd6c", "value": 114128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698799026, "uuid": "c5eaff50-1450-48ca-8e8d-997f8ab03eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799026, "uuid": "c9dd2c78-f202-41bb-a4b4-ce430b46cc71", "value": "d90b5135a9f746c28cb197bfd4bbdc9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25be856c-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854587, "uuid": "be599c81-2590-46fd-a96d-c621b925c6d7", "comment": "Malware payload", "value": "a56ee2359e18930555f5c8ad64a4f687", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854587, "uuid": "ae4679f5-fa9c-48e8-89a0-43f6dd014f53", "comment": "Malware payload", "value": "50642ebf22ca11e488e447dbe79fde6ca704d89361e7b5500ba30b3248f27de3", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854587, "uuid": "d7aa1c04-2da2-4ba6-ad32-3630445d6e70", "comment": "Malware payload", "value": "6b530461f56c0fb0e615ac3a83bf1b2d05bcf27f", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854587, "uuid": "7e282e50-4dac-46f6-aa4d-1083dfa1d750", "comment": "Malware payload", "value": "1c581dc2f92d84adaa52889993b94c5d2f3547b5b4ebb3ef009544a486661eac7ccdbd6d19f09b71c4d09b9ec7116eba", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854587, "uuid": "e14d7db2-c094-428a-b94f-ca96ffd1933d", "value": "T142A35C1952F00166D37957328BF38D1366B69B93B5120F2F8B8B129D1C65340FEA2E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854587, "uuid": "f9cf1d6c-3e3d-4a7e-92a4-11a2cf798d8e", "value": "1536:XEjHcUBFSzTWNec7TJ8epJ9HnXxqv2hvbxFvZP7YfMdWHdr:Sc1iPpnhquhjxL+Hdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854587, "uuid": "c0fc2c55-ac97-4c10-b711-a8f739e6a0ca", "value": 98200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854587, "uuid": "e69dd5bb-796a-4496-bc9c-fdfbd0666536", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854587, "uuid": "3426aba3-1154-490b-bedb-639b133030f8", "value": "Missed voicemail 002.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc7ed5b-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833586, "uuid": "09a1e5e7-33bc-429a-9732-28bcd0bc888e", "comment": "Malware payload (AgentTesla)", "value": "a39b26d2f302c4080fc1a674f693fc76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833586, "uuid": "802f61de-197f-45b1-a5b7-086206aa5f8f", "comment": "Malware payload (AgentTesla)", "value": "50c57233d3be4189fc1d3512d523f2dd6e2dbcdce66193bc7ee341c3c251a800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833586, "uuid": "1b94444a-d80b-41a9-9d59-d3abde7545e1", "comment": "Malware payload (AgentTesla)", "value": "770296e7cd6aeb2ba8366c39687e7e4fc5b20d7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833586, "uuid": "456e60eb-90a4-45ef-acf3-ab6e3ac4170b", "comment": "Malware payload (AgentTesla)", "value": "e9a0153a0ba1163f338120fc8b61f20a192f245418804f942cc37cfec34ee853505bc7ff9f70b49c8271113faf836c58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833586, "uuid": "ec108dba-f3f5-4adf-a04e-c9d7f3de9c81", "value": "T13535AD95E2F1A60DE8DB4A369D3063F4627278137B22E25ECD40E64C786C7D7CAC1663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833586, "uuid": "bdd25339-087d-460e-85ae-a3d941436e09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833586, "uuid": "14c61b5e-e541-4edd-886e-3a55dd2fa7c6", "value": "24576:LXiDAXnIqOrs9qdJm18c9t9NyrOZUuifn6XM2KSOWW3/t90Q7e/:LX5XnbgsAJ8RH9muk6XZKS2EQ7e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833586, "uuid": "b0ddcf3b-d6c5-4a8a-b679-9f6eea29b928", "value": 1135992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833586, "uuid": "58107b3a-063b-48b6-9047-a8c52212ac89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833586, "uuid": "24b3bfcb-89a3-4cf4-8c5f-025dc653927a", "value": "RFQ2610203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6daa64-786d-11ee-8907-42010a9c0042", "comment": "Malware payload (Meduza)", "timestamp": 1698812271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812271, "uuid": "505416a2-6951-4672-8246-8700f9739a73", "comment": "Malware payload (Meduza)", "value": "618f137baf526f754d3ee3885acb9c04", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812271, "uuid": "6c0c8c55-978f-49c7-be74-5ec3344bd995", "comment": "Malware payload (Meduza)", "value": "512ec746b8318aa67bb11aa498a94d0e9848c241e7296c46757dcf1997e28be4", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812271, "uuid": "4835bf08-2a19-49f6-94eb-d491917f807f", "comment": "Malware payload (Meduza)", "value": "a7f29acee8f33eee1b569fc992bdbbe2f413042c", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812271, "uuid": "4dac8d97-a53f-4f69-9021-23ca075b38a2", "comment": "Malware payload (Meduza)", "value": "e1a8bfd8c156f149002cfe28cdcb1bb093256e90a403c3bb93c394f5ae4606ed2abcded7483c293dc182afe033897790", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812271, "uuid": "89b10f8a-156b-4b49-bbdf-446c847bfb3b", "value": "T11EF40934E69C3669D06BA078FC4B5C02E93278AA1320BFEB12D55A511F97EE15F3D360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812271, "uuid": "0e754808-1ca3-4b26-9146-b3ddaf3dd2b1", "value": "59fc3561b97c1724a66e573b2805c788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812271, "uuid": "a318490f-f487-4e30-a3bf-aef2bb55c3ff", "value": "12288:k/Dduefh+bErggggggggMfAF3m5mz1U/uuUtw/8DvC5mukp:mDduz6ggggggggMYF3Imzy2NAaC5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698812271, "uuid": "9b83a17b-db2d-4e49-b5b9-813f6826b5c7", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698812271, "uuid": "6a8c010f-5071-4a32-9871-4a87d73d75b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812271, "uuid": "b0139c2a-1635-42be-923f-3b8d212f6db6", "value": "Metamask_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1018874-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821320, "uuid": "475446c3-f89d-4b53-a236-e8881edf85b4", "comment": "Malware payload (AgentTesla)", "value": "910e25b8f5640b2aa806a53962925ee3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821320, "uuid": "199b9c39-9dc6-43e1-b0d5-94b236daffaf", "comment": "Malware payload (AgentTesla)", "value": "51940b1f28bd57a1465c131e56c52510c0a80522e149cf706d71e5b756bf3f33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821320, "uuid": "f1639900-a096-416a-96e0-457c393288d0", "comment": "Malware payload (AgentTesla)", "value": "624e0f3b870261c4585ee0e310894f53f6fccd2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821320, "uuid": "a642d836-6750-4d67-a8e5-26ef8499b246", "comment": "Malware payload (AgentTesla)", "value": "1deb0ad3e14239674ffc47d10a821570b95c3f1865805d8361a250b71eefa772bdb0cfdcb25db9fdac7193f663880c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821320, "uuid": "a41a15e8-c336-42c8-b212-23401514ec72", "value": "T1CCD4232C095295DDF60B9737BB49542A8003360E757917BE8C9462B8B8CB2D46B4DF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821320, "uuid": "4dfce34f-dd88-4dce-97f3-094dc262ba89", "value": "12288:gqnW6UVgCQr8UTL8kXygmTQx5eVb/Xi27M95S+TP5NBNsUKA9n2CsRwCI/stS:7MgCGH8kCgJxg9XiS6cIhNfjKAMNI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821320, "uuid": "a7718bc4-faa4-44a8-b0ab-e9b03f6287b9", "value": 656115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821320, "uuid": "72937e40-4d62-40b8-9acf-15294d99a174", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821320, "uuid": "3d820234-44fa-4b39-b7a4-1be820b24384", "value": "PO-35723.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96dab18-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820099, "uuid": "2e7b1680-4830-48f4-a42f-bcd355b7af1e", "comment": "Malware payload", "value": "c2a1db4ef5fc17e473d92bd7bf2b963a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820099, "uuid": "d4e61972-3b06-47d9-9f75-bd675e896ad9", "comment": "Malware payload", "value": "51b16d4b6d027af33896a71cabadd650cb4422fb0591dba9bc164fa96e5668f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820099, "uuid": "768bdcca-b5c0-4617-8cf4-671e359a632c", "comment": "Malware payload", "value": "71a569a216280e6e3e8c222a97ef7bc51e79495e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820099, "uuid": "82bc3102-43b3-453c-94b5-4834ca45a1ae", "comment": "Malware payload", "value": "b991ca0d0177d9970cfd76ce97419be5c9cd927af54b2c37716cb9016c881c27bcda9158e9d0537edd5ecef34e4e1dd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820099, "uuid": "16b38b62-f7c1-4660-af68-9c6807737eb2", "value": "T1C9F21F9C725031DFC86BD0728EA95D64EB6078BF831B420BA06726ADDE5D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820099, "uuid": "d0604f6e-391f-4231-a003-b8a29cb22e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820099, "uuid": "c75b3f93-dbd8-49dc-91bd-45b04f814831", "value": "768:WyNPSFY+M6N0ie4F1S4VbVyJsIFYLyje:JN6FY+M+u4iwbVOsIkyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820099, "uuid": "8fb650db-a916-46ce-9fe5-016aba5b6819", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820099, "uuid": "06e81a40-3067-4e24-bc6b-ff4ffdfffef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820099, "uuid": "0842f4af-a00d-4781-bf9d-10610c6ad7be", "value": "Order Item.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6b35f0-7897-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698830387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698830387, "uuid": "911cffcb-e3ee-4bf9-8d98-016e0b756d8f", "comment": "Malware payload (RemcosRAT)", "value": "f26a2f5b20109013af6303c9adc2546d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698830387, "uuid": "d5a4a876-8484-4e53-b957-287e4e4f59ec", "comment": "Malware payload (RemcosRAT)", "value": "52e86b12783755a700ee53510574a5a3d99ecf2bfa5468438a5addef9bfe75c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698830387, "uuid": "37d04123-0fdc-434e-b65d-6f2d469413df", "comment": "Malware payload (RemcosRAT)", "value": "c08296a770478d90efc5c23312a9956a29c59bca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698830387, "uuid": "1a27df8d-c301-4216-b948-e5af28d1c8cb", "comment": "Malware payload (RemcosRAT)", "value": "9a9ab10feed054efd84e749c6b390abe01041ec71c5af62ac23c0b8723ce0ea95bff0d1e885e2c8380d38899609446cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698830387, "uuid": "bc588c78-c70b-4ed5-a72d-d6010b7f21dc", "value": "T11135DF6621F9DBB6C56143F560ACA15FF374560F7060EA548E81E8ED78B0BC089A1BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698830387, "uuid": "46ca746d-821b-4e25-8b0a-72f82ae587b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698830387, "uuid": "96ec1b46-a259-412f-ba3e-9f73aac983b4", "value": "24576:lz4w06LqN1BKv9EQVTXq3oFzYg6qFfqPDx8FV:lcw06LqN1BKv9TVT64FUg0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698830387, "uuid": "c3a82294-7842-485a-85f3-a8912a1e84bc", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698830387, "uuid": "f852b52c-1039-420d-b436-f7d6cf342ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698830387, "uuid": "04e435e2-a5c6-492d-a7bb-ffbe91da55a7", "value": "f26a2f5b20109013af6303c9adc2546d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdbac3f-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820083, "uuid": "c8e5a53b-737c-4925-b48d-94f911d879ea", "comment": "Malware payload (AgentTesla)", "value": "c50dac71ee1745e1eb46fcd23697bd10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820083, "uuid": "56e82dea-5ddc-493c-b44f-1d5a10c2dcd0", "comment": "Malware payload (AgentTesla)", "value": "537edcf644e81dd4ad2f4b34f3bb046386b95d5deb3c6ef4026086d0a5b7b5bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820083, "uuid": "d3927be5-e54f-4dd6-9298-afc593766308", "comment": "Malware payload (AgentTesla)", "value": "1a8b75ad57ddbf9f5610bac21293d86fabb0621b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820083, "uuid": "e72a4bb7-a99c-49dc-b117-0993efef0d69", "comment": "Malware payload (AgentTesla)", "value": "252ec79a1f7d7c68495e1b4e6c85a2ad19df24bd032b2d29f3db4a88bc7b78dc5d39c877efcb0e753fe6c1a047e4798f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820083, "uuid": "543b5f5d-59c6-459f-99ac-2f67cf2771bd", "value": "T1F234CF0632888750C56C347685EF413493E9AEDB3932D7A97F8D77AD05023F3AD49ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820083, "uuid": "cffed2ae-3221-45a8-adb0-f39aa3492fe0", "value": "6144:2Fe2kxMXErD+LksZ5Nt6e+4XmFsCY9BNjm9B6:f2KaLVh+4Xmql96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820083, "uuid": "ed77911e-c680-420a-ad26-06071ece2cc3", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820083, "uuid": "ca8b3345-5498-4c83-9e1c-b117497d1beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820083, "uuid": "002d0efd-d464-448b-b09e-765cbbd21d83", "value": "po278632864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3206a37c-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698821537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821537, "uuid": "b2415925-5f41-42b9-a007-df49d4c9f441", "comment": "Malware payload (Loki)", "value": "a80f91e97aa776a97da9161994bddbf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821537, "uuid": "5449bde9-448e-4a73-8e51-9cf3147f2d41", "comment": "Malware payload (Loki)", "value": "553bf29491be8663337a438c2644c4eb3502b684555975840c6d1e2888bb6989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821537, "uuid": "ec1e83ab-2116-4a6c-b851-d8d8b0f67aa8", "comment": "Malware payload (Loki)", "value": "f50afd4e0c4fcdfb43b31da8bbc749db18abe84e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821537, "uuid": "46e637f2-1d27-47b7-9bbf-34036f2c9f48", "comment": "Malware payload (Loki)", "value": "762add146cf7dd927d8b4df1265c16164c2ae5bdccb507e70bb987b0ae123116010dc9884613a9d629fca2a0192ee9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821537, "uuid": "e36855f5-b974-44c5-a8f5-6d698657b2c9", "value": "T165A412517DB51B09DB78E3FA4BB6C144E7B1111A25F3FB091EC8B2C90AE3B884A5174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821537, "uuid": "5d78af0a-f8e8-4960-9a97-5d099a73ab9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821537, "uuid": "d49f4cd2-8ca3-465b-908c-5f6afa93ded7", "value": "6144:/8z69yqDX7aCw+Ld4rm89Beo7D9YU85zve2kp0/6O3PtcAra2gi4Lkkq:/8z69yqL7aCaLND9GkpwJttqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821537, "uuid": "5194821d-469c-4db2-bc96-e642a7c697ed", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821537, "uuid": "90be3ac9-8ac3-4dc9-aea6-251dde36e4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821537, "uuid": "1630cc0d-fe06-483f-91ba-4508bb5c2c75", "value": "PO-3785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08998e0e-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698833493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833493, "uuid": "6a5873b5-2d00-49e3-8c97-c6a6f7ac7e34", "comment": "Malware payload (Mirai)", "value": "0411e5a34d5fc4d84fd68655ac2ddb92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833493, "uuid": "f0afa01b-30e3-4574-9c4f-42c29a454c0e", "comment": "Malware payload (Mirai)", "value": "555b9db36db9ee7b9d30285789b695cc2a762e7436ba33d064f12da47f1ee7e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833493, "uuid": "00c1fb02-c5a6-449c-9145-d826366909c6", "comment": "Malware payload (Mirai)", "value": "8b9ed29b78c077b92ceb60a6c800608d7eb2cca1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833493, "uuid": "99028104-18a2-4b18-82d3-f406fd0bf0c3", "comment": "Malware payload (Mirai)", "value": "33d41277cfd9294d591cd58b6086941493ca3d7cdaed3dbcf2b1d0d09c478501eddabc532beddd2e1437137823339296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833493, "uuid": "e6e25e6a-772c-4591-8281-0b5c469fa850", "value": "T1FC83C509BF614FB7DC2FDE3706AA0B4924CC651722A83B367974D918F64B14F0AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833493, "uuid": "ba92be8e-06d4-446a-b7bd-b26539654c43", "value": "1536:dR6/O+OJqiDS5wBRTVsyuIJp0nZgDR/VqLZ/EINN:H9JqUTV30nx6I3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833493, "uuid": "7048d3cc-d79c-41e0-93d7-e8bf9f9001a5", "value": 85816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833493, "uuid": "43f1316a-d084-4327-9da3-9f925888a3e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833493, "uuid": "daf86ca8-1bf5-4407-8204-90675ce70c86", "value": "0411e5a34d5fc4d84fd68655ac2ddb92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6b9c2c-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698826114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826114, "uuid": "5460c383-8498-4e4b-9c33-57c5a7812bc1", "comment": "Malware payload (AgentTesla)", "value": "37dbe3ef6e12c4277656f06fe87393c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826114, "uuid": "547bf0de-42bb-42d0-a16b-db10d8b7a71c", "comment": "Malware payload (AgentTesla)", "value": "56201f646915a1f24dbb151b653b770290ca145e163999bc39a874bb174ec33b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826114, "uuid": "8b95816a-2697-4c00-9a46-5023e6d3a1d2", "comment": "Malware payload (AgentTesla)", "value": "b9f4b990e265b149dd422f8418f96fdaa8a26544", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826114, "uuid": "5270afd4-cfe1-48b2-8525-338f41c3f39e", "comment": "Malware payload (AgentTesla)", "value": "604489603d2905627c6b80b3b141d7b0d138cfc21312eb7eeb697b4701b8d6e64581258ee6d60c34005ce214bfece384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826114, "uuid": "51daa08f-8fcd-4c86-b77c-882c6b9bf81e", "value": "T1BA05028D76791FABD9BAA3FAB025640003F5A12EA036F3156EC2B1E77175F800A15F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826114, "uuid": "338a47f5-0a68-4662-b8c3-396da206581e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826114, "uuid": "b053cf0f-d8af-4eec-b3bc-6493ede61a49", "value": "12288:J9oaeQFtdrscF/g+jlNlkoVlKjDUAJOGspJ9rCE4mqFck/Hbwm4I1ljmcFYOS9g2:TDRF/g4lNlkoVlsUGsrUfFw6TGn9g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698826114, "uuid": "ceeea110-bf63-40e8-8723-7f926ea4dec0", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698826114, "uuid": "60559c1d-acd1-4024-a0f9-984b86bae4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826114, "uuid": "6f00fb05-625c-4a94-8e55-dd7741b8571f", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d9195b-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698833488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833488, "uuid": "e4f1f82d-3daf-4da1-a3c9-c078383c17d3", "comment": "Malware payload (Mirai)", "value": "3ba5ef273f78f152f1f9c33e2acb96ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833488, "uuid": "ed3cbb2a-8f6a-4e63-89da-ce813880c9e2", "comment": "Malware payload (Mirai)", "value": "56a2081146fd95492c6f3b5beeb31120fbcd7a8b35c22f8f6c27e4ce835f0113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833488, "uuid": "9c1ed9a8-5264-4407-9389-d9126a3a94ce", "comment": "Malware payload (Mirai)", "value": "89ff8418a6c69a9ad5055263298ace3d44758439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833488, "uuid": "ab2c8aa6-54ea-4934-af2c-a1c0fa291243", "comment": "Malware payload (Mirai)", "value": "053b823b9746c2520720adb5c476fe0313353f32512d27c50423e99569d3cf26dcf443ca5ff5bdcdec98047ccd4e3d66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833488, "uuid": "df7b7e84-c16e-48ae-a72a-e888e77b4a2f", "value": "T18E531A42BC819725C6D1167BFB0E52DE371A57A8E1EB3303CA259F21778E86B0E73641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833488, "uuid": "9679e9de-06c4-44d1-8258-9c44a2c45e95", "value": "768:MXiSNKx1fjr1nQ92IfNFAHFyXvc0AAmUk4tBeMDgn2JVTSeARlhLhFsEvTf:3bjrfIfNgCvXAAmUkEeMNb21gEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833488, "uuid": "e1c91f6e-c773-4587-b9b6-69e940862c4d", "value": 65108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833488, "uuid": "6220775a-5b3d-476d-b89e-4efec3d42145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833488, "uuid": "47721a5d-1e6a-48d3-9303-f2d31eb24bca", "value": "3ba5ef273f78f152f1f9c33e2acb96ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2372fe3d-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854583, "uuid": "ad2a9acb-01d2-4315-95ae-fe460051add8", "comment": "Malware payload", "value": "d79dbd7d106078de352636b3c2b2e74a", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854583, "uuid": "8db13cc1-1e66-45ee-ad8b-8b37b1f4e933", "comment": "Malware payload", "value": "56bab234c32d72be67d6b0de93e797894a7657aa90b21c73adc1a71667f18c20", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854583, "uuid": "69504765-cfe3-4ba7-937f-edcf9be2cf3f", "comment": "Malware payload", "value": "18055dcf87a91143ad6972bf29dad98ef4f59531", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854583, "uuid": "6a907bbf-869f-4096-bddd-eafed941a897", "comment": "Malware payload", "value": "04e2215d660521a9ab8bebe4c5b4122b7907ed1fc91b667732899fde472226c7e5979e0f1d678938f2f770143f0b10d5", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854583, "uuid": "a3d5b720-5731-4ce6-80d0-eaf8b8511d62", "value": "T18E936C2962B00267D37957318BF38D1365769B93B6110F2F8B8B029D1C65350FE62E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854583, "uuid": "3e193fcb-dac9-45b5-9437-1fa76572d142", "value": "1536:excUyFSzTWNec7TJ8epJ9HnXxqv2hvbquvZP7YfLoti:excuiPpnhquhjqY8oti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854583, "uuid": "9ca39396-9609-4ccc-b498-3f00d9972b01", "value": 92056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854583, "uuid": "d34186fc-338a-4510-b27e-b847d0833248", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854583, "uuid": "f23943a7-f2ab-4920-a044-2567201e69cd", "value": "Missed voicemail 001.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcc632c-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880719, "uuid": "d14bd0b1-3aa2-4174-93d4-3cc62e20885b", "comment": "Malware payload", "value": "134056edf59879feb4b29578fde473b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880719, "uuid": "2f16548a-5152-4130-8d22-c76e717ea4cb", "comment": "Malware payload", "value": "56ce24de00988cea4dbb703c01e5fbfc390307f537f791336b42b9db063361c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880719, "uuid": "79b94fac-7df3-4db6-a6ce-1e7745fb4e6b", "comment": "Malware payload", "value": "8f46cd8158c04590923d9d0b65724483f2618455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880719, "uuid": "d7a90428-04f7-46d0-9765-8d97c609a210", "comment": "Malware payload", "value": "d33f39ac1dc7bf01cace6bfff1c1b3d03a2dd1f6e2e68013a5c308b141735b4dae273ddb532705a76557028f0866c55b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880719, "uuid": "55f42956-f9c3-4782-be51-86717ede61e0", "value": "T188355B41B7C4C1A2DB8221714D6BCB6E963FA5635F382BD3AE58372A0D709D0F938749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880719, "uuid": "758f34b1-c25c-4368-b8bb-80029115ca2f", "value": "12288:c8rWbJqL5Xsepcdo7S14zb4nImyw1p9VbrYaiNYfgXp4cmwjA:c8rWlqLNseGOCpnImXtbrjgXp4zw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880719, "uuid": "a17b910c-fa88-4a4e-b9e4-8c428ffe92cc", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880719, "uuid": "59e1afdc-86d9-4b73-b9e1-adb190cc75ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880719, "uuid": "8431ee8b-797f-41c6-bd6a-c741b92d8347", "value": "SecuriteInfo.com.W32.Graftor.B.gen.Eldorado.25825.24832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c65e4d-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855547, "uuid": "435db5c4-af2e-4725-a741-6e691896f170", "comment": "Malware payload", "value": "e62ca1ab3ae22b5e1b13f34b29b6d18a", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855547, "uuid": "b355f81a-21dc-48d1-ba0c-09c2226f3fde", "comment": "Malware payload", "value": "56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855547, "uuid": "1a30c5db-72cc-4eed-a45f-6141e1fddebe", "comment": "Malware payload", "value": "acdd9b5f2b17e3d3b042515d440af94da26686b4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855547, "uuid": "22038b99-1364-465d-912d-7fc0dcaf2d89", "comment": "Malware payload", "value": "44fae1074927d199beba34366b0121a6adadcb8785ede963f16b7e09df4e55c936ac12003cdef6af40a4df36fa76c867", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855547, "uuid": "a2d1d49f-124e-4ab1-b29a-3e6fa9746f0b", "value": "T111547EFE8B03E6545D12FF17A6924293797C780FB188B988F6C7A499908ED37ACF5101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855547, "uuid": "531ba83d-6da5-47cc-9a2a-e3e146cb590e", "value": "3072:iFJlgmtzj27Oxfa2zMQRyp43aiV3oRs6fuPWWn5CWHCSE51okAckR7:EgmY8fTzqa3apfmWq5nTE51S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855547, "uuid": "e02b233f-999f-4cf4-8ddd-6f07ae00f1fc", "value": 297015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855547, "uuid": "63546ff3-360a-4b0b-8fa9-0a5327bf3f6b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855547, "uuid": "fb96f1e7-df22-4842-8c55-263d01d8d7b6", "value": "Atn.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f207fee4-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880700, "uuid": "ef6b3c1b-55a4-415a-8340-1a25b50170e5", "comment": "Malware payload", "value": "fe26a6012d53a1ab592901ccb6c84783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880700, "uuid": "365d0c08-9727-4c3c-9285-0e83ec51fade", "comment": "Malware payload", "value": "571f700a0afa33a8edfbf5c16a15ed0f1378d449483092773f44ea46e50ca937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880700, "uuid": "14d6bdf3-4691-404b-8709-4f0c90e51027", "comment": "Malware payload", "value": "ea7fa550750f617cb9f0712e832ca79ed71436ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880700, "uuid": "6fbe2d5b-5607-4266-b90b-46f8a250ab29", "comment": "Malware payload", "value": "2bd61bd7ce1833c2a9e598268b7469c91020222a3a830bcd7b80ec3f98e265fa996dbbcbb5550a2726d53a2ce148f4d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880700, "uuid": "a9a4ba9c-ccbc-4606-8e5b-09c0be0bafe7", "value": "T1BBD4DFF1FD054BB9DD27E170E03ACD6197AB6E2EA554A54121E2F68B4FE3027843B843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880700, "uuid": "eb33e61d-1ca4-4431-900b-bddf768afeab", "value": "70fdb1cc5a7f08af3dc8a9d56cb41801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880700, "uuid": "61e2b157-413f-47a5-a6e2-1e30e4f741a0", "value": "12288:ZOtNrR+gP1DRv1Ihwj12XfJbOAUuAiAlsj+YGjCgMsT2n57dfQ:Z0NrR+UftyRfJOfiAIGjVMsq579Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880700, "uuid": "4bc4ec6e-af78-49e8-ac35-855a659ffea4", "value": 644772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880700, "uuid": "a86b1be7-36aa-4e48-8a98-f278121766a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880700, "uuid": "d12b6ea7-c7e8-435a-ad48-0e02c8a494d5", "value": "SecuriteInfo.com.Trojan.Siggen1.42086.13664.30961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b9c2b8-78c3-11ee-8907-42010a9c0042", "comment": "Malware payload (Metasploit)", "timestamp": 1698849168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849168, "uuid": "1900fccc-efe3-42d5-a043-0f438345aa91", "comment": "Malware payload (Metasploit)", "value": "a860142665556db513b8afd0c07e2e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849168, "uuid": "2d2a3c67-b9b3-4eb2-a5bf-aec04252bfda", "comment": "Malware payload (Metasploit)", "value": "573b987e635f535bbd97e9e6c9f65ed993af8a32ede1317d11bc6bc4ff406d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849168, "uuid": "e8f51eec-8aa7-4db5-bbea-b97143f08551", "comment": "Malware payload (Metasploit)", "value": "4b98fbaf17ffb69c91a1858a39bb9971ee05f114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849168, "uuid": "c2c21b59-6431-440a-99b1-3f0a13128524", "comment": "Malware payload (Metasploit)", "value": "b3602c59f42aa3ec4d996198179644f19c9c6883114c45818cc33b11d4299b6179d6103e0aa1d19b75eaf09e33079dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849168, "uuid": "85868e18-dea1-4666-8363-24245e4afaf7", "value": "T1AB663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849168, "uuid": "cdd7bfd8-a5c4-46cd-8637-e4824abf4091", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849168, "uuid": "7bffb505-4f28-4313-9498-265eecd5b1fd", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKaz9:kfauN/HYOSIT/EVF9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849168, "uuid": "2e8fa0ef-8d8c-415d-a698-90f7df1a1aaa", "value": 6967160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849168, "uuid": "4568771c-2d9d-41a0-976d-52623a855cca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849168, "uuid": "9a1e7835-3270-4045-9f9c-f5b00a4713fa", "value": "573b987e635f535bbd97e9e6c9f65ed993af8a32ede1317d11bc6bc4ff406d3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c880be82-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698855290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855290, "uuid": "46dd8707-7554-4274-bfed-171416acf58c", "comment": "Malware payload (GuLoader)", "value": "786e24b8d3bb9659a339dcadaef357da", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855290, "uuid": "421739fb-9d73-43e3-9077-d9ff9fead520", "comment": "Malware payload (GuLoader)", "value": "58047fdbe7965dbfd7ae738c287db3d990cd45cf295c0ef3d547493319743af5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855290, "uuid": "3e588420-8217-40fb-94c6-5a1aa6ea605c", "comment": "Malware payload (GuLoader)", "value": "69f94c573b0940ccd446957c36ec689eb3fd453a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855290, "uuid": "068c6568-d785-456e-b94d-ce854cf7da25", "comment": "Malware payload (GuLoader)", "value": "73cbd2cfa3a743b339be87ce0c86b25336a9a79861e59e8c1adb4792de910bebfdd3f104a4bb1850c4761d68e756a162", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855290, "uuid": "70c42869-e355-404e-85eb-41051f67b307", "value": "T180935DF2DB95161D494B27BEDC424D62CD78802E2627063AFFED078DA20B49C93BE745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855290, "uuid": "2df2fe6b-1c3f-4d1a-936c-46ae5d22d5da", "value": "1536:+tWVUKDcxwpcPljwKZJzb7ZvQIk+cWUw7Q2u7dXd1ViwpOFeBvjpy4:8OVcxOc9jwKZ575k+thc2u7xdziwpsez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855290, "uuid": "d2bac9d9-759f-4d34-85d4-b27b23c857bd", "value": 90859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855290, "uuid": "7e9ab36f-4638-4d73-b246-f154caeaf2a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855290, "uuid": "a9da0eb5-a491-4260-ae47-2017a57d6d18", "value": "Ertesito_-_MEDIKLASTER_Kft\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e72559-78dd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698860142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860142, "uuid": "27e309c5-34a5-4807-9603-95fb4d15c5b3", "comment": "Malware payload", "value": "9492841a7eefbce52cebbd195453ab7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860142, "uuid": "c984f701-0809-445a-a10e-098b1ac60543", "comment": "Malware payload", "value": "58a63ea446ddd8bd4bbda56a139157b04997ce2ee7cb36645c4cb0cadf3d872d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860142, "uuid": "60290be3-6b5f-4d8e-8533-8c51b935d48a", "comment": "Malware payload", "value": "c132962a8963fbb0b76a1eee98c3ed42646dd751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860142, "uuid": "b27e8fd9-51c1-40c9-8a31-237dd7e0fbe5", "comment": "Malware payload", "value": "6d98bdd83c535db29a257c45d54255a0d4076a45a3d37b7ae5810b33aea1ecec3a11d88b71df2e895e21e696a15dc0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860142, "uuid": "40661748-8b3a-4e2e-a60d-3914a316999a", "value": "T18E7417C1338454DDDC4FC9F2A0250D758670CA4AA69BBB537C8BA8F73C1A359AB851E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860142, "uuid": "c074e0f9-b2f6-4a34-85cf-79ede36f2c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860142, "uuid": "0ed0b18f-1208-4595-9b07-7c43a5959c6a", "value": "6144:VFDtbqLQ5tbMImueyzBEyhcOPVbVtcN1KXTi:VFFqa6yhVbVt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698860142, "uuid": "71599a07-a626-44eb-b3eb-ee97b5dabb44", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698860142, "uuid": "9374015d-f1d4-439f-8c14-07951ace8e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860142, "uuid": "dd86c352-dbe0-472b-ad90-258ea88207ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e0ab3-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880725, "uuid": "0e06252e-a59a-42d5-84ec-b05ca1a860cd", "comment": "Malware payload", "value": "ba09a96adc280a92f49e28329e4ce776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880725, "uuid": "04b372a4-bcd2-4f35-a36b-9b2142c176b8", "comment": "Malware payload", "value": "5a467cf4b501b889c0da93b9c320607913aa06558fecfb9c5936e9bb7077e087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880725, "uuid": "36cc236f-f269-4953-9bc7-29760767f00a", "comment": "Malware payload", "value": "4e758d12d7d2f119f81b601f6b6e63004b58fd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880725, "uuid": "9ed7a204-3017-4b2c-8d56-2d185ec4146b", "comment": "Malware payload", "value": "6c12cd74dfecda92675fdcce5e0173d3d5e86005d116644de46ae5e857b8009f4990b23b66d9dc07968398e6040542a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880725, "uuid": "882574a3-65fd-43d0-9e40-389ba24eed0f", "value": "T1E11733D292C789F6CDC63F36898B8844DC11167394D268165EF1E69F063EADF0CBA361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880725, "uuid": "0edaf07f-0bde-49a1-9044-67106b4e1f42", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880725, "uuid": "e7544c2c-258c-44e1-a88d-8638882acc42", "value": "393216:QkTTQxVD8VivuspZxnp6MXKsSG06UtB+dqy0t8fb7w+35NaQ:LAVD8VENUN3Uq9t8fnwc3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880725, "uuid": "57243b1f-3858-4b9a-9892-79c289deac7a", "value": 18713629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880725, "uuid": "5939cb0f-b6cf-40a9-a9e2-67c6c00e9e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880725, "uuid": "613dae2d-afc3-453d-93f6-6172c9c7951c", "value": "SecuriteInfo.com.BScope.TrojanDownloader.Agent.4448.3246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9acb888-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698842460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842460, "uuid": "21930113-4295-46cc-a53c-7da791751bc9", "comment": "Malware payload (AveMariaRAT)", "value": "df72ac63e2d66562d21032c3e4d27772", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842460, "uuid": "a9ee3cde-1b51-48be-a9a3-f3456756c21f", "comment": "Malware payload (AveMariaRAT)", "value": "5a6a724c8195e65a395491e429806920b7c6e994bcc6b5fe0c2c3339fabcc4ff", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842460, "uuid": "c39468b1-2d8c-4cdb-95fe-498f870beb4e", "comment": "Malware payload (AveMariaRAT)", "value": "6329f89af2093d5ebb6ce5dcd0dab6e856e76c66", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842460, "uuid": "9d61282c-875a-4b54-9e08-650c3ebd3db1", "comment": "Malware payload (AveMariaRAT)", "value": "c9061eeb0fc811747f5589e6d209fe16262ec20fafcebc75fc3f39eb5aa810edb96256b843c3c02b14a5076400d1f399", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842460, "uuid": "842cd14e-699f-41f3-bd02-beb57eb18ee7", "value": "T1078413B076AB010FF5A690BD07120EB6ADF1E82D2212A97B55D5D72FDD0E380958437E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842460, "uuid": "e5164675-3de6-45c5-86e8-9b2938de6f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842460, "uuid": "af82e784-8049-471c-8798-f216dcc2c4cf", "value": "6144:YZrrQcxdlV/TUB/VfoPJ/KTFWqWR1MqkD5Vo9DllIU0Dj0EdIS4q395eJ+0Gf:Y1dlVW/v5Wz15mVGnIVDo3Ut+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842460, "uuid": "8837d01a-d8c6-476b-90fc-dfa9211f469e", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842460, "uuid": "5fadc8c4-326c-483b-ac0e-8f15cdba9c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842460, "uuid": "94acbf6d-f042-46d0-8ec7-99986d8ecf98", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.11277.18501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73f6ce4-7889-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698824418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824418, "uuid": "36933eca-4391-426c-adf9-2d8298b4b370", "comment": "Malware payload (RemcosRAT)", "value": "8121d5c5601989790f1eff4ec4877d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824418, "uuid": "857fa68d-f95a-467c-9d36-037336ff2a74", "comment": "Malware payload (RemcosRAT)", "value": "5ad88b48598633133d30a79c10cde8860cdf5a2d05ed4fd6227dd4a7449d02d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824418, "uuid": "d977526b-52b3-44d2-89b0-ca4087333be7", "comment": "Malware payload (RemcosRAT)", "value": "71e7c8649e85d7185cd09731a732906d784722c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824418, "uuid": "3bd1cdf2-e50a-4d1e-8c3c-436f6c7a4128", "comment": "Malware payload (RemcosRAT)", "value": "a3b8d260569ed3639f5bb93687f4cb5b49cf52d2aeeaf432dfe7525906f53586c090a26487c517d82853004e43964024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824418, "uuid": "88af324f-53c6-463e-b808-fbeeba7b6269", "value": "T1F9259C176600231BC4EEA8F134E621A7ADD21FE60F84A98757A1BE45F471E03B7E161F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824418, "uuid": "7acee3ad-a0b1-4001-9f29-c5e6c8939ab4", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824418, "uuid": "598a1f0f-f580-42c0-9a38-4b2b43d53e66", "value": "12288:GENN+T5xYrllrU7QY6pM0tK5Dm3FoB6KoOM4b5aMxXieUMyAyakwNEBMw0oR:K5xolYQY61Kd2FoUcJ8eUMoyDwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824418, "uuid": "c9184d4e-96e1-4d70-b5f4-9b34d5510e44", "value": 988527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824418, "uuid": "a82cc252-7db3-48c4-a92f-9081093cdcb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824418, "uuid": "b63c57d7-f124-4143-946c-abdef7455421", "value": "FAT8767890098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21868d36-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854151, "uuid": "7cea2648-ef38-4a50-939a-047bf0c5d2d6", "comment": "Malware payload", "value": "7e9d2dfe67652e5028a295a4840f0b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854151, "uuid": "2a9d7046-170b-4845-be77-cc4d9a523173", "comment": "Malware payload", "value": "5b7021592273b1ba2103fe4e86fc72bbec9503c6eae54110798f769d23941f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854151, "uuid": "ed41c122-c468-4f98-afa6-441eaf2c1451", "comment": "Malware payload", "value": "4654ad538e59cf2f99783595564a7912ec1f98db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854151, "uuid": "591e4f22-987b-4806-a9c3-e638c59feae9", "comment": "Malware payload", "value": "0407063b4bcc6daccf6063b45ce1caf2be82e2449454e64824820d42085989116e7ce841e0f0432f92033670ab713cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854151, "uuid": "dfbc2594-51d5-4a86-846a-35931f3fff39", "value": "T1C5E49C2379F8C4B1D0620A3609BDE61FF5386A1B3A658E8AA340DD7CADB15C0D6717F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854151, "uuid": "415c645b-5647-4c0c-9b39-71d786a6a5e0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854151, "uuid": "6775bc03-14fa-4dfc-8c0e-e269b442c42e", "value": "12288:5ToPWBv/cpGrU3yhpzS5seOtAXhlxSi6l0f5+PluGXcwi9L:5TbBv5rUwzS5s1Axb9S/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854151, "uuid": "3aa96af5-e43e-4c52-b9e3-76bc0d6ec714", "value": 663258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854151, "uuid": "0536fa5a-e5eb-4cb3-9e37-0c158386fbac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854151, "uuid": "1074f8c2-12ac-40a4-950a-ca408a037f64", "value": "7e9d2dfe67652e5028a295a4840f0b0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1077393f-78b4-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698842526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842526, "uuid": "a18b4e05-3094-4a51-8689-112644abed48", "comment": "Malware payload (Stealc)", "value": "c98a1347b79ed081330e81ecba892f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842526, "uuid": "f3048823-9890-418b-926d-26e015105cf1", "comment": "Malware payload (Stealc)", "value": "5c00aa250e356a29b7e0e558d9d4fc76dd9b2a27294e410a0a2c3153bf062e6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842526, "uuid": "bb4fb553-a3df-4400-8c6e-3451ebcc9130", "comment": "Malware payload (Stealc)", "value": "6e78fd91cf17f29f78f623df53bb4a794e3eec71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842526, "uuid": "04a05efb-af4c-4eb6-8110-aab991649269", "comment": "Malware payload (Stealc)", "value": "725071a5b3d7bf9733bf703a9b1511eab638d335ba30c7cbe04aab1362c115d14e6393ee3c12b3008df4837efc5146a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842526, "uuid": "1457ff91-4ed2-4d1f-9290-78f77e1b2e1e", "value": "T187F3CF2577E3C0B2D0B75A3024B5DA622A7B78732731449F37E41A2E4F707C299B974A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842526, "uuid": "2cab122d-7f98-4043-9b37-3cd55d759c3c", "value": "8ed70045ac6ef5b241edfff82b56695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842526, "uuid": "6573cd21-b73d-4fd7-be8e-479aeb54a4b0", "value": "3072:+wXKhSika9R6Yxpsmijx5eegLUWncEoAXxdSdfDaKpU3:rKhrk+R6Yxpzijx5eeKhEBdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842526, "uuid": "61789f9b-ec49-4d54-aee2-6458aa1612ea", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842526, "uuid": "a55815c1-ea0a-4d06-92de-1df084d5963e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842526, "uuid": "ae931eb2-8fce-4630-8348-3e750c83c75e", "value": "5c00aa250e356a29b7e0e558d9d4fc76dd9b2a27294e410a0a2c3153bf062e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61206f5-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698820040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820040, "uuid": "28908b47-c00f-4eab-8e3c-bbb2bfbeec1e", "comment": "Malware payload (GuLoader)", "value": "04de814065c70c53ce0d4b27ad5af2df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820040, "uuid": "ca7ef840-be2c-435e-868a-61f8a69fd487", "comment": "Malware payload (GuLoader)", "value": "5c113c269116ff02e9f9d67d3a7965ff5474c369220857a30213e41c2b82497c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820040, "uuid": "fb707f96-172a-4fcb-8d51-4768f33d085f", "comment": "Malware payload (GuLoader)", "value": "9378a563e3dd76f20b279d647b02c19e280b2d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820040, "uuid": "19e159e0-d516-4b9f-a375-a219b57b5f65", "comment": "Malware payload (GuLoader)", "value": "babe29f7a91bc620aaaf6878659304dd0958165413ffc97cef6aa3a5e42f82b67eae4ea4348b5652ed1dc4ce2313e420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820040, "uuid": "15c8b9c6-7d09-4bf8-b0d3-29d0942cf8db", "value": "T13C65331410BA9CD7D478437016E25F3F7CE37EB59898624267A57B9BD872403E8ACA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820040, "uuid": "0e1cc9cf-b6c6-47c1-aba5-da1d4ca132c8", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820040, "uuid": "a94f36cb-5d22-4006-970b-121ef04f5aab", "value": "24576:jSPQIZ8JYasgNdfwdweDnbdGNcvJWf2yKIkLin3fkm46kuwaZuvRAn0lVbo:8QIZ8SasgwdweNhWf2/Lc3fk62miin0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820040, "uuid": "bfe86892-0a16-40ff-af4b-6ac52e59f552", "value": 1487158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820040, "uuid": "6bff3dd4-fb10-4ca1-805e-0acd3ce14bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820040, "uuid": "56fd5b2a-e595-4bb1-a7b0-5ed87dfdb666", "value": "PO0009-00987890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba744b1-78fb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698873334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873334, "uuid": "e2cf9bdd-40a4-4fdc-811a-9889c6e15fc1", "comment": "Malware payload", "value": "e4335de822e74c57abcd82f7c9648927", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873334, "uuid": "8b5c7040-c2ba-45b7-8458-6a4f3fbe4e4f", "comment": "Malware payload", "value": "5cee8a58e0b41d0f66d361e8a4d410e8a085d5dfedfaa54af7f6b28044ef6092", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873334, "uuid": "d0b27743-0dca-4132-b8c2-6d0b4cfbdb11", "comment": "Malware payload", "value": "277d1b151307e4e6394f4ecc1130bfb9b4dd09f1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698873334, "uuid": "51873a80-7be5-44dd-b706-a0e9fcb8eeb8", "comment": "Malware payload", "value": "f569bc44d29d00ea70655f595b3decfdc8b7b994303b78da1c77e315450538060930c39e8f0d5a69eeb9657abee65885", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698873334, "uuid": "39b46125-c743-42f7-bf0f-1255d3453c38", "value": "T104C533A8E41CD94EDA12128CD089793B1EBFD1D666DC4788D3C58F3CE9DC14AEA087D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698873334, "uuid": "14119bf2-95e0-4a3c-afe3-361956821992", "value": "49152:1MutWdXosMS/6XdekNIhoWhtfOsSiSN1iMebCzeLhnCX7Lp:1ZtEXoJiC3NIhXt23iSNoMnzUZCX7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698873334, "uuid": "31d3c22c-a810-4147-9381-716b8f0c28d0", "value": 2642657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698873334, "uuid": "0683f187-bd21-4ade-93a2-d986130e9d79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698873334, "uuid": "c4c19a96-88cf-4770-84f9-e1468bcf935e", "value": "OverdriveNTool_0.2.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7b8dbf-7868-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698809879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809879, "uuid": "0aaab5af-bac3-4c90-939e-a0d9f6ff3834", "comment": "Malware payload (RedLineStealer)", "value": "3cbd3e3e72635ea641b33fe77996d180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809879, "uuid": "1be85ff6-7164-4769-8eec-f3aba6dc1342", "comment": "Malware payload (RedLineStealer)", "value": "5e28747dd875e98a37142b88afc399cd2298e0943976c542dd8f67c4f5dfd2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809879, "uuid": "d3b38935-15c0-453f-9ad7-5fae0e067e1e", "comment": "Malware payload (RedLineStealer)", "value": "c4c440f08796947f6e8a0fa64fcd4c675901a7ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809879, "uuid": "13b195a2-4971-4d96-a36f-cedc048d5f15", "comment": "Malware payload (RedLineStealer)", "value": "b6e1b5b3827a4298e84239a7762600037354beb95c8568cec987b94d674a64f7652ee599a51c0c9591afc3cb3379f80a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809879, "uuid": "cb6b3e46-9430-4cd5-a8b6-a1e2512d5245", "value": "T1A17523137AE592A3EA7523F09CF217C347307CA5947149EB770AB80A6C71A92A47137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809879, "uuid": "db435d3b-99e0-4578-8e43-8c2845ecb656", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809879, "uuid": "50b333f3-9a34-4b55-9165-ac93e401db49", "value": "49152:YaKW5BKf1AfHE/uuMeS0NX30uOHtZIYoQ:24HEceS0d0MYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698809879, "uuid": "284d6a04-a3cd-417e-ae59-c37bb1fccfaf", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698809879, "uuid": "21d4f630-2ca0-4705-9ddf-6dda1a30b0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809879, "uuid": "42da91d1-ca1c-4498-bdd5-15330e372051", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b525d2a9-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698819609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819609, "uuid": "bd6ef20f-1655-4483-ad23-427920e2db73", "comment": "Malware payload (AveMariaRAT)", "value": "fc0c9923f9560ba48a63f4b9146185bc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819609, "uuid": "ed0bfa1a-8a65-4957-a317-bce10bcf0440", "comment": "Malware payload (AveMariaRAT)", "value": "5e6c6a53ee54271a6191f51ad4933e66dc31680848bd36dd2dfb051f7721bbcb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819609, "uuid": "0e241ec6-d3b2-42d4-b6c8-b3551a7792da", "comment": "Malware payload (AveMariaRAT)", "value": "da985de0af03c9e02b62a6354d6b20fbb6a191f9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819609, "uuid": "b9632a7e-fc77-464b-b253-57dca024a4f7", "comment": "Malware payload (AveMariaRAT)", "value": "bbaa6949a6d62ff1fb48cf56476eeeb26ee0be57605fee41e92234f11fb4c5648fb1352320d304fa6f1072e839dff711", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819609, "uuid": "67445d72-329e-40c2-bee2-f5857470b35e", "value": "T151030D203AFF510CB1B37F525FE575A94E2BF7712A3AA06D2149530A4B63E40CE61B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819609, "uuid": "4d90f74f-0e4a-4fe2-91cb-2e56489ded55", "value": "768:x8njuCupu16uxu8uYuhQnuxuAsa5453ID8u8uYuh5uOW9:xsuQGJ9m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819609, "uuid": "ff01dc99-dca1-4330-9d91-43544ab7e0c4", "value": 38278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819609, "uuid": "2940a154-509d-47b6-ae93-3dbeb7c127a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819609, "uuid": "bedb1dae-ad99-4626-b653-62990c019cac", "value": "Egypt Airlines Sales Managers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689bd0e1-7902-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698876174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876174, "uuid": "9f177ec4-6184-4559-a385-4e3674bb3be6", "comment": "Malware payload (Mirai)", "value": "05d1d8797ccda4a8701428119cd66ef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876174, "uuid": "075a85c5-ea9e-42fe-8357-40e2b4d59aec", "comment": "Malware payload (Mirai)", "value": "6021d4a24b32fde6652012e1d66f94ec034c66c42597424722a04eb801d2496b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876174, "uuid": "97a39fa9-6437-427d-b87c-a2b11cf12c34", "comment": "Malware payload (Mirai)", "value": "cc07ea1c48a1b86a154e1ac33d0a953c5a205a72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876174, "uuid": "2a045b16-a923-4ca3-889a-19c50bb7fb70", "comment": "Malware payload (Mirai)", "value": "e150dde0ba0642567ab9b720ad9bf84c1806582a3caf3e753f7ce16345048c170b155729587f67a5232ef6e422753925", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876174, "uuid": "c798a458-fc18-46cb-881b-09a33a589e35", "value": "T14EB3184AF8815F11C9DB22BAFA1E018D335357E8E3EAB1129D205F2477CA91F0E77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876174, "uuid": "1b74a539-ae24-4258-9922-db0d4f726a4e", "value": "3072:cslYrLZxVQksuEJa5Pet4tx9+FXuB2g0DwbZn9:llrk8Ja5Pet4L4FXwewR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698876174, "uuid": "3020d217-9122-41b0-b0ac-d14b015bc2a0", "value": 114144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698876174, "uuid": "e7c50634-f03e-4a3c-959c-506f93e38765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876174, "uuid": "8fe7d529-6ccb-4e7e-a177-42b15d9fa6e3", "value": "05d1d8797ccda4a8701428119cd66ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668099bc-7902-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698876171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876171, "uuid": "39a3e718-637a-4608-a815-63e92cc454ed", "comment": "Malware payload", "value": "e180f6f446de6412c02a93dbc146dcfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876171, "uuid": "e4fdfaf2-fe70-433d-b0c7-2ed8fb351d9f", "comment": "Malware payload", "value": "603f3a6931021693f1c4bf5477fca99ee9db3af6668f8c62c9baab7d9980a23c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876171, "uuid": "b2ad70bf-85c8-465a-9f7a-1d6d77f0cd92", "comment": "Malware payload", "value": "9471882dd50572d3c7ead4d4c75cbd3434ebd737", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698876171, "uuid": "55382b2a-3b67-4b93-b392-1392a24dbedc", "comment": "Malware payload", "value": "3c93a96eee2d70e17aebd5a553d487f9e1e37e88d3711d689913e2058ecb08fad3eabc834fa8c2cc45a81a04ba9e4e6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876171, "uuid": "add550cd-c338-4af1-8f01-0380871c5ec3", "value": "T19DB3D80E7E228FBDF7A9823847F74A25B65833C53BE1D541D1ACF6015E6024E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876171, "uuid": "20d9209c-d72c-429f-bdaf-dc93e6cae2b3", "value": "3072:4n+D9GOp3EO4vM+s3zmRvDRo9EGOf4kwbZnv5k:4nqGO5EO40+TRvDRj7DwRv5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698876171, "uuid": "929efb1a-38c5-4c20-9606-2d0a21535f12", "value": 108528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698876171, "uuid": "d43de1e3-1719-488a-a0a4-6174ef4561eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698876171, "uuid": "63a21acb-73a8-4151-82d0-77c8468d3f98", "value": "e180f6f446de6412c02a93dbc146dcfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d4e9c5-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820061, "uuid": "19ba1ecf-edf4-4f3e-9cdf-32ca4189e414", "comment": "Malware payload", "value": "488cd0c21974d76054d33936d477e0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820061, "uuid": "e9f806a8-d41b-486e-8bdc-724a803480ef", "comment": "Malware payload", "value": "6049ebd2d0d4238690c57ad4928ad638d26f1b19de398820e12e3bc86f874db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820061, "uuid": "d179a7f9-1521-4845-a1f9-6ea6d490e91e", "comment": "Malware payload", "value": "3b9a70a4aaf40b1bada8c337801e35762f9207d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820061, "uuid": "4598538e-6b34-42fc-9d9c-02ec8bd696bf", "comment": "Malware payload", "value": "2d00a2870210d840c8db54c6d100b3a434538441def9ae5c5f5ae5e2d6cf39605aec1b31153c339cf7703c58bc4401a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820061, "uuid": "f2bc6286-1dad-4570-9c82-7ad10360edc2", "value": "T13E538D2477975826C7AE293410D687250730E7CA54E3DB8E31CD73168FA33E25B9B68D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820061, "uuid": "39ac63c7-506c-45f5-83a9-b2c6ad575e0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820061, "uuid": "0377677f-4b5a-4adb-8f30-647ac05d83d3", "value": "1536:IX8b/k174ajchuUyj4m7TPxdFP75Fbnd3hT5:IX8bhaghrycmfxvPXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820061, "uuid": "6b23c247-62bc-4544-a231-e8ea1d105947", "value": 65088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820061, "uuid": "df5f2961-fc2e-4d5d-8950-20b80ab265f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820061, "uuid": "3304ee5e-ac92-4cb8-af23-bf800c191900", "value": "PAYMENT RECEIPT STAN100699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f564c5db-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880705, "uuid": "ccda28f6-86ab-4e5f-a40b-d651861ff3fa", "comment": "Malware payload", "value": "349139f03edcfb2489c37fdd73e88f84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880705, "uuid": "ef22fea5-1c93-4b16-8840-dc8962166f72", "comment": "Malware payload", "value": "60fa9a8cbd9e16beb1be777554e76a5417a3549e6e0782046f3b8bad598c0f00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880705, "uuid": "5c6826f8-5e70-4680-a137-836a8f290104", "comment": "Malware payload", "value": "574e9b5dde48c074286012bb79264c8b93e75400", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880705, "uuid": "85e0f0a9-4004-4134-831c-c1c833a72f6a", "comment": "Malware payload", "value": "b53d3ba27c1edec044b12a3ac2dc7ff2825909d20dc11d7983fdd43278943b0a162f460a12e4965a9fe96cdc85405da0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880705, "uuid": "53477c45-6946-49cb-a1b3-428516ee7b2b", "value": "T12AB44C0A7592E92BC3390D33489AFEA4AA53A8514C78867B3796D34DBC333709D771B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880705, "uuid": "95fb5159-4f16-4648-915c-0fe06fdac809", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880705, "uuid": "e00b86d8-73fe-4a7d-bab7-30716901d9e8", "value": "6144:+RR5rhZFQGrsUwF7vlPoSTKrXz0tTCGY:+R5nWFpPoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880705, "uuid": "0a001d64-2022-48a5-97fa-66bf8379c38f", "value": 532812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880705, "uuid": "6dc9135c-abfe-451d-9a58-21c93eb88cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880705, "uuid": "dcebf82c-314e-40e5-b4f0-ee01b2c69222", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.28191.27528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b872ee48-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698820044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820044, "uuid": "5f9bc2db-c87f-49da-ba93-5002e8993547", "comment": "Malware payload (GuLoader)", "value": "bc7273d0803b53eea43a79a924b0d173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820044, "uuid": "bd50e7b3-51ab-4078-b0cc-f49d2b76a7e4", "comment": "Malware payload (GuLoader)", "value": "628f832ed4f97ea3143ed6503c9b4aba51cbb9daf13c639eb503c01cf172d770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820044, "uuid": "cf15fe8e-ed50-4de4-a968-3259ade7b40e", "comment": "Malware payload (GuLoader)", "value": "a489b8a51cf2c09f1e2a776f39e98c293d6cedaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820044, "uuid": "97f26571-3bf3-45f6-be2e-217d1e90c6cf", "comment": "Malware payload (GuLoader)", "value": "f95c16244380b55bb5fc6b9bbea51f89df0b0f4c64956e811eea4eb34cc0e9558a03591b01a8d2160dffeead76f8fdfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820044, "uuid": "c1db07ef-4f96-40ac-89a6-83befdc5ec68", "value": "T1C965334011F59DC3EA70427056A3DF3F7DA37F6BD955621713EABEAA8936002E41860F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820044, "uuid": "bebdb6b6-b697-4d24-ac4e-02f4acc40d35", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820044, "uuid": "f70bd027-7175-4310-bb18-df8c78d9ca54", "value": "24576:j7R5B3jtN02jYN6dweDnbdGNcvJWf2yKIkLin3fkm46kuwaZuvRAn0lVb3:nd3J/dweNhWf2/Lc3fk62miin0lN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820044, "uuid": "34ef8a79-9f16-4043-84ad-a22538bafaea", "value": 1503033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820044, "uuid": "f0024f65-0253-48d1-992d-73368689a445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820044, "uuid": "15f94678-3413-49b5-ad97-97c6cd68f9e0", "value": "FACTURA0986890009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bbddb8-78b4-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698842805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842805, "uuid": "77ba17d0-2e1b-412c-a070-a8a63eea27ef", "comment": "Malware payload (Formbook)", "value": "5add408397e9c91312e326759f249bca", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842805, "uuid": "5a63f4a5-2bcf-4ece-8c93-6ad2c2e66a00", "comment": "Malware payload (Formbook)", "value": "6334b6f0cc9327a8d249b876177973cdad16ade45ef0aa5cc7c06bb862eb6a0b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842805, "uuid": "863b46cb-e440-4cf2-9dc4-9586b8362d61", "comment": "Malware payload (Formbook)", "value": "0d6d092623f723f79be560aaba4e7093317302fe", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842805, "uuid": "71d35cad-4242-4b35-a6aa-4627fdb091ff", "comment": "Malware payload (Formbook)", "value": "80633447f877280576263aefee78fad3749c96ac6627803edc90878b3a9fa862df274f5ea8c74f53c09294551e090a6b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842805, "uuid": "cce9b0ee-7d7f-409a-b9fe-548a06c64e6c", "value": "T16375AFB875047DE6267F576BDA96ACEC03B61B639ACBA4CC806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842805, "uuid": "589f4e48-a2d2-4536-94f2-0474d18f6a57", "value": "24576:00U0Oxo9HQFfmMoU9FxOEQjGbdEAugLnvWF4grKX9uoCzuWWd+JRhG/ih+byRPce:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842805, "uuid": "7d25c340-843f-4e0e-99c4-6b55b6fae887", "value": 1698354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842805, "uuid": "4df0d670-7fc9-4518-a096-c1bd9f3fb57b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842805, "uuid": "f48ff94b-e647-4a29-85c6-774baf39488d", "value": "TN81804BM.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28763db6-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698854162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854162, "uuid": "00e989f0-74cc-4639-a017-d05438187af4", "comment": "Malware payload (RedLineStealer)", "value": "25ff8c2550e5093653c34a6325d5d4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854162, "uuid": "a1e3a6c2-6af8-4bf8-b2d3-7ebf49360534", "comment": "Malware payload (RedLineStealer)", "value": "634059b07462491cd2044802a208faefd0b9c30dd7430ea7ecaf1a44e7b6de58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854162, "uuid": "35954dff-7962-4378-8a99-c3cdce8d4ccb", "comment": "Malware payload (RedLineStealer)", "value": "f672bab859f612bc7057656f81ca4218b26b54fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854162, "uuid": "bf702fa4-17c0-494d-94ff-2ea5d6bdfc8a", "comment": "Malware payload (RedLineStealer)", "value": "9a326972bc6d3e32c01b541eab6c801babe488702726571f1381e28626e114f4e5709dc79e9ffb52ec68a18d068c87d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854162, "uuid": "124a8a9c-64bd-4aae-a16c-1c7f3e1d1932", "value": "T1DBB4AC2321F8CAB9D4640BB101BCE62FF2791B5B71249A569A14ED6C3CF26D0C4B1BF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854162, "uuid": "51046e73-d3f2-4b20-a42e-b9e8c618227c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854162, "uuid": "7272f80c-084c-4925-8ebe-8a3891a631e2", "value": "6144:2lidI8C4ufWy3RPjtAroV38WQ/pl1vG5LTNQPGm4H4zsbk0m2j5wRym6NI/I5:2kd04ufzP5ArobYfsLhQQH22FwRyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854162, "uuid": "1a0c6e2f-6737-403b-ac0c-f2334b630d2e", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854162, "uuid": "59de5106-7c4b-40c1-bbb7-0d5276729f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854162, "uuid": "eff05aec-c58e-4fd2-bd69-950cf798c1f2", "value": "Purchase Order1187354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdf5920-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855566, "uuid": "d4d08856-bff0-47a9-8dac-0d1091c1dd37", "comment": "Malware payload", "value": "8fe7dc3af5c74bf43f6a7a20ad88fa0d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855566, "uuid": "ea32b560-a9a3-4f1b-9cfd-20485b07c3ea", "comment": "Malware payload", "value": "63b3d18919359d1e4d0bd8b325d71bd3d72d6d0c10e84659b188a53a4948792e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855566, "uuid": "08370b22-a9ef-457e-9eb7-da84690a9590", "comment": "Malware payload", "value": "fde1579fe21407b14c803ce472d39dece44fa640", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855566, "uuid": "3f6a66d3-f036-4aa7-becc-872d5d87a7e0", "comment": "Malware payload", "value": "2eb86a0b24ef5bb1a79aeaa8cbadb952dfc06204d0bc1f034ccaeefb9e72ad51c41896e53293ead5664ae1717a6f17aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855566, "uuid": "4b94f7b7-2fcd-43b6-9764-d7c119c38dac", "value": "T14FD36C44F25132B959EF737E287F23069737A65574168429F07CE2F05A2CE4A5233FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855566, "uuid": "43d8658e-3cc8-4e91-93e2-519a53527173", "value": "3072:0BUKp+VzLz4MYcAQY6/0I7tPRx6PFWgnUpDRPVlKYPg2vb/q:6U6+V74MYcAQY6/j7t6n+tVoYPgeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855566, "uuid": "6b090f89-b0f1-42b8-808e-8e5f38ca598f", "value": 136753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855566, "uuid": "2fd911d3-d23f-4a23-9a6c-6bb9da2372f2", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855566, "uuid": "35bf388f-36bb-411f-817b-e85b615af5b3", "value": "expedita.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcbdb3d-78ce-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698853983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853983, "uuid": "213e8f1b-fc6a-42ef-9c8e-50e82575aea3", "comment": "Malware payload (RemcosRAT)", "value": "91dba632832725348774e1559d5a457e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853983, "uuid": "f62c8d7a-9a6e-47cd-b2b1-3430292a82c8", "comment": "Malware payload (RemcosRAT)", "value": "640edcd4eb6616347387a6d6a22d7ff623e3702aaa40831fd128c3f9e1a4a414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853983, "uuid": "471d92ba-2bb9-4414-9494-0cac9b6c23eb", "comment": "Malware payload (RemcosRAT)", "value": "bdaf538fd32cbd4860d468726dffb3ebb422139a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853983, "uuid": "3388039f-7915-44c9-975f-c09b98b5fca4", "comment": "Malware payload (RemcosRAT)", "value": "1eec4b4b81c436dc1d06ba9bbd1025199e4bca38354153e78125367beb9537d25e4018322b15f236051d4c14b29df561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853983, "uuid": "cd0e2790-565d-4eb1-bce5-1b40001c22e9", "value": "T121351290A2EE8B76FE3853F51129A6044BF77C2B7076E3495E9274C221B9F001B46F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853983, "uuid": "b6c91cf6-a2d3-4b7a-9494-1d5c046c8b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853983, "uuid": "faa88ff2-1b56-4b7f-a84e-4d5b80bd3cc8", "value": "24576:eEvuo1jfG6PduK+qFv/REuCQMHg/nS+INNTJaAWHUW3p:eA3bdD+qJRRyHoS/NNTJu0Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698853983, "uuid": "e7da563e-c3c6-4e3b-9eb2-a52d7b14b951", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698853983, "uuid": "064cba90-67c2-47f4-9b32-dab07475fede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853983, "uuid": "377b9d46-e608-4c44-9460-14d7f93a04ac", "value": "NN5WSpobMLs2bTV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef80ff9e-7889-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698824431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824431, "uuid": "8ca9ea92-52c4-4544-a484-26b88dd171a3", "comment": "Malware payload (AgentTesla)", "value": "f617d090d5f0ca80a0accb2820a54e4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824431, "uuid": "697d5d3a-337c-4c6b-a0de-af627be1eea2", "comment": "Malware payload (AgentTesla)", "value": "641d142d2c9179a273816979372c591b714a206547f80ca61d8a762b00ac9bfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824431, "uuid": "1ef1d323-0c51-4d85-9b3b-b864eac782d6", "comment": "Malware payload (AgentTesla)", "value": "9cd9863b643c8af5ee1ba2da2db604d494bce40f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824431, "uuid": "c60e6b58-2f8a-42a8-b605-6c6c60c3c665", "comment": "Malware payload (AgentTesla)", "value": "4e949a532955cfd8aa5b47d952529c69ac13b2d54adaba1e2c4fa0775438281001f37834fc02cdc786532f5e7778604c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824431, "uuid": "11629542-8824-4d0c-9c84-66ce0c331584", "value": "T1EFD4234623E88311E97DA3F6A5B0BE20A3B092116459D3589ECFB1C37FB1F9409B9D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824431, "uuid": "bf055032-fc34-4de1-8a55-60016f117f1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824431, "uuid": "68c558ff-4082-49ea-b86d-8970f9fc1be8", "value": "12288:t5Osoa7w1uwb+IhQvbwm8bUI1MKee80ADze0SwUDifw2i6wox6Z+dipEvy4jf:tg31uljYIIi9Qb72Rwox0Eii64jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824431, "uuid": "acdd81cb-79e4-4f24-9363-94de1b03c469", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824431, "uuid": "69be7551-17c0-4ef4-9c1f-9de091951e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824431, "uuid": "8d62f4b3-6097-486e-8bb6-d1e3c5e264d2", "value": "Requirement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63d7f18-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820094, "uuid": "cee62eeb-41b8-4e77-a395-0a9a89e3835a", "comment": "Malware payload", "value": "07f7c01e1639abe7b706b0a5118429bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820094, "uuid": "565eefe5-1968-4fcb-9a5d-cae800b7424e", "comment": "Malware payload", "value": "6463a7cd190a83e8dd97041fe89ae6d3f6a3543b2ef4d289ddb2819e014b0969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820094, "uuid": "02799bd4-0128-4d66-9747-27fd013f199b", "comment": "Malware payload", "value": "6a1b86f7567d033f0d4fc811e9e0755180b83268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820094, "uuid": "c257f082-9c77-4302-bd0d-8e0743369101", "comment": "Malware payload", "value": "024222553c9be47dc0455c81ca2ec61d628235da58ae11de8a266eab69c48ef0eef7a7c54f49dad13a5939d695004160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820094, "uuid": "52fd429b-f65b-42dc-92cd-909feb1d4909", "value": "T1B6F2109C721071DFC867D072CEA95D64AA6078BF831B4207A06726AEDE5D957CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820094, "uuid": "38bd11ff-9bab-44c9-8111-89e44d39f6d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820094, "uuid": "1b382451-8759-43f4-9337-3064a9e4ec7d", "value": "384:X9DN7JEa9AiAR55DFoHbCMOjT7HiVQ4LTtxd0emje8b4IUXxLYbjmjed:tDPEBvn5+7CMkyV7dxd0eELyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820094, "uuid": "f45cef8f-c2bc-4d1f-87a2-6562cab48c5f", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820094, "uuid": "968c4337-c0b3-45cf-8765-bac9dab61f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820094, "uuid": "b93c8fed-46c1-43b9-8a81-1ec864f1802b", "value": "RFQ___7252023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dcb357-78da-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698859064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859064, "uuid": "d0568404-9dcc-4d34-80e1-7ff3da6c57c4", "comment": "Malware payload (Formbook)", "value": "83cdb597d20acd75dd60840276ca77b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859064, "uuid": "9bf7dd7c-9b82-41d0-b76a-213d930e63d7", "comment": "Malware payload (Formbook)", "value": "6467245f6d186b2dd54ba139a2bd8ea38cafe83952d7c20cd0937c53b9e9cb6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859064, "uuid": "8b547e9c-5bf8-4e82-bb32-07fd44d0798a", "comment": "Malware payload (Formbook)", "value": "205aaf9be50212332648bc7011213d7a8cdb28f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859064, "uuid": "1b2c6c76-e185-4d4c-a59b-f47a98bb8cf0", "comment": "Malware payload (Formbook)", "value": "655b5c298875d145a98ad19e03db60254b0b98482bb25e7c419fca61fb2474eb7d912f84b11a8dea18091558083d3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859064, "uuid": "9f91dc4b-a79f-4b16-b414-67abb7528880", "value": "T108F4024972796F67C97B93F9B410A40003FAA96E6161F359DEC671EB1278F804E22F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859064, "uuid": "ef8b8f29-d76b-4a97-b79f-559783f8672e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859064, "uuid": "bfbaa5f2-f799-4a55-92f6-70adae1fd5e5", "value": "12288:Ko7Moa/qeHS7zlYhIMDDqfjnudL+qHdeigNVzQAqSO1QJq9f6M6R:BgqeyWIMDDMjG9m6SbJgl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859064, "uuid": "0b2f72db-984b-483d-ad03-90a05e0dd315", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859064, "uuid": "0fe83f7f-c577-4a78-b7b0-c4bc29390d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859064, "uuid": "38d14514-fc00-4577-a77b-c3ced585ebb7", "value": "83cdb597d20acd75dd60840276ca77b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4871609f-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698825869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825869, "uuid": "48639cda-80c3-4e80-9af0-4d8737b6e313", "comment": "Malware payload (RemcosRAT)", "value": "1197e7a27b14835cf1acf9c3cf35ca74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825869, "uuid": "93d02835-dfdb-4433-bd87-3b5d266a68e4", "comment": "Malware payload (RemcosRAT)", "value": "659af6c54d31cf15cdca40c29959c160e47e65254f178661f98807b649fdb596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825869, "uuid": "7cace06f-b1ed-41b8-9ca2-02ead5d1b2f2", "comment": "Malware payload (RemcosRAT)", "value": "774d345b00e8dd09732bc8a01a4208e76e5a62dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825869, "uuid": "69f2699e-d649-473d-91bf-a9b7568a87bb", "comment": "Malware payload (RemcosRAT)", "value": "395d4dc6008c1c10966b4a054ea3948b4ff8ba036b4e81f9d48a1c4d71c384dbd7aa4160eef660f1d609cba5fcbdfc53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825869, "uuid": "9a657bcd-e86f-403a-a873-0cac7a647de6", "value": "T1078423DA31F0C5B3E57342720DBB9F7DE3D6AAB88290868B57983F3645A0607DD0D192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825869, "uuid": "8ce10afc-3e35-41f0-8b85-a1b9e69f7e71", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825869, "uuid": "bbc3ef3a-4e9f-4491-9796-44c9fc922c0c", "value": "6144:h8LxBnEhX9iCpLqrCVyMshjXlw6Nr1sOfiFtDXW/c5Q2Q56NGEi6uRFqFYqjyHWq:sE+6BVLCrXiFthhf43zq2vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825869, "uuid": "4f0d116c-d659-4bce-a88b-00f2e5a9e7d6", "value": 406259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825869, "uuid": "33d45bef-770a-493e-bda0-800ec068de79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825869, "uuid": "5687d7d4-291a-4b5b-a5e9-60899bddbaa8", "value": "87654345678900-98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05088ff5-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880732, "uuid": "21c25c4d-dea7-4d31-879f-6c7b5236e949", "comment": "Malware payload", "value": "488c5a3d35cd4633e2151dee80993cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880732, "uuid": "56b8d574-181e-4fd5-bb48-d86945618770", "comment": "Malware payload", "value": "65c4cc5bb69984cbb4ab387d3fe7c73dad32c3415289d7a4d2fd8dcfe4080ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880732, "uuid": "3903038f-3647-4a28-971a-9e6ca35cad62", "comment": "Malware payload", "value": "c849bf7d1bcaf964a42fab31a6206ee31a327861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880732, "uuid": "34a42d3f-7f7f-4bf8-9992-8db3ab994eaa", "comment": "Malware payload", "value": "f99b33d91598655751065004bc905656a0e4002cdeb8570372d1ed410dd747d16dfafeac34382fd7c1bd1e9f021f6272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880732, "uuid": "95e2b42b-962a-4293-aeff-fff3f47766ff", "value": "T1314533951ECEB0BCE8161AB3859AD05FDF2D9D32052DD682E37423172422B501E7E9FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880732, "uuid": "93b8f6d9-dd54-4ccc-a125-df8220836ed4", "value": "a8a6bd55c771aa022ff8ac8dab80dc31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880732, "uuid": "7570badc-a68d-4fb0-b7a3-2bc039fe5e82", "value": "24576:GNfTOycOy32bUzakwA3yfEgGiaKwB4GALoAlxN+6NROI5plp:GdKCy42dwoyfE+asGMxxNlBplp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880732, "uuid": "9de8cdae-db40-45b5-b433-620a78b93bba", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880732, "uuid": "2ff75886-310e-4b77-ba2d-1356e40117c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880732, "uuid": "d7f40f92-604e-4637-8f97-c50402705a78", "value": "SecuriteInfo.com.FileRepMetagen.3514.4839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e9e454-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698855227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855227, "uuid": "d02b1f7a-feaa-45f6-8231-d32323611c12", "comment": "Malware payload (Stealc)", "value": "430143f995ce2e934f8021528f1a5c9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855227, "uuid": "e491d609-ca01-4244-9f47-79b5fbaa6469", "comment": "Malware payload (Stealc)", "value": "66467375d604cb25ddf27d225148d50f47c7f1fda23d561cc8325aaf1ff7a30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855227, "uuid": "41b3d2e4-10ac-4413-9133-936f72aa8b86", "comment": "Malware payload (Stealc)", "value": "a0423b7428a9c6a4af9231e6d4b47842c0d09bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855227, "uuid": "0bf08e77-876f-4535-807d-9bef3cd4a7ae", "comment": "Malware payload (Stealc)", "value": "fa15cee1fedf660b0f90831556fd9553b0056afba7832286ccb47669f2265671f91ce0903d4e155f41ebea62cb1cb63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855227, "uuid": "7a05eac6-dc9c-4c52-8251-e07661f0469f", "value": "T1C4246C1352F16C61F6274B33AE2AC2F476DEF9608F55779B22549E2F08712B2C672312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855227, "uuid": "8aaea01f-4447-41bf-9032-573e9d41a53e", "value": "deea862cde3076f248a80e5759ebd886", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855227, "uuid": "375aa1f2-2a5b-470b-9e0c-947337346921", "value": "3072:Mf+o9ImiTzzSyhNwAxOTkDExzl27jNa+PyRxBx/6C+tyKS/P9A17lAoLjguk:JokzzScOIDazMhNyBxHPKEk7moLEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855227, "uuid": "1ce37399-67b7-4cd0-bb8b-6b748cf41032", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855227, "uuid": "7d1d10f0-e487-4ec2-9eb4-57afb56c7109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855227, "uuid": "360d00d5-1eed-4619-bc9a-c494b38607f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d9276d-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819827, "uuid": "f4e415b4-9d01-4a7e-aed2-94e64da64184", "comment": "Malware payload", "value": "bc71d0fdd464d7aad9d1286e0c590c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819827, "uuid": "70290362-0048-4d15-8396-13a06bc215d1", "comment": "Malware payload", "value": "665f3577ea46e3b5ed1054835de4cd9b7982bc6913a0c74749a38c22b3c0474d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819827, "uuid": "4fe7c928-2d6e-4a55-8c7a-a1ddab233bf3", "comment": "Malware payload", "value": "a867caeeeb57328f5089a064180ba19aaa4cc818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819827, "uuid": "6da48cbc-ac82-4cc4-86fe-e2595807ae95", "comment": "Malware payload", "value": "36c21cceb7326859316964ff9857997ca733df0e4e532485e72d2d9d07ad21e6703b7e4e6d545a0102ce5a494edffa05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819827, "uuid": "0fb38a38-30df-4e90-8bde-bad9ecff421f", "value": "T102B34B0A258B6615C8987AF494F2541603B2EEC32273C28B7DF87A554FB2743DEC678D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819827, "uuid": "bc74d614-47cd-49de-96a4-92800fdd8750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819827, "uuid": "528a1035-d994-4241-9860-4a2816c27550", "value": "1536:Qg+MxvZIpmu88VumuNUhbFC0f8C93ak7630VDF97TPxdF8o75F943hh:3IMu8YucbF7f8IahEVDF9fxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819827, "uuid": "377b6bec-6b30-4866-a16c-08126480f832", "value": 111176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819827, "uuid": "9d55dcad-dd07-410b-b324-6233ad8664a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819827, "uuid": "48865035-d523-4120-9de1-f88480339075", "value": "PO_328172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45dc4c6-784e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698799046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799046, "uuid": "e3bd25a0-d024-492e-bd88-6848b81250ac", "comment": "Malware payload (Mirai)", "value": "a4cf233e1025ab010ef1bf0d5212053e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799046, "uuid": "85df43f1-0adc-4c2d-9c2f-88eb04a04da6", "comment": "Malware payload (Mirai)", "value": "66776fc7d7a76100869a2738b9b450b0adc6616f02b48f856f31e35f19c89e14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799046, "uuid": "ccc2d1ef-2649-455a-8059-a6858eda0fa8", "comment": "Malware payload (Mirai)", "value": "87cc63a325668e64642bf73de70f5f1996c3531b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698799046, "uuid": "f36a11af-04e5-48de-8194-d4d807a66371", "comment": "Malware payload (Mirai)", "value": "288c3ea1dac60929c12af49d241bc906cdd3e1e81f43ec1a5d99b94715ab46c20fe88332ef3730525c41104b2283a42e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799046, "uuid": "36d4d1f1-cdb5-4049-87e2-12e4f96d7819", "value": "T16443289BF8019D3DF40AA6BA94274D0DBD3063C113830B3667A7FEE3AD721695C52D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799046, "uuid": "4fe7ba34-efb0-4979-943a-fb58451cbecc", "value": "768:yUeGmdS2VqXbQUHA3/J3Qflu11Jo3M6ud7CyHEbz2XO8Sl0WnU89yAWyQN6gHxWV:hZ8+w7jkbz+O8SuWZ9yAuN6A1rLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698799046, "uuid": "5abd3c7d-a717-4539-a3b5-287cb7e641f2", "value": 56464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698799046, "uuid": "53f5574a-b2d6-4964-8aad-ba969b07c71e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698799046, "uuid": "00f192aa-54c5-46a2-8d0d-00b67ce6ea5b", "value": "a4cf233e1025ab010ef1bf0d5212053e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1f64e7-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698821262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821262, "uuid": "25701e22-6d3a-44b9-a425-c749551074e3", "comment": "Malware payload (zgRAT)", "value": "b6ca278fab493e1f9f51973625289ace", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821262, "uuid": "8371f8cf-54b1-4125-b7d4-418f0ca868d7", "comment": "Malware payload (zgRAT)", "value": "66ae63878a74976329f121048865a7edbb34c9e9921bc63cb14ab15515c216a4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821262, "uuid": "2b23a34e-6d4a-40ae-ab93-27d006186f7d", "comment": "Malware payload (zgRAT)", "value": "5a3cbb9fbd8199e38d2fe659b70edd171bab5e99", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821262, "uuid": "bc0a280f-aa4c-4dd6-bfe7-31d010e2d85d", "comment": "Malware payload (zgRAT)", "value": "5e4ab043f02531c86f9b02cb561e7b957873a5fba97b7b7f3c26b1d15ec5f61a09b78f968c159d19ad332141c27f0464", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821262, "uuid": "0895cd82-45bc-475b-9f2b-6b559fa1fa86", "value": "T13A515EA13AEF520DB5B37FA07EE4F7D68A4FF7F1AA26644D0844024A4E91B50C951733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821262, "uuid": "ccfb29a9-5f55-4824-85da-24f99c4c1271", "value": "48:fGLBiu0eNCiBiu0eN5XBiu0eNthhBiu0eNgBiu0eN4CBiu0eNfc:eY3eu3eo3efE3ex3eah3edc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821262, "uuid": "e1d183b6-8b9e-4611-b28d-4c3ea21bba33", "value": 2626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821262, "uuid": "40e3fed7-5181-4e40-903b-9040cdf22801", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821262, "uuid": "7cd7db14-06d1-4953-af31-d93341f7c0ba", "value": "\u039b\u039f\u0393\u0399\u03a3\u03a4\u0399\u039a\u0397 \u039a\u0391\u03a1\u03a4\u0395\u039b\u0391.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890c0839-78db-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698859478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859478, "uuid": "e40921f4-d68c-4216-bdd0-d95e05714da3", "comment": "Malware payload (Adware.Neoreklami)", "value": "48537f9e55f0b290713e2d621e75d37e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859478, "uuid": "84186f48-8bda-47d9-8e22-0f90330505e3", "comment": "Malware payload (Adware.Neoreklami)", "value": "6836eb9938416092c2c075be273accdbdcb404fce44ed18180417652f5bdadcc", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859478, "uuid": "ac4245ea-cf83-4ba5-8786-29f3362c2e09", "comment": "Malware payload (Adware.Neoreklami)", "value": "316cf0579713928d5bd9d4e38c1bad67cd06fcf1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859478, "uuid": "d18eca26-aa37-413c-ac71-3547fc57288f", "comment": "Malware payload (Adware.Neoreklami)", "value": "0dd5c4876578e111343c9e71227111da3dc7a649b9e554eb9c6db20954903bd278d7ba137b9483d7f70320d595b47ba2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859478, "uuid": "e3d6fdcd-62ec-4532-bbf7-9a947ab30e11", "value": "T1A776331278CAC9FAE7C24BB389DC9ED7C038D970072798B7179501691EF57A0E21B789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859478, "uuid": "21a59382-f792-4bca-9edd-e6027d906a79", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859478, "uuid": "9122f701-23fc-4153-bd7c-9cdecc3b71ce", "value": "196608:91O1gs97My/s9ZI5tE64TLjAJd6KOccPkIZWVwDHSCJJc:3O7gy/CZI5tfWwObR+wDHvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859478, "uuid": "8b0a7d3d-7f38-4cbe-8e68-58cac3c7ae4f", "value": 7507647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859478, "uuid": "bb65ef73-f21c-497b-b391-e377f02520e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859478, "uuid": "f97c4c95-89fb-4692-aa57-14324d1762c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c8dbfe-788c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698825616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825616, "uuid": "51441b52-c556-4643-a0c3-e31d41b0570f", "comment": "Malware payload (AgentTesla)", "value": "5aaf321ae9604f0d7da335b6803e1de9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825616, "uuid": "90028224-2c3e-43b4-841a-b82698e86167", "comment": "Malware payload (AgentTesla)", "value": "683d871d00d22e771fe7563a06e32c6993c0f343709f0927c65e38c023cab11e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825616, "uuid": "09626d4f-dbc9-4e25-a79c-7af3e6f9741a", "comment": "Malware payload (AgentTesla)", "value": "b76a05b9d702e520e3eefea0b0932f7a68b888fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825616, "uuid": "f4f44465-a35f-4ed5-b563-885e13093722", "comment": "Malware payload (AgentTesla)", "value": "944bff5017b7f67944523764bcf19f1a68a53da328e7b24b4d52ec2e2f92e9d2b4b9a9950c114b3c3a74d35597978a15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825616, "uuid": "223a1369-c33d-4e88-a4d4-8f3ac32f57d8", "value": "T171F42355CFEAE3889EC9A0F93252CD7E51225F44E25DD31D462C88B186FF0074B6B68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825616, "uuid": "e6e3d1da-9059-4f9d-ad01-2098d3d33257", "value": "12288:yAzZIko11in33uNtF9FrXdmnAq0tR2nG43jUy0N6/6+Xf8mj/Er/G:yAzNhHuNtF9hd52nG43jPgykmjsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825616, "uuid": "9a9d6506-3aa1-452c-b708-3c69519b4b7c", "value": 780089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825616, "uuid": "106cfe11-9ae7-4e4d-a2ec-015de8abc51b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825616, "uuid": "92dd78cc-e53f-48f2-b79c-27b55986777d", "value": "Invoice Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e83a6b4-78d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698858655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858655, "uuid": "4ae461c3-46f5-4470-b349-c245b619eead", "comment": "Malware payload", "value": "c7f894f642e227b593d34eefd2b87a8a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858655, "uuid": "1dd0f6c1-6c94-4a6b-9e70-3d3375fa142e", "comment": "Malware payload", "value": "685d4aefd63578340462788a3e11e331461ee70ec274b9aaa6d49fe43199be47", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858655, "uuid": "b56a85db-5d0b-492d-a13b-ed37cc9a866d", "comment": "Malware payload", "value": "1b421ec460c6d93b54da6e9f77bab0cf291cdf51", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858655, "uuid": "2ad6f07d-5e7a-461f-9179-6ae203b5e368", "comment": "Malware payload", "value": "125c831d45967c272658f21e703dd0a7cb0ef969943dbf9528bd5affe26769f27f4c1067d522cdbfe9c4e801f3564e39", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858655, "uuid": "141234f9-5c5f-4d0f-a8d1-5e837e8df778", "value": "T17A8302B9BC0184CD42730A08431F649DCE5D462F897E369E3D67E0B3BCEA552E0A6D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858655, "uuid": "19efe5e1-2ffc-405f-aa38-e5c6f71c052c", "value": "1536:hZgzVYDinvqZj1sYUXoVVpLKP939+6Tp5lV+lLjw85V2ozsJhPnm4vERk00Na/WI:WZSZ2JSpL893dTbl6LjBT27Hm48RkXEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698858655, "uuid": "1d0bf7a5-5f5a-4291-82d5-98d1566301d7", "value": 85883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698858655, "uuid": "467c9ca3-b68f-4dc8-9ced-ef42a6f0ecf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858655, "uuid": "dd9261b5-6b34-481c-bfed-2de862a8ec05", "value": "Perferendisu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a85ebf8-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (Adwind)", "timestamp": 1698821282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821282, "uuid": "c3430a37-4eb4-44a6-91e2-e2a303526e23", "comment": "Malware payload (Adwind)", "value": "e62b9e866f408e9ad03fad42b0e2e39f", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821282, "uuid": "368078fd-852c-4b84-bdb7-a0d64cffbaf9", "comment": "Malware payload (Adwind)", "value": "69157ed7f464e918428577ee73db4cafef0bec5644e27a5d3e6554bf1530fc08", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821282, "uuid": "c9ae9e54-e6bc-477f-a958-ffccd2cbc154", "comment": "Malware payload (Adwind)", "value": "a7174a14b46e28b93057c6ae79336ba2e5dc01d1", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821282, "uuid": "892a1299-15b3-41e2-b917-4efb09401320", "comment": "Malware payload (Adwind)", "value": "db9984c0cd910023382b6fce6b99ef8878095332d1175287f0a028b7e2c22d18e95b593f11b153ce3e20a9920e409fa6", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821282, "uuid": "c91f85ba-4f6c-49d3-93cb-0973ac4638f8", "value": "T10AA4124DF78D9069D7E2603011D244C367B86D89E3C284768E76B15793B69BBCB138F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821282, "uuid": "35f8fd82-6bb4-460d-ba68-43562ebf9315", "value": "12288:66RFIt5H7gQI4R9NiF5pxogQNUhIK/0c2qnAZC:rO7S4rksS7B2qnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821282, "uuid": "be3a30c0-6b18-406f-95eb-7fc4d889672b", "value": 484861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821282, "uuid": "a0bf4098-9e14-4189-9df8-4d8e2ecbbf26", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821282, "uuid": "e7280e3d-2fde-45f9-94ad-cd38d02bbb25", "value": "fattura.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5cd428-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698819437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819437, "uuid": "3e54a83f-731f-4492-9864-11f421b017d2", "comment": "Malware payload (PureCrypter)", "value": "f12adaa32fc17c4a9ed76049d0077335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819437, "uuid": "de0eed69-0c82-4826-bed5-7ae121b87b2b", "comment": "Malware payload (PureCrypter)", "value": "6a1c4642689c829b26802a63eb92e93c5c4768bcad6e6afb3a21d0608371d325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819437, "uuid": "84dd2a62-c57c-454f-860f-4a215414df2d", "comment": "Malware payload (PureCrypter)", "value": "6a344f422a3a6bdefea8bad30a735c3ebdcdbdd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819437, "uuid": "76d0ee54-8c23-405d-9df3-06ae7748f216", "comment": "Malware payload (PureCrypter)", "value": "4066576f3dea1a492b5fdbec2e1ae0c2f34f816ba69a5a5dc2b77f1453d69b319933fe714bf41fe9441862bab609a6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819437, "uuid": "48cdfa07-55ab-4ff8-bd8d-29544bffe67d", "value": "T1C692F5567F7CD131C52BCA3EC0E7D555CAB4ED522856C24EA65B33432B3336ADA02681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819437, "uuid": "50ffc28c-a30d-4d44-96c2-d06924378086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819437, "uuid": "e2c44bd2-0a71-4bfc-8618-56f521f3a2ec", "value": "384:3owCeRWPtlyXdeN17RLw5tjUW6PyoABKb5xZ:3eeRWPSdefhwUp6u5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819437, "uuid": "cd05ba2d-f93c-4c34-a6d0-30df8c35c80a", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819437, "uuid": "e44bb6a6-b2e9-4534-a7a0-f2957609b4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819437, "uuid": "5ce058d7-c301-4c15-90e4-36e614a812a1", "value": "Lwanghsq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cc03c7-78c2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698848630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848630, "uuid": "517104e1-4e59-4f13-a507-967435a510d0", "comment": "Malware payload (RedLineStealer)", "value": "764ec3b005d940023d61c6b49f6d9451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848630, "uuid": "c52724eb-fe0c-4b87-9c34-b4a85902f70a", "comment": "Malware payload (RedLineStealer)", "value": "6b31a0eafa7cecab1514fbf2d98889810cc898f54aeae45d088e8e3a2ba23fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848630, "uuid": "96636ec9-ddfb-449e-b5a2-8756bf52a482", "comment": "Malware payload (RedLineStealer)", "value": "fba8d340ea08ce4a81b1a599ac4653d7a4d4d1eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848630, "uuid": "5aa833ff-0683-494c-b2c4-5f62542f9109", "comment": "Malware payload (RedLineStealer)", "value": "f0a02ad0272321a088b6163834abd5b384fe66356927e480beab4a8d1ad1aa8da63996da7a96bf583e459b5e42d155e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848630, "uuid": "7f6a20ce-ac7e-4a98-b0ee-e090384fed97", "value": "T1E0E511BADDD06508C17F06B81770F226D8F008B0868D1515757C58FA2AAE3F86E9B4FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848630, "uuid": "e289248f-8f91-45ca-bc44-0ac1db8ae6a8", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848630, "uuid": "88b42cfe-be2a-4ec3-bfed-73eb3ad07c24", "value": "98304:sXMq+DPCi5UFZZLaeM9/GJs1BsSfFUybk:W1i5wZLQ9/jsStUybk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698848630, "uuid": "471440e3-f87b-40c6-b215-5543b3c0ad49", "value": 3283264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698848630, "uuid": "b4de3dd7-cf5d-4449-bdfd-0e67b70f1605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848630, "uuid": "39b85d72-e70e-43cc-86d4-2c48a84a73a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08008358-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698842082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842082, "uuid": "485a1914-c2d0-4aad-833d-85eb5e2aa5a2", "comment": "Malware payload", "value": "3a5349fdc46acd1df3784415f4ed977f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842082, "uuid": "2707ae02-62a5-4c9d-82c5-ebe04d128e01", "comment": "Malware payload", "value": "6c63bf7e3f936d4aa62e38e3778854267c9317056fcc0a359aa28e3f108a8620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842082, "uuid": "ddaae193-9b17-48d6-9c87-a48fb1dc5c0f", "comment": "Malware payload", "value": "320c46ab4faad3ad9b707c10a40443fc40551edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842082, "uuid": "2d6e95bc-6ca3-41a5-882b-c11616947f01", "comment": "Malware payload", "value": "02886ca51c11f527f0dea0e106ea857a9096dbec4fb8467fddaaa4f621b07d92a5d57ab524a614c4180f8d5d07ee82e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842082, "uuid": "84f0d953-af9a-47d0-9c04-f2396d85cfd6", "value": "T10546338CE5830B73F9F7193451F6473F2139A9334712DAE6ED88A44B16E5B2B227D248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842082, "uuid": "0bb00858-9321-4584-bf85-578771017347", "value": "c8968748bf6183e3c66062912a824b6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842082, "uuid": "5e9ae7d6-62cf-4096-881f-008924fb3b75", "value": "98304:q/qdoV1JGOFO1i6wiAfANeDKoPpHZKpFRW/jTIh5ttH+6bOP:PoVfG1uDucpHUFRW/wh5zH+Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842082, "uuid": "008e0088-b1a9-49fc-b66a-c8a49f9b2cc4", "value": 5722414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842082, "uuid": "07198b0c-d66e-4b4a-aae3-1b3911f3f621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842082, "uuid": "dc4d4f9a-10e5-4d96-ade5-97a00a19689d", "value": "6c63bf7e3f936d4aa62e38e3778854267c9317056fcc0a359aa28e3f108a8620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072c0790-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880735, "uuid": "d5fa5d86-c4fa-4b23-b924-99df4fd6b3e6", "comment": "Malware payload", "value": "5d07a11e6e8a5383cdf0e238ab869655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880735, "uuid": "abcd06a2-5725-4e2e-bfe2-1d6498cefc72", "comment": "Malware payload", "value": "6caffef0bc3952d29e475a427878bcff24ed5c158c4bfc07b6f3707f09e4b86c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880735, "uuid": "67066c6d-3787-41e5-ae25-61104ea55f11", "comment": "Malware payload", "value": "7f63e6539bd6981552b9ef9d029fc6f711cbf4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880735, "uuid": "59218534-d09b-4d15-b4c0-eaef290f89f7", "comment": "Malware payload", "value": "ca54a79c6ebdd08055ad311c70cdc40dad91bf7b47cc382edc09a22ac6730994f115749d0ff11b07e1204d50600f47be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880735, "uuid": "b1c16c00-fef1-4a3a-9845-2a6e8b26b24c", "value": "T17A86334237870873E115BBB8EC52CACDAD387E2A2CE544361CFAD94E587C5C15A7B0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880735, "uuid": "dcc35a5a-dc4f-4af0-ba3c-7432abf8bc6b", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880735, "uuid": "fabf46df-9037-47bc-8c1c-8fa2addf0f76", "value": "196608:WmCBdHshTtPNJp6QmqKa2nUDRo0HDk0M5nLpS5:V/luUto0AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880735, "uuid": "a2e055d2-e3f1-4e8f-9211-84eb9bcf27d9", "value": 8226976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880735, "uuid": "095ec499-fd92-41ef-bf83-9bab29516b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880735, "uuid": "c6c17c54-dc9e-4e06-9b38-861e83cc3c40", "value": "SecuriteInfo.com.BScope.TrojanDownloader.Agent.15295.16749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f792050d-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880709, "uuid": "5857dec5-192f-459a-92a2-e0909c0cc5a6", "comment": "Malware payload", "value": "17a4c0e64a792f3fe2fb2fe9f91cb890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880709, "uuid": "888506c5-26d4-4994-aa61-8229c9e46640", "comment": "Malware payload", "value": "6e2d8739b47f4d48b5b9f38c824015bd6469a27c3286a63bfa84fe4e1b89dc03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880709, "uuid": "acb837e6-1666-4165-b019-6fa37d7a3ad4", "comment": "Malware payload", "value": "3ed189c07432971251dbfdc6b110282c8182c30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880709, "uuid": "974bf9b5-5bf6-482a-9fda-4d6b36e91673", "comment": "Malware payload", "value": "3ea698747a16b4f0e40ebefe6df5f1432b857d933210013d048bf0c84801e1a30b567347cfa2f28953cf5ef42c131fd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880709, "uuid": "e842b515-2a76-4341-8030-82d81fd82684", "value": "T10F55E71BE750612AF45300326A54AA37696E3C350448DD4BF707AFB835B46E3A9FE31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880709, "uuid": "634d3f7d-0ce2-40d4-9eb9-27f9465cf999", "value": "456998f0f1bd77fdd28e8ead84ce6be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880709, "uuid": "8c24f7f9-2466-439d-91cf-8eea1b653ef9", "value": "24576:/x+WA1WyicqceapWGRqM5whmssu0/AH2CH04pNetU87q5h2/hwo1ht0f7IuQOEZw:/x+WA1WyicqceIvm/NpQ2Zm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880709, "uuid": "b17a9eaf-0af2-480d-b7fa-8f3a6c7cd8f1", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880709, "uuid": "ddd4435c-be5f-4447-95af-93ddd1436f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880709, "uuid": "b94e2555-e5d3-416c-b365-f3ab6a89a33d", "value": "SecuriteInfo.com.BACKDOOR.Trojan.6794.1201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630dc305-78cd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698853402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853402, "uuid": "d1d57351-b31d-458c-8233-45933ef7b808", "comment": "Malware payload (RedLineStealer)", "value": "dfeb9dd1b9f1f21932dd2b6364dab193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853402, "uuid": "e1895047-4480-4299-a5ff-b68a63808a83", "comment": "Malware payload (RedLineStealer)", "value": "6e66f61bfe275d382fa4bb216253568ed2b0d9b08f35b618879f2879025a9e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853402, "uuid": "46adfa03-f7ac-4499-8f66-09635d093fb2", "comment": "Malware payload (RedLineStealer)", "value": "2a4c22ae8fd8d8199f000376cb1f3b389da3cd25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698853402, "uuid": "a2b39a25-fa2a-41ba-aedc-b830bbf8132f", "comment": "Malware payload (RedLineStealer)", "value": "2675c8de7ff2684e69615524df2ac897fee9949932c970543ee0fd3d9edfcbd741cddcd444dea16e966f041d9429239a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853402, "uuid": "9d2345c0-bd01-4319-864c-fe8c9fa2ded8", "value": "T1E1B49D1159814457F6EA1131B8C155E20868A021CD170AFB23B546ECEEECF73FABDE7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853402, "uuid": "ad33df98-ca85-4e4b-b350-d4ac994f1e9a", "value": "fecfe2b246ca405036095a05f7a099f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853402, "uuid": "c2befabf-baca-47e7-ae13-ac849f3476d0", "value": "6144:2c2vDq6ynKoiEtMaXliaXF7A9bipAoTWryiYx2OU54ik1QNZGGq1cpF2l+O323Nh:Z2vDKKqXHF7A9KS0IIGNMGq1i2l+bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698853402, "uuid": "fefa0bef-0bbe-42c8-b98c-9bf2eb90f3ee", "value": 511304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698853402, "uuid": "9d33d8c0-5bc4-4ae3-9afc-d3f5d614d68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698853402, "uuid": "bd627609-f072-4d62-901f-38c8b88efa63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da588152-78b4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698842864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842864, "uuid": "69f3eb92-5197-4bc5-9406-010cfd8c42c9", "comment": "Malware payload (AgentTesla)", "value": "7f8d20b73df2aca2fe871a4b77a03a92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842864, "uuid": "374c2ab1-771d-4441-adba-64c46d61fcad", "comment": "Malware payload (AgentTesla)", "value": "6ed77c12bc9d5e4b4d311b1e8f2d6e5fa2afce0016e1499563c75d938a059ee8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842864, "uuid": "4f9a11e1-014b-4312-80ae-90fe21add038", "comment": "Malware payload (AgentTesla)", "value": "da6319cc96d1899db6da79288765a96d30437450", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842864, "uuid": "2eb2fefe-d9a4-45c9-b238-553c54198a7b", "comment": "Malware payload (AgentTesla)", "value": "e97e7a8dfc9d875533280e9965bdc09be6ff841cd75d9b46f96f069d006873ebb1d2827f8b0cee8f6661633529971337", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842864, "uuid": "6825753d-91a9-4e92-9805-7392038cb60c", "value": "T142D4226139F869BBC67957FA0994898887F5E6CB0A21FFCD5DC105E90F9BB540380B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842864, "uuid": "26948f48-2b1d-4947-8772-97c5700704ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842864, "uuid": "902f5b3d-6b92-491a-a261-3721c647d2a4", "value": "12288:yTX2pXoa5Cdg3gNolqJcVhLZ3mti8evp3RAvnrKd7LM+y02UT:yj2pXoa0dgwGmcntLppyvkMQxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842864, "uuid": "258fea84-93b9-4133-a8de-d8c182073055", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842864, "uuid": "c4d1473e-75d0-462b-8baf-703c3af757b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842864, "uuid": "ab1cce87-060c-4dd1-a5f9-22a11dcb7328", "value": "Nota de credito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f1b481-7893-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698828497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828497, "uuid": "431330db-8e3b-4250-9c7b-d2d37a6825a5", "comment": "Malware payload", "value": "46804472541ed61cc904cd14be18fe1d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828497, "uuid": "fb8a7c96-ac42-45ef-b73a-638c515cfb85", "comment": "Malware payload", "value": "6f0a38c9eb9171cd323b0f599b74ee571620bc3f34aa07435e7c5822663de605", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828497, "uuid": "00ad260b-0435-43fe-86c5-cc9349723035", "comment": "Malware payload", "value": "e287f70804460043b12410f95b4fa400e1910f42", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828497, "uuid": "904504b2-54bc-4f35-b6a8-bf6f6ce737fb", "comment": "Malware payload", "value": "755eb8b7fb8dce8101bdc602b6997b2764e38765b7c346c61dbd25bd78ae866250244988d46a7dc45df632b094d1ea74", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828497, "uuid": "f191d680-d2e3-4465-9eb4-787964873034", "value": "T14692943819921230D5EB53F4D77BCA60451D429D9D93F6BAFABC1BD049AAF81CB1C2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828497, "uuid": "f91def50-c022-4269-b590-71dd5fa6161a", "value": "b552436fca61b3d053aae8e1e0ee5d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828497, "uuid": "b381397b-a695-4452-a1c1-27a6b9f0d841", "value": "384:Ifl/UMj8vN2Gti4KgTUjub9ttBuMsUdIxc9:4l/UAGSvgTgux9sUdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828497, "uuid": "4f2ebdd6-0320-4317-a765-e3a7ce345517", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828497, "uuid": "5b47ef71-df2e-4d44-b942-785307646f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828497, "uuid": "946db45a-457c-4575-9140-fe3c2eb53e49", "value": "CyveraConsole.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b37bc-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833580, "uuid": "9912a20e-a988-444d-8eac-af4afc4d479b", "comment": "Malware payload (AgentTesla)", "value": "e45e04bfe96eafe14cf85000fb0a24d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833580, "uuid": "afe33fad-ca1c-4a8f-b831-e3f3c5ba7bbb", "comment": "Malware payload (AgentTesla)", "value": "71ae4861d74ceb1eb06bbb6223ffc3e14f5ea37783b410785cf261bc55b64876", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833580, "uuid": "ad4b5b81-28f7-4bdd-967c-a88f513352cf", "comment": "Malware payload (AgentTesla)", "value": "7efd2528f7b6ac31b47bc1273acfa72061e08215", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833580, "uuid": "d57467a8-ed3e-4013-b896-30055db71668", "comment": "Malware payload (AgentTesla)", "value": "7546b851869aef605fa20167a09cd86fc8017380b174cf6d589bf17988a4e8df0f429b2fdf36f3ae8f0f68af3819378f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833580, "uuid": "bc5f1ded-081b-4c68-99b9-81e098a75915", "value": "T1EEA433A374A52C4833E1273E09D9C7D1E5A0707074261328BD57574BC3AADBDF8DAAA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833580, "uuid": "fa83779a-4930-435c-9dee-2bec1be2c485", "value": "12288:YE4s/LrDIVZE06rkUJ+rZfUxwcRtn7viVC:YEVLgVZukAAZEwczoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833580, "uuid": "4bf78f32-de4f-4535-9b33-060283ae718c", "value": 454940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833580, "uuid": "04cebbbc-e4f2-4227-8687-d0935a590387", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833580, "uuid": "c273a005-7ca4-4274-a4c9-f55cc2857aa9", "value": "Quotation Inquiry_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d91d338-7891-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827703, "uuid": "98528617-6276-4980-beca-d51bd8d3451f", "comment": "Malware payload", "value": "7946926dd10e953e5056515a20954a73", "object_relation": "md5", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827703, "uuid": "4b9b4cb8-33b8-4c57-8ce9-8a8315bcfdf6", "comment": "Malware payload", "value": "71af3b1eb3b6593a5c01b0582c07a8ba6d92a780d1c0b9ef02bea1ad008d98ee", "object_relation": "sha256", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827703, "uuid": "52207e0f-bd16-4d5c-8042-29d3c7c7a1ac", "comment": "Malware payload", "value": "6090eec59234bd0237abef6b222329b7739b2e43", "object_relation": "sha1", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827703, "uuid": "fd34c7e2-479f-4467-bb42-833ea0544bac", "comment": "Malware payload", "value": "fe448e008264a120052f2971921d8b6716adba88427879fa377bf357645a6899d7dc1653164d461db0f53e4573f5ec45", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827703, "uuid": "b1e8028c-a8ec-44b4-92b2-0a9129b3a916", "value": "T1A6444A0533EA4A6AE6FE5B70D9B014848BBDFD63A517E74E5E2090FE0C12744EE41B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827703, "uuid": "a510166d-7245-4bdb-be50-8c17e3a5945e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827703, "uuid": "077974e7-2052-478c-9ab8-10b8a4f19bf5", "value": "3072:0TBncFWn1GG7bnDOlQGJ1axJO3d0NBMFh3wXrnWm6ObcgOXyMZbv4uEnk0ZOuK9V:0TpGG7jtO3dmuhAXr9bLOXXZbgp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827703, "uuid": "276dcbbc-e6fb-4522-b95f-56c6fc26588a", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827703, "uuid": "31d2dc72-134c-47c0-90c7-5e1d486cd838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827703, "uuid": "df785b2c-9746-4f61-927e-ebf43f9384b5", "value": "nwl415x2fc-cleaned.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e272a46-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698819356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819356, "uuid": "28742cdc-da03-44c8-ad93-2b46e58030a8", "comment": "Malware payload (SnakeKeylogger)", "value": "c9303344ad8835a85fc0b2a09e01f573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819356, "uuid": "770139e7-f766-4f72-bf8c-5bea9ca43d39", "comment": "Malware payload (SnakeKeylogger)", "value": "7284a7a47a6c2aa97dddd4b8eb7a04e285e2d36aab49d1564421be0c7a6d8f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819356, "uuid": "24af143a-0dad-4963-aa8f-1553af44592b", "comment": "Malware payload (SnakeKeylogger)", "value": "18adb6199034985533754d12cf2980ec2d5b71f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819356, "uuid": "c99dfc7a-589c-4138-be0e-3f8bd537cdc3", "comment": "Malware payload (SnakeKeylogger)", "value": "b16657c3c15bbcb6bc07f29d6ded61175c6e3a2cea39dc532ba345571c695b45ef1d672d438a9d2c09dca9819179faf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819356, "uuid": "8e7eec3d-48f7-4905-8a26-7493e51efcb1", "value": "T1FCB25B82B6885673ED7F03B890320A51173AFD669D01BB0F68C87BAB3D73743051962E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819356, "uuid": "fcd873c8-b6e3-42b4-9f8a-3786b8545d32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819356, "uuid": "b6ad4d5a-8c56-4bf4-95e8-1e54751d4a09", "value": "384:79ZyyYEaGmLV8SwFtiOUo9U2QuW2APL6yRqtxAx+roEOsVK/KO+sB6fy:poy11YwXuZHuNs3RqtGx+roAYP+96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819356, "uuid": "a5df82e3-bd9f-471d-ae6e-fae7164cdaa7", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819356, "uuid": "252c98f0-e7e2-44e5-8668-05001e929e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819356, "uuid": "ec498aea-bc28-4c63-af4b-7012bb15c556", "value": "hareketleriniz.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bb7f73-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880704, "uuid": "41356b34-38da-4c57-b599-316668e990db", "comment": "Malware payload", "value": "3c307250133d17d9c7c46dbd10a03ec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880704, "uuid": "15a01515-8daa-42cc-a0cb-fe3ef3cb286b", "comment": "Malware payload", "value": "72ba182866e18b82f6025fa40746c5ba2ddba40e218d2ab984ced8e41ed5cd00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880704, "uuid": "44ea5f3a-6286-4600-a874-dd80dd241c14", "comment": "Malware payload", "value": "a36be6de8faac9701501a9e2f07a70871282090d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880704, "uuid": "9134c245-fd68-40f7-9496-59cc385235dd", "comment": "Malware payload", "value": "1cec3f809a6c0468f671be4406704f708d0c206c83d1e0b485b4659af18125380c203410554807bfd611da0012cc57fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880704, "uuid": "99148510-40b6-460b-bcb3-b964154399b5", "value": "T188942A2372E1C424F1214236DDB197E7E96DFD625324651BB288BA2DEF33250CF3A616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880704, "uuid": "0f9fbf4d-bb57-4110-aaa5-884a59aacaae", "value": "2ec3794441edd0885a7d0ce3032ac832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880704, "uuid": "45e5a90c-4cd0-44f8-9787-61c4a4e6f824", "value": "6144:45xmTJzTJHuwkfrkSNwwCUkiP0Q3ZrMK5vmfSzp48XaYlrfNRbNfdNlaj:45QfHuwkztNwPJQ3l1l/XaYIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880704, "uuid": "13203a59-a650-4cfe-9ef0-8cf4a0b43c44", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880704, "uuid": "8ca791a2-fe38-4165-ba22-dd109bc55507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880704, "uuid": "d7e865ce-b0a6-4ada-aed2-3d8e81983f01", "value": "SecuriteInfo.com.Backdoor.VB.3330.17280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bf1fe5-7870-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698813376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813376, "uuid": "0ddb29ed-4fdc-4b0d-ba8b-2d7962e1329f", "comment": "Malware payload (Mirai)", "value": "2c8c14dffd64fe1713b8fcc939ee5b01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813376, "uuid": "68bc266c-da05-40ab-a533-d33f6520e691", "comment": "Malware payload (Mirai)", "value": "73fbb147eb5ae54db3a31ec22c37fabe2dd15a1fa038e317c081b81bfc513897", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813376, "uuid": "b5dd3ef8-18d9-47a3-8b7b-7d1f6f300496", "comment": "Malware payload (Mirai)", "value": "995ff662b2b01e5fd7fedb8cde465efb2436903c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698813376, "uuid": "41cb9a12-01b9-40df-9ff4-a4c13398a714", "comment": "Malware payload (Mirai)", "value": "b62b53e1c22471f96b96708c0858ce25de7bd98959a281f5a892418d7c3511175f4bb893e8cafb9ecb6953c9bd90fa5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813376, "uuid": "a49983ea-cff8-42ae-8e9d-3e8355585927", "value": "T19203F116B299CD11CA99907D1F5FAAA99E30B32E244C2165BDEC312B72D5BBC3F34710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813376, "uuid": "827089ba-eb96-494f-b143-04543e2752fb", "value": "768:TrC1ULMrvNX0GzzKC/UZzSFwUgSGwgQsCoG1HXZpKZnbcuyD7Uryqh:vsuM90GzzKCxFwbsgQsCo23ZgZnouy8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698813376, "uuid": "b44281da-5091-408f-a133-403ae6fbe634", "value": 38892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698813376, "uuid": "0924bab7-b4ff-4514-aa16-b30231716d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698813376, "uuid": "6d854225-0766-486e-9c78-280ef91cd04e", "value": "2c8c14dffd64fe1713b8fcc939ee5b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cba495-78d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698858667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858667, "uuid": "7cc684e0-0543-4c84-9439-7a8010b47aa8", "comment": "Malware payload", "value": "e86528d6889bf4f9bb80e3e8d1fafe5d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858667, "uuid": "10a00428-f901-40c4-869e-3b337adff8b2", "comment": "Malware payload", "value": "7446d40415fcf2207458c48fbed63c192674a2fe49798b0724e649411ddbbdd4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858667, "uuid": "879d60a0-94c8-49ff-86c4-fbd3c5e1278d", "comment": "Malware payload", "value": "cde1f7177dabfcf02a45fd9546e0ba97942dc3ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858667, "uuid": "2a6debc9-9b55-42bf-ab39-ae96608e1cd4", "comment": "Malware payload", "value": "23b4d79f2c4c91c3186db2a79b6e2f6183189ce6c585d04137dea0ecbc60eb03aa967f52da32b6b47161595aee407994", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858667, "uuid": "6e73f40a-cbd9-4fd5-a2cb-d94f62d48d6a", "value": "T11313F1B5AC056C0E27B1414983162CDC4589473FCF6E60EEAA369075BDBE4D1F09BF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858667, "uuid": "00bce078-446b-42ba-bdd8-118441f40116", "value": "768:7lLjKIk85V2ozSbk+7TBhP6Mm4vEBfk0wjNa/OrcEIJM8Tig0Ld47Ue3IjbikI:7lLjw85V2ozsJhPnm4vERk00Na/WlIiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698858667, "uuid": "7c2a55b2-a4e8-42f9-b69f-5c401cbc9d2a", "value": 42844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698858667, "uuid": "8bd88aaa-936b-481d-adef-cf45af165e49", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858667, "uuid": "f00230d1-7ca6-427b-90e6-7d7848ca6775", "value": "KL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2886b7cf-7893-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698828393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828393, "uuid": "f99f55e2-049c-4c5c-92cc-03c1d237cec6", "comment": "Malware payload", "value": "4abcf21b63781a53bbc1aa17bd8d2cbc", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828393, "uuid": "dbbe5392-ca47-4549-8140-fbc2bfe80552", "comment": "Malware payload", "value": "7495c1ea421063845eb8f4599a1c17c105f700ca0671ca874c5aa5aef3764c1c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828393, "uuid": "cfed5254-7e21-4f16-b729-80aa26bab4a7", "comment": "Malware payload", "value": "9c58ec8f7ce75ba1b629c9ef84ab069a32313288", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828393, "uuid": "0e748317-8584-4aee-8176-ea8a6b51eb73", "comment": "Malware payload", "value": "03e847e6b3638e7df19960b6b5184a2a7ed4cbf597b9117b1cb20a2ee76d64a724234976b22fdd6357126ade95960769", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828393, "uuid": "e8095f92-a071-4de3-8ea5-41138ba9c5ae", "value": "T10D827C962E093AF7F7A795FC138974937EF2E36B5F82475C6DF180A60068F402235616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828393, "uuid": "46fa6558-5a85-4437-8485-8393e65a9748", "value": "b552436fca61b3d053aae8e1e0ee5d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828393, "uuid": "6892ac93-01fc-48c8-90f0-cf9003a58347", "value": "384:vJtrA8T+4TeMjvYKpWTLji62jzh/XGfZ0Tl:v7Pvbzpo2Hh/80Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828393, "uuid": "bafbfdba-d642-4618-b469-3a2f714070dc", "value": 18352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828393, "uuid": "2f2c7e28-5170-446d-8d72-7f0541b326e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828393, "uuid": "9d68adc5-6d60-4411-bc71-df0c5ef619c6", "value": "cct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d54d3-7892-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698828260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828260, "uuid": "084f570c-f356-44cf-a148-38da31e4be7e", "comment": "Malware payload (RedLineStealer)", "value": "4b0fb62e3def191ca5c64325342ab4f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828260, "uuid": "9ef8bc0c-a71b-4c9b-8eca-1eb41ca1fcd4", "comment": "Malware payload (RedLineStealer)", "value": "75ab3aadac14e25230ba73e55f3e15ad45fceaeed42d3b66a100acdc087e6381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828260, "uuid": "f8c996ce-173e-473d-aaa4-b872676db37a", "comment": "Malware payload (RedLineStealer)", "value": "226f7c2d1db8acfe4669a5e9a8e6992135b18bf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828260, "uuid": "cf96ddd2-ecd7-4221-8609-5b6ed00a67a3", "comment": "Malware payload (RedLineStealer)", "value": "674fb80756796950c7720663159cb12c9e877f4f4cd1837c1ac7a6a54f92dea864dcca8f0949f71962f6bfeaa65844b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828260, "uuid": "e34b43d1-158d-48ec-8270-241de8b450d5", "value": "T1BC752343A7C58463D979A33048F20B930B3979E06D7A432B2384F55A5C637A8FA7476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828260, "uuid": "b985b46c-76f7-459a-8b0b-d1da7995765d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828260, "uuid": "2c95c583-c20d-491d-98f0-f36b515ff4ba", "value": "49152:S+rE9uKjA588ZoQsdt2ntZOHPFbCfOXmG1Fe:Do9xMXiv2tZOHPxCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828260, "uuid": "99851bc7-39dd-4134-8de5-38c0f0d19924", "value": 1648128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828260, "uuid": "45f502ab-20ce-43f9-a2cc-0475b7d9e57e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828260, "uuid": "d3292433-8f86-4faf-8401-37f7b9b923d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878229b5-78c4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698849597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849597, "uuid": "a98e26e6-e2cf-4ace-a336-264d8da91a0b", "comment": "Malware payload (RedLineStealer)", "value": "e3380ed6d420eb9e137a3f2674338c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849597, "uuid": "0ccbb54e-f96b-480d-b03d-8ffcd9d89711", "comment": "Malware payload (RedLineStealer)", "value": "75c5d2ee59003e07d1c9fb2b713b389ed088f3a4a1896e5ede3ad58d3bd4c3f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849597, "uuid": "f3137f78-7a32-4655-9ab9-4c80e23b3be1", "comment": "Malware payload (RedLineStealer)", "value": "2149cb63e9a92d6194053f795243fdbbab2db873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849597, "uuid": "25ea6ca4-64c6-434d-9406-c580d1c6eeaa", "comment": "Malware payload (RedLineStealer)", "value": "3ce27a0c18e9e4aa6183a038ed7dfa5fe796103c9c95e4423ad89398569e93cf5a877c88e9222aa5924ccadd39eb3e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849597, "uuid": "8175aa7b-47d4-46f8-a5ee-8e51fee0de4a", "value": "T1AE458D21B4CD4272DDA7217A06ADFD35A16ED0F0039405EF12DC6BEEE621EC06BB15DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849597, "uuid": "eaad929c-4285-48d8-b549-781a4c0dcb96", "value": "94d1384f02205e490f7850f2f39bf5fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849597, "uuid": "f8fbaf4a-7062-40e3-baf0-b2dfa4410fa7", "value": "24576:jA72dACotf+BV3oMYpRj3cqPd8ufkhhBAjYZp:5otf+BVBYbtCufkhhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849597, "uuid": "efd6eec6-99fb-4def-ae2d-8e271d07000b", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849597, "uuid": "23edb9a6-2028-4d0d-87ad-27d1fdbc9639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849597, "uuid": "9d10aee6-a179-48a1-b9c9-c737afb94e87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9feb0acd-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698854363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854363, "uuid": "ba55062e-0f3a-490c-980c-fb6870532df8", "comment": "Malware payload (GuLoader)", "value": "c5db835c5c29f01794f39bc27283caed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854363, "uuid": "f93bcca3-5585-4ebe-b095-b1ce433553a2", "comment": "Malware payload (GuLoader)", "value": "75fff2e04fb75710d69eabc89d7c4ef49eb951f3cf42669a77690c7baed12475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854363, "uuid": "3ac2cfca-1d70-4295-bf98-7b4d022e351c", "comment": "Malware payload (GuLoader)", "value": "a6f947d4560211b4c3970fc27d82855ef67c82d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854363, "uuid": "c7c15db8-116f-4e21-a4d4-9789d7e5a66d", "comment": "Malware payload (GuLoader)", "value": "54da5ef98018ebc7c4de4f282b65b010c7f69dc427b12694eaf3052897d5fc5c9f475406d09544eef03d6179020d003d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854363, "uuid": "2c05c109-2737-4504-8def-45704ada2322", "value": "T1DB6523185598D613C36136BE45B6D3E672B16E41F91042D3AB38FF8DBC7A2C0BF09A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854363, "uuid": "6fa6aac0-7bd1-4929-a712-0b6603e2b738", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854363, "uuid": "3c609eb0-180e-4d3c-956b-cc973e4980d6", "value": "24576:4Kk6ZaufHy1xWSILwgnLwbpclU12Z1owyMsMtBH9I9QoP8YfyWhk2xRUASHJcPWV:9kefHy/WNLLwbylFZ1l7wQokD09OuPWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854363, "uuid": "6bd1460e-32c1-4a68-bdd3-2cc8f1e2f1f3", "value": 1535739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854363, "uuid": "df41b351-583f-4085-9a51-c15e9caf8045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854363, "uuid": "9bb52161-4cce-4688-8d02-1e2c1e696641", "value": "TELLIMUS (LEPINGU ANAL\u00dc\u00dcS)-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21914a7c-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854580, "uuid": "5ce67f2d-558a-49da-b83b-436d8bf2c9e6", "comment": "Malware payload", "value": "c9acd457b4ed34593f64894ccf28fbfa", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854580, "uuid": "d962de8a-0dfb-402d-bd4d-bf93cac5a723", "comment": "Malware payload", "value": "7670970292647266783fd0006663746e1d448043fc1c4aba0927c3afd9d331b0", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854580, "uuid": "ec3800ec-08a0-4c68-83f2-ae34367df58f", "comment": "Malware payload", "value": "1647dd49ad25bbcaa60f0eedc85b0084969b784e", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854580, "uuid": "aa9ee25f-6680-4aaf-a961-650b70f531c3", "comment": "Malware payload", "value": "6b8f2e9cf6ba107531baf519b5abbf740b1690174474d32a319b4fedd066f13c64fbdb9cb8ae7a2a4340969be7008387", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854580, "uuid": "321b4f8f-9ddf-41ca-89e0-688ab96fb549", "value": "T1D1739E1967B05166D27E63318BF24E0665769F93B6110F2F9B8E014E1C25380FE62FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854580, "uuid": "d1dc06d5-8b16-422b-8ca6-dfc48bc9d2c6", "value": "1536:WcUXFSzTWNec7TJ8epJ9HnXxqv2hvbRsevZP7YfW:WcPiPpnhquhjR53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854580, "uuid": "9e6c0d7c-3c32-455d-8306-6f008cb33bf5", "value": 77176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854580, "uuid": "b0288101-9c9f-4866-9171-6e8c61d163d4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854580, "uuid": "9edbf19b-bac0-4e64-9d71-c19634d0da9e", "value": "Missed voicemail 005.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4323d6-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819920, "uuid": "7c4863c6-ec4e-4153-96ce-dab4e3d6e4df", "comment": "Malware payload (DarkCloud)", "value": "fa8bcc8280933c00741e7e457bcba7fa", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819920, "uuid": "309a095d-42ca-4e98-b127-354021e96ab2", "comment": "Malware payload (DarkCloud)", "value": "792975478e97a3de86e7d7751fcf9a069ce5bd5e486d35b0b82f0f35bb6bf09f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819920, "uuid": "5d5e6625-33f3-4846-a08c-0a9d3a2737c7", "comment": "Malware payload (DarkCloud)", "value": "cca13d2c0913c975047d84775dc394e93b500122", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819920, "uuid": "9533220d-646a-4e13-b415-2a99ec530e7b", "comment": "Malware payload (DarkCloud)", "value": "abe3cd686d6d373e2d512bf630011b4049ade31e6d9673c01d33867f094c90eab3d88b6b4417fafae6fa3f1c23c5d2ae", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819920, "uuid": "1ea257cf-294f-4d8c-ad93-6b48264f98b6", "value": "T11E9412045061E46AC8E77BF52E3531472A3B6CA60528834BABF43D59BD36243DDCD39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819920, "uuid": "3889be02-fdb7-4f4d-ac60-fde6e8aca644", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819920, "uuid": "6bcbbf36-fbf8-437a-a609-d61047c3757d", "value": "12288:wY7lUmbdLJsg0TkqcMZ8wH8YiXlXj+LUel63Ns/M2KbW:wY7lUkp09TLHdej+LfMBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819920, "uuid": "10bc68ab-c8f2-421f-a5e0-c1abcd7fe012", "value": 434307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819920, "uuid": "a1f0b961-d6d2-4921-9ccb-c9ce0b299949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819920, "uuid": "b360808f-7529-4f5a-9fee-853265639bd2", "value": "45678909876545678DC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8f24fe-78de-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698860581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860581, "uuid": "bd329cc7-4c51-4ce6-a797-bab56d48f1b6", "comment": "Malware payload (RemcosRAT)", "value": "63085b0b7cc5bb00859aba105cbb40b1", "object_relation": "md5", "Tag": [ { "name": "allnato.net", "colour": "#231B0A", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860581, "uuid": "5295ecea-f43b-4266-a339-81af54e6c0e8", "comment": "Malware payload (RemcosRAT)", "value": "79a4fa2ac4971f669cbcbe4f1573bbc893f05490a9a0d0d9d6b6c1c91bb3a1c4", "object_relation": "sha256", "Tag": [ { "name": "allnato.net", "colour": "#231B0A", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860581, "uuid": "cd7581e3-14ee-4f0a-85fd-def3d0339e4e", "comment": "Malware payload (RemcosRAT)", "value": "399a6c514bc8caa0297a558f5abbf61c5b96aa74", "object_relation": "sha1", "Tag": [ { "name": "allnato.net", "colour": "#231B0A", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860581, "uuid": "16363b68-6a17-4e49-87ea-d17438cf6035", "comment": "Malware payload (RemcosRAT)", "value": "8ed6347dded1184d43662ee81b579ad41dc8d6a75cce2a6dd587f5d57abfe3df84d9fbef36220d84636187acc4c4bb7b", "object_relation": "sha3-384", "Tag": [ { "name": "allnato.net", "colour": "#231B0A", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860581, "uuid": "98c71af7-a8b9-44ee-9738-63d69c6a088b", "value": "T1ADA4239FE6E67DD86C06E4C5A7992C0C476363B809C1D3827E13B099BDC980336B7795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860581, "uuid": "f34888a9-410c-4df8-a967-aa2919d7d5c6", "value": "6144:dt3ny/Uskc6xS2MvJi7SORdQiFwEBpF0vysoq0qxTJ65ICtVthPS/KbWjXQDNO6B:dt3nNkBVG3F3pmyzqHCDtW7QY6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698860581, "uuid": "6405d7c3-cb6f-431d-b1c9-926f7b611273", "value": 477251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698860581, "uuid": "c626cd97-ac22-4f94-ac88-2390713bf7a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860581, "uuid": "187acb73-dc2f-4031-b637-348e41935fa1", "value": "NATONSPAFinalInviteList.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27dcdbe-78d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698858662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858662, "uuid": "cc5442d4-8497-4bef-ae73-177c30cb0f53", "comment": "Malware payload", "value": "a3387d44fa717db499d1ed3adbe7802e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858662, "uuid": "2ed64372-76dd-4d11-8e30-c62d7e9ebf14", "comment": "Malware payload", "value": "79da4cfb6ee1ff539df6c57542bf9586629df5b1763ddce4a3057a94e577cd15", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858662, "uuid": "cea4b2e9-6c7c-4fea-8084-2e89773a0e10", "comment": "Malware payload", "value": "81dbc6aa75074c3b9ad0b90d66e3ef56b2ca2d82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858662, "uuid": "feefb04b-3dd6-42d5-b5f6-92b56971f4e5", "comment": "Malware payload", "value": "eb095e47faafb413a8b9affa22c2853ce54f535b1c222409c73dfbf8a71153d4c8b49c8d0ebf195e715416cc180def79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858662, "uuid": "3a3f3cf6-2639-4419-8eb6-1ba9f6ae73ae", "value": "T1F4D36C49B24132BE99EF637A247F2306A737A56574128468F47CF2F0192CE495233EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858662, "uuid": "5441e880-05bc-408b-8504-c789c2b753b3", "value": "3072:MLUd7VzLC4MYcAQY6/0I7tPRx6PFWguUpDRPVlKYPg58gVMe:MId7VK4MYcAQY6/j7t6u+tVoYPgC/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698858662, "uuid": "5b4a791a-a62d-42bc-8837-842a0df7f821", "value": 134205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698858662, "uuid": "67005a3f-4222-48e8-96f0-0aaaeec48c91", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858662, "uuid": "fd738ceb-3216-4bc2-ad7d-26df517fa49a", "value": "Perferendisu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d78381-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819820, "uuid": "226d491d-14e0-4810-8936-af48ad94f1cc", "comment": "Malware payload", "value": "ef2fea4c6d0cb664462ba52b422e88ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819820, "uuid": "02763731-9c7e-4a42-8eb5-a7da3c047fb1", "comment": "Malware payload", "value": "7b501e912330576496b915c6f43f9d38f130b5ee7bc5c076118d955166a8a27c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819820, "uuid": "c8763df5-f47d-402e-93b3-c959dd7895ac", "comment": "Malware payload", "value": "813107aa7e5740708ea70a59f4ac1f43090676c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819820, "uuid": "c90053e6-08fe-4c16-97dc-1b16daa27574", "comment": "Malware payload", "value": "80faa04f0d0cac97ec5fd3dbb7de40cc61b8fc6d02e3cf32b56c501a2ca9b1336f40ce2923e40632a2dd96831c4586d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819820, "uuid": "1ab3c2ac-9020-45e9-a664-3f149f3be11e", "value": "T158534B576C91580ACAD4BBF825F091572A32BDE10520C1CBA8FDFE299E72353EDC51AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819820, "uuid": "373e7050-2ebf-4ef1-a877-72cc28294cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819820, "uuid": "fed70436-4603-4652-9c9d-2735f113cfb2", "value": "1536:RFSpiNqAQ8fyEt+8L630VDFN7TPxdF8o75F943hh:RMpiNqAQ8fyEt+DEVDFNfxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819820, "uuid": "7b736842-708e-4968-8b48-fa59e080e823", "value": 63560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819820, "uuid": "a9d45b11-d358-4bd5-9280-e96ad5ab62fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819820, "uuid": "d42dc0b3-fb76-4656-b94f-66816544379d", "value": "PO_5432168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a50e4b-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880697, "uuid": "449d475c-43ba-4367-a7f1-933bf2b5cae8", "comment": "Malware payload", "value": "12bc4313bb4386ab501d01422ab82e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880697, "uuid": "de10553c-ec31-4245-8d92-ad9fb5fe75d5", "comment": "Malware payload", "value": "7bb4b4847508416d97f911e2daddb5985e77f115aae6f6515f0e3d6d44358d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880697, "uuid": "bf79f290-9323-41b2-a0a2-20cfa8503992", "comment": "Malware payload", "value": "a9ccadc12ca13c46a1b0fa8c5863314f4a559029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880697, "uuid": "5efb9ea2-d5fa-47e2-a3c8-8aab61aa4b16", "comment": "Malware payload", "value": "eee763120525d89961c84eb68a9f6f03fcfe898e123421bbb2ee8d9037adc580ddb3e74915ac1294e50eac7cc47bb523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880697, "uuid": "162fc46d-8fe3-4a7e-92d8-df6a210fb01d", "value": "T18F342A53ED1C0DA1D0410170D9E7475D6631BD2276434A0BB3A8AAAFF9B139BEAE530F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880697, "uuid": "ec373a73-b664-4738-84a4-b200240c3b04", "value": "3072:oUiyA/ewu2LbbbZlmbbbaaAokYkvS4N71yAuUJ3QgzBrv3yPQAwFC:oErAokYkvSK71QgzF3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880697, "uuid": "0c0b9eb8-1b10-4b46-9a1c-a1344ab46022", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880697, "uuid": "99e7d523-8a54-4a3e-8bc0-10e30e0d88c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880697, "uuid": "e5a56c55-8ee1-4c8a-907b-1473026428ef", "value": "SecuriteInfo.com.W32.VBcrypt.I.gen.Eldorado.2224.17152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f0acb4-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821296, "uuid": "60ee7aac-349a-493f-96e0-78394ddd6c40", "comment": "Malware payload (AgentTesla)", "value": "3f287e5927edee66c7821ebc42513d17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821296, "uuid": "1de23b68-cecf-486b-9c7f-7e1b108dcbbf", "comment": "Malware payload (AgentTesla)", "value": "7bc24eab2671cdde0c8f509b33aa7d42234f85e9547957666bbbd363826e8973", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821296, "uuid": "4e10c96a-0649-4323-adf4-7dbf81736dca", "comment": "Malware payload (AgentTesla)", "value": "fac974c81d2cacd1d4d832fba1c9e802d947cf0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821296, "uuid": "a20738b0-082f-4cc6-a2d3-fe0f4876c31b", "comment": "Malware payload (AgentTesla)", "value": "1dacea00ce72aa96bb0f69f3c30642285995ffdc7efe200b84c3550704d2c16515d8cf8befd15fada9cbceb61846db98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821296, "uuid": "8623da93-811a-488b-844d-be4ed0983cde", "value": "T12C11210C6A1CA246A6877BC2D7ADE528DEA3FEF70643E4B82500CD540829474FFB0B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821296, "uuid": "4697899b-bd94-497c-951b-f8eeb1fbfd81", "value": "24:scMe+GVRWQHiv+XrfWl/Z+zG0GAYJW+t8/xJXgZXvy5MFTw1r:sctpiv+Q/Z+6sYJWyaxReeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821296, "uuid": "a37eab34-2f2d-44a9-b367-d992a2ba7b75", "value": 1016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821296, "uuid": "e9c8f83a-9d84-477b-aaed-3517f12c7f41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821296, "uuid": "7fcb6c90-62a4-49d9-9e57-1ac8075d61f9", "value": "SWIFT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6db274-7892-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698827998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827998, "uuid": "8de78624-0e08-4b92-85f4-bad1295b532f", "comment": "Malware payload (Formbook)", "value": "d3970fd03db03f3e026192203a110226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827998, "uuid": "b20e4aa9-a9c0-4829-af3d-f6bf87e6c58c", "comment": "Malware payload (Formbook)", "value": "7c0276edd9ce400d92a0b135a90b3d0f055991aad22ba1acb0fac193636eb621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827998, "uuid": "8efd57ad-f4c9-4736-aafd-cb4fc5da32a8", "comment": "Malware payload (Formbook)", "value": "65d7c87dedf0d99ebff535cfd3e81c34a06ceeb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827998, "uuid": "d262b683-c9e1-4b56-bed7-6c402dcdc79f", "comment": "Malware payload (Formbook)", "value": "b09c5781e9c7d88046610f6b2cab3a1ef5759378fa9ed2569da322a044ea03cd60cea94eb6b93ad31b5879aeddd086df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827998, "uuid": "6f42bc2b-3e50-4df2-9fe3-2e4bab3ba3f9", "value": "T19BF41250A7FE0B7AEE39C7F616645B042FF1716F6126E3488ED270D69569F000A81F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827998, "uuid": "44c65ccf-20ca-4af0-844d-36aa84b2eeab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827998, "uuid": "a33d5a00-57cd-4325-92f1-424f32bf5687", "value": "12288:K9LWtjIQpEB0gYGBKvzNDpZrbr174bKlhku8T1gXEZ3gzCt9EeYRGzwFOGueWAoC:KctsQ7gYMKLJppb6KlhmxQegsCLWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827998, "uuid": "176e0a59-3fbc-42e1-9f76-d5314fdb88b9", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827998, "uuid": "74a5245a-cfe4-4ffc-8c96-5093429b100a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827998, "uuid": "224ed8ed-c012-445a-a790-e6153848a409", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11e08ef-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855680, "uuid": "e3c6eb11-bdf9-41e0-96f0-82165dac5054", "comment": "Malware payload", "value": "b155db832bc67e83458837cd0f0fbe40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855680, "uuid": "6d1acb99-98fd-460a-a65b-f74735481326", "comment": "Malware payload", "value": "7dc14f3afe3e01a365c7a94a1cd7068104db00362227d638717e13d616560409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855680, "uuid": "60323063-a5bd-4a6b-b329-21298b593b85", "comment": "Malware payload", "value": "3d75aed0bf1e2de847b0c4cbd5d57cff3608c5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855680, "uuid": "2c1f0830-201b-4bdb-b572-11c344df9814", "comment": "Malware payload", "value": "27c2be2c92d09d9c1313342b1a2ffa0036ad8be20387a3d69d4c379c46cffb2b5e9656127f65391f8e97d0cfb9d00715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855680, "uuid": "dbf1e005-83f1-4870-be74-ad63806fb8c7", "value": "T117C52300B241DC42DDB906F41C6AE2BA50743FBB641EB56337817AFE2AF2E31954F256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855680, "uuid": "d5fee545-0571-47b3-9324-6fa2a0150d4d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855680, "uuid": "331fdbba-0fc8-4f43-92ad-3fee9240a4a0", "value": "49152:C52s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsh:CfzX71oDCRAZUviAHImDqia7hsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855680, "uuid": "07be95e0-4072-44cc-9617-48fc0a5f4a4a", "value": 2671885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855680, "uuid": "f496bc56-0e08-42c9-9969-3b0cc6f26742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855680, "uuid": "815c0707-3587-439c-bd2f-0d20aab8924c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f893bea-789e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698833209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833209, "uuid": "b4143baf-73c5-4d2c-bdd6-7e21841cc9e3", "comment": "Malware payload (Mirai)", "value": "003b68359601e665934fbc95fe3e4472", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833209, "uuid": "daa8f954-1cc9-4910-b94b-bfc65d53727d", "comment": "Malware payload (Mirai)", "value": "7e7f630c0c723783cc08656d71b2af911badd703c76a09c32d54fa5b800f7a54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833209, "uuid": "6cff3dc0-f52d-44c5-99f4-66eddfcf4cf2", "comment": "Malware payload (Mirai)", "value": "41061cec876efe4b7c19b1f82777c1055506c3fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833209, "uuid": "2f9e1f23-23e3-418c-8b4f-3e14746568c6", "comment": "Malware payload (Mirai)", "value": "c6daf95cc043d97486dd3bef76d456d8474bae9d50c02b275c9e3bb62672f59d5a4ae560471201d32985184ac5a75c76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833209, "uuid": "59503e05-af72-4c7e-bdff-cc85fb833809", "value": "T151632A46BC818B14C9D5167EFF0D528E33171B78E3EE73239A205F21BB8A96B0E76511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833209, "uuid": "889e009f-25b8-4ca4-a801-90494d899d83", "value": "1536:QTnk9hjfHvJ7CK1QeWgxIBYEfmWBnZMYiZS8VJEIDr7IxY:dfvAe+QS8VJEIDrMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833209, "uuid": "50e1deb2-8f38-46a7-b864-1a2b7f10d153", "value": 72788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833209, "uuid": "641da703-876b-40f6-b537-f617512514dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833209, "uuid": "6fd9d6f8-a013-4bbc-aa0a-a979d8793469", "value": "003b68359601e665934fbc95fe3e4472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ea1d94-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833571, "uuid": "e68ccee8-d6ea-4cb7-a0b8-f0b93894aa4b", "comment": "Malware payload (AgentTesla)", "value": "c36fece019eaa54bb9053c02103dc82b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833571, "uuid": "255869f9-8e40-42d3-b8c8-2209f9b07e4f", "comment": "Malware payload (AgentTesla)", "value": "7ea1426fc3c2782a12ab97cf39d25438dec33d2964d53f08bf615f54813ad660", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833571, "uuid": "a99b3a2c-6703-402a-80bb-07cb01dce56e", "comment": "Malware payload (AgentTesla)", "value": "74ded19cad091a7543a3bc1cd248504bc5781681", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833571, "uuid": "49d139e6-3924-4a8e-b142-cbc0276a5a1c", "comment": "Malware payload (AgentTesla)", "value": "c111309a93b75db8b76b3a17dba370e269340f80b873e41d10f6e4111d0928ce7f8df52b5dd7621d10fd0a2ab157f4f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833571, "uuid": "3d4ad8a6-221c-45e0-adeb-8b9c70f266d6", "value": "T1B545063228728061EEFEC1347CD1B765462438BE9ED94FC7F59C76EA3A632D1523019A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833571, "uuid": "5024b4ff-1f32-47c4-a67e-be0181c3e94b", "value": "3072:lCDKW1LgppLRHMY0TBfJvjcTp5XJpv8xyfOssWHRJFk48:cDKW1Lgbdl0TBBvjc/Jax2XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833571, "uuid": "8b2dae83-11bf-451c-9753-58f98831857f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833571, "uuid": "6f1d8c12-1032-44b1-839e-99bf9ae12926", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833571, "uuid": "b42a9d44-4499-4095-b521-228e154c30df", "value": "PO43100077.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99e3884-78ee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698867693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698867693, "uuid": "5ca32740-a7ed-4c6a-a41e-c7dc785bf42e", "comment": "Malware payload", "value": "2f37190da5ec2f9ec73878506e1c0614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698867693, "uuid": "22bba8df-211d-42b3-afba-e598e63decd5", "comment": "Malware payload", "value": "7f5fd51b97907e7dbad4a79aea928d562d93dc56dd7320a6823dcd55fe1b727c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698867693, "uuid": "2621c97b-751b-420d-864c-2359b9bc293b", "comment": "Malware payload", "value": "bd8e9a880fd2ec54883dbf51739f8fde973cc5b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698867693, "uuid": "246a1a80-a4c2-408f-9525-80994ffd7fd1", "comment": "Malware payload", "value": "eacd615fc9c9ffb6902d8e3a21972375161b4264ef16e96e1df8eecc3be46acbf008aa63c5216722fe66e62d7d4e0eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698867693, "uuid": "18d92232-0f9b-45f3-a8ef-a3fccfbba205", "value": "T10B47CA1FAF8F133E16E14337720DA9E4A3368C3936EE89315499A03932D187D5579AEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698867693, "uuid": "a01cd045-3473-4b69-bbd4-6b47c2646b76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698867693, "uuid": "42496387-22b5-49d9-8576-ef2d11b5074b", "value": "49152:EVyhvFQWWfPD+FQpxs09MIWEgV7jrNUHPT8K3gaQbQ/ataj6HvyFZ+cQXSp+SJ8f:fnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698867693, "uuid": "d941869c-cf8b-4dea-adc4-f29caa902c6d", "value": 26430153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698867693, "uuid": "8e361e2c-73aa-4ec1-abf6-3a9ef5faf178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698867693, "uuid": "8964021b-f30f-4179-b903-fdef1d102561", "value": "carteid_filigrane.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2701eb69-786b-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698811210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698811210, "uuid": "9f0ebae2-6c06-4a51-9951-9067b6f27fc4", "comment": "Malware payload (Loki)", "value": "d4bc1a116cb96991aa3181d45a4cd46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698811210, "uuid": "db0da09a-e8b1-411e-b3e3-cd89d61d5dcd", "comment": "Malware payload (Loki)", "value": "7fd6a6403f2ad4e6f878924e00ac7d72f5855969276284ee7a9459f6f8c9b26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698811210, "uuid": "d81fa5a9-ead6-41fc-89cc-cf5ee9c773fc", "comment": "Malware payload (Loki)", "value": "4839e63edc029d5d28f42607b2c0f5eb360fd350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698811210, "uuid": "ef6a00c2-d9ca-4f0e-8771-b0a2db66d3d3", "comment": "Malware payload (Loki)", "value": "94dc6541523f0e274b5dcdc01cb89cef257bf57ebd4a45848caa11784a15a783554267e6926cf27500b329cee1a276ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698811210, "uuid": "d3771fb8-48fe-40f1-a8ec-af516c407137", "value": "T106057CEC365079DFC967CD76CA982C64EA206477930BD243902316ED9A0DA97EF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698811210, "uuid": "66ec1769-4126-4d5f-beca-14876bca8c10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698811210, "uuid": "d5853e8c-4d71-4321-bfe3-5e5bbd954586", "value": "12288:x3RRR8QGY/Z3oaIV040cDaaTp2KG/KIDtTBjt9YjXgXmNgl3dOTlHlsYVQbnPpUq:xhRR8M/gqcDaa12KUtTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698811210, "uuid": "fe558622-7d78-40a5-87ea-9542e54f4ab6", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698811210, "uuid": "fd735c79-c56f-4205-8671-12479607ef48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698811210, "uuid": "fb3507e8-0856-4164-8b7e-053d8942fd37", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c199a2bb-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698821348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821348, "uuid": "a8c95f40-2d44-478c-9094-636b1bc30600", "comment": "Malware payload (Formbook)", "value": "ceccf9c702cec9bf92bdcb828beca655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821348, "uuid": "4208a4c2-d331-4c88-a444-0d84ae9c4a93", "comment": "Malware payload (Formbook)", "value": "80bb6faabfb8cfdfc6f858a50b3893f0df49b414087619470cafce4ea26af74c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821348, "uuid": "92713e55-c714-4e9e-8e73-36f14f9732a3", "comment": "Malware payload (Formbook)", "value": "b166c7e1a06a1a1af0b00e3a696de323983faec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821348, "uuid": "86f72391-d95e-4b9e-84cf-441e4380f8cd", "comment": "Malware payload (Formbook)", "value": "d1aa8fcc56f59f350c452b75fda602b030f09f85900e9afc634294e0cb1efd7aedad7e701dfd2fc94fc0da18985200d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821348, "uuid": "bffbfa06-096a-4453-afc1-8e9458cbbf1e", "value": "T1B1C4235035ED67A3F0FC3BFA9C2522604775A161A690CB195CE7B2FE2963F428644F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821348, "uuid": "48f3acf6-67ec-4b0f-b383-448076a97e2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821348, "uuid": "b61105a0-a350-4b66-9556-88a7bcf32900", "value": "12288:tLpkoaH/qViAGaNIy5+nnyvjnLFzEXr8Cz9HZztXZuG8YwxAhuQEEqzRlsmGRtd:BpgiViAgyIyXJEAyZtXB87xAMdEZmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821348, "uuid": "8aad7b23-e403-46aa-9876-3d94c3bece78", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821348, "uuid": "9f1d7a6e-9f19-4212-8885-848a5df4b5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821348, "uuid": "3d25e6a5-bff4-41a7-8390-9a2be73d379b", "value": "31102023_cmlmaas_dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c3a1d8-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698854299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854299, "uuid": "8eef7444-8e94-4bc2-ac76-cd6a10de3653", "comment": "Malware payload (GuLoader)", "value": "93cd4b25990bf72c8ba462b017c39ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854299, "uuid": "cfbb5f21-fc4c-4e42-b001-112e2b9a1262", "comment": "Malware payload (GuLoader)", "value": "811b3b4b3b7b9b23319329cce72eedc58fe0b780ff053699ca6e1c92bfa44910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854299, "uuid": "6283bf2f-770d-46db-8bc8-e458371ca857", "comment": "Malware payload (GuLoader)", "value": "d2b03932f2e52946e17e09c21ad41bf3ea55bf3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854299, "uuid": "32228cea-3006-452e-94ab-2d7003ff1a9d", "comment": "Malware payload (GuLoader)", "value": "8c1fa43b88cf448b3b911c5ff6087b849c2393885b909d8da816c60e5ceb37c098649948753f218967e8ac6a85da65f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854299, "uuid": "d36a3231-4c62-4163-beb4-a8eedb7faa6d", "value": "T1696523182944C653C35229BD4ABAC2F4A2B5FD81F91552D7EF3CBA4DB8761C0EB09BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854299, "uuid": "72a27072-6230-4527-901f-5ff9b9fbc8e8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854299, "uuid": "4ff9cb6f-4225-4461-a4d2-910b751872d7", "value": "24576:4Kk6Zm07lfrp7MangGR4rXq7LWLwbpclU12Z1owyMsMtBH9I9QoP8YfyWhk2xRUr:9kj0xfrOWgY4TFwbylFZ1l7wQokD09Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854299, "uuid": "bb421864-3277-451c-b84b-d7105e83fa0f", "value": 1512130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854299, "uuid": "660e4c4c-b0f0-4e9b-9df1-cc3f4391f79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854299, "uuid": "032cc733-1b81-45d4-864a-34f8da87cb2e", "value": "BESTELL-Nr. 67Z50-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c4b89c-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833517, "uuid": "51491197-92b5-4f6a-8a8c-3258f6fa7c84", "comment": "Malware payload", "value": "f4c7fa623b2d25657dab71a124bebcdd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833517, "uuid": "bf444b3d-c330-4095-be54-c306bd601370", "comment": "Malware payload", "value": "844fd0746ea5fd3ba1e19e4f92a2d4a3dbf0482470c85b6657979f749d8d13ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833517, "uuid": "8ce0d466-f0c8-4e47-80aa-034639cecf4f", "comment": "Malware payload", "value": "f130ce1b39c24c913e3ca8f0a0ee9c43d64bcdfb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833517, "uuid": "3ecc2637-10f5-42f7-9389-06f63aa8a5c9", "comment": "Malware payload", "value": "fed6645b5daa1d5c92894ba6c1b24a8700aff1809699ad01d6464e7b1d939f6546bb94f898aefc87e478e90e0507c01c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833517, "uuid": "52d237ab-92ab-4b91-a61f-e9bba3973e4d", "value": "T19B643B9D7164743805C5506D902F1A0BFA37252D286AC45CB36CF4FFA8BCE8931BABB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833517, "uuid": "72b31e0a-97db-4764-88ed-6db9b8466224", "value": "6144:c9ClMipUF6wFwvP6IoPajJroC7oafG075CGY:c9ClPpUM1o67YGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833517, "uuid": "72269a52-f64e-4408-9fd8-b4c961af2c9f", "value": 333294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833517, "uuid": "5a71cba4-36e9-43d4-aed3-0749964493b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833517, "uuid": "24b009fc-62e0-4087-afd2-8a65356cab62", "value": "Animih.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391bbbfd-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698833574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833574, "uuid": "5b64632f-55a1-4727-a088-d745e6228e43", "comment": "Malware payload (Formbook)", "value": "696c362b9ebf6021785b79a07926c835", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833574, "uuid": "493efcaf-17b6-4fdd-8599-c21c5a1593d5", "comment": "Malware payload (Formbook)", "value": "84f3e2c99f3e25a6518ebadb00344af59e2fc1cda8f8153d78f57e7146896e6a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833574, "uuid": "a6d2b8cc-2370-45e7-9f0f-52f33c33a6af", "comment": "Malware payload (Formbook)", "value": "7fae3ac53e27e7f7b9303576a548cd6688c14fa6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833574, "uuid": "6172e627-0c04-43a8-80c7-2bbf496581d3", "comment": "Malware payload (Formbook)", "value": "ad09ee6ca44b3ad22d9af4fde796e479556fdeb8871f4681f1e6bb753cff50500e217019121d277d7d80d2598e324413", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833574, "uuid": "d0981352-b281-4b6c-b6e6-f4ccfff7c6ee", "value": "T14534336DE34B01A98F62533B9B5B0E4941BCBA3EF38511B0346C437933EAD39912667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833574, "uuid": "c8dd2fee-74db-4eb1-884d-a90c0f822d23", "value": "768:jwAbZSibMX9gRWjcMwUyUPp3K1OZ+RhrHbJsDnYHA5nM/Dj:jwAlR+wOP88ZmfJsDnUAZMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833574, "uuid": "42f907e0-dd9d-4453-8eeb-f6c2168c7ce3", "value": 240912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833574, "uuid": "c107a7b6-7d59-44dd-b520-334abd3366f1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833574, "uuid": "f26f1277-9614-42d9-8f8f-dbaa536861a7", "value": "PO No. UVG-06-2023-24_1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bb5b54-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880729, "uuid": "67616a80-bf5e-4688-bff8-1a0405513cfa", "comment": "Malware payload", "value": "ea3e3c58f12da256cd219c0776b108fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880729, "uuid": "29aba458-2f4d-44b5-80e9-2bb6d85b5345", "comment": "Malware payload", "value": "863cc0ee49e1e81d1f5c8160fbabeeab1448ac2951400a34ec18d8a2c54d4ac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880729, "uuid": "8ae9d477-c531-48d6-9e0c-0e5bc6cb59e0", "comment": "Malware payload", "value": "cf0a1950d1cabe76e515e30f4292b34198967bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880729, "uuid": "2fde5808-f298-467e-9295-49d54fa36208", "comment": "Malware payload", "value": "9104bead04087e9ad9dc3e2a42a757dec2914299aeb8061128ebed4ce9a47a18f931c9f995711f4cffd0a671f9bb9c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880729, "uuid": "1939fc2a-71d2-4751-853f-44231118812d", "value": "T19CA62623B191C3A2D1151930CC6FAEED9624FE55CE519A8373D2BB6E2DF1390B522339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880729, "uuid": "d5bb3ac8-7cc5-4e58-a8d5-4cd3f0b43d27", "value": "24576:wOjyoZ8W7vqJCmXhwV6uOCooLPCiFuTA5F:wOjyoZ8W7VAoZZFuTA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880729, "uuid": "c3c61bba-51e2-454f-8449-dcded33808f1", "value": 9667584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880729, "uuid": "2cba90d7-9ca3-422d-9bc4-cdeed534fd13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880729, "uuid": "8602d808-c55f-499c-bd64-8994eca9ce37", "value": "SecuriteInfo.com.Trojan.DownLoader39.9180.1991.5130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9d6ef7-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820075, "uuid": "b45bb345-4a3b-4709-825d-df8fd8f200e6", "comment": "Malware payload (AgentTesla)", "value": "05f56b40b4779f7e282669898479e78c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820075, "uuid": "730e632d-15bf-4f3e-b3f7-6a2830c2090b", "comment": "Malware payload (AgentTesla)", "value": "8772b4c9a9acd1587e2f238db5489d0c7df58dc2563f0f4e04e30a0026289de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820075, "uuid": "4b6acada-bd6c-4aaf-9cdf-59376467f675", "comment": "Malware payload (AgentTesla)", "value": "958eb2cb72aeeb7b0bc382c782fe3dc9c0bb2f12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820075, "uuid": "ed952b3e-2ade-4b0c-aed1-b639a5fad871", "comment": "Malware payload (AgentTesla)", "value": "3c7b5c883d31690e0b93c28b2f966634440e491cac2faf84d177e115f88bdded602977cccb6af88a8eb577b954eaa1e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820075, "uuid": "2ff8ad81-8b36-4850-9092-52e0e256e940", "value": "T12B736C1137979515C90A9531D4E786300BF2EBC761F3E3CE3AC852464F523DA8E8AB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820075, "uuid": "5c07566d-092c-4c03-88eb-7d0fec2a1d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820075, "uuid": "7bc1c710-b736-41c3-a6f7-6a6be2f9a42c", "value": "1536:aYXpCiffaoD2GqktAgGyyj4d7TPxdFP75Fbnd3hT5:aYXpCiftSG3tAbyycdfxvPXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820075, "uuid": "8c7b7fd7-652d-48f2-8a9c-1298e7ed1283", "value": 77888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820075, "uuid": "66b63c40-1859-4b78-b897-83b3a6da55fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820075, "uuid": "ddab06a8-4946-4eb3-bb36-0029f34154dc", "value": "\u0391\u03c0\u03cc\u03b4\u03b5\u03b9\u03be\u03b7 \u03bc\u03b5\u03c4\u03b1\u03c6\u03bf\u03c1\u03ac\u03c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443a5f6d-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698825862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825862, "uuid": "08d1f6ee-33a4-4ad0-9a09-b5efcdc3f3b5", "comment": "Malware payload (RemcosRAT)", "value": "be556f66e3086d9bf5465c33d51c0921", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825862, "uuid": "843e6d9d-b821-4dbc-9a39-b3fc028d0ba1", "comment": "Malware payload (RemcosRAT)", "value": "879b9830c133cfc616497be434cd8f9988f91fa217e42f30afa21a2ab08ddeab", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825862, "uuid": "7698a971-aa3d-4ead-a3cc-69c4887dd835", "comment": "Malware payload (RemcosRAT)", "value": "f823e1caf92397d41e46aca724b693bc2d6e56e5", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825862, "uuid": "d2082a37-1332-4a76-8fc6-5502d8ea6171", "comment": "Malware payload (RemcosRAT)", "value": "73fef1f90e5d276f0b10a90b1d722300c7ef3562e5c48efac6a9f086305803f9555cb1723a577ae1093c1da44bd3efcf", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825862, "uuid": "35cbc9da-55d3-4dce-886f-a7664ba871a4", "value": "T1148423DC66B1C671A761C2B35EB305FCDAC6EB30DBA14BE72A082F718191756FC48162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825862, "uuid": "cfb652c6-53e0-482c-8700-db6d3ed63629", "value": "6144:qvGAVmi/iCpLqriVyashjXnwENr1gOfqFTDJW/cVQY3PGE86uFFqLY7+LyH5nf:qvNVmf6LVvEr3qFT5r+rfqM7+0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825862, "uuid": "2d7435af-570a-4887-8732-342f85acac53", "value": 389043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825862, "uuid": "ff3ad97d-8249-4137-9320-bbcf9761d2bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825862, "uuid": "3e9beb82-8976-494c-bc4c-c070e78974d6", "value": "87654345678900-98.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b8c9d7-7853-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698800843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698800843, "uuid": "5a91e0d1-b274-4d44-944e-b2ae8239005b", "comment": "Malware payload (njrat)", "value": "a3352857ad5be8542c961e979f99c206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698800843, "uuid": "ddfb8f30-d29a-44a6-9ec6-7dab624454fd", "comment": "Malware payload (njrat)", "value": "88e3771d0df5183c6e49438db031e378b1d85be315f6f477617a1ca698944ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698800843, "uuid": "d94c21ef-8f39-4aa8-bf5d-fc7fd57ee244", "comment": "Malware payload (njrat)", "value": "da7432c7c6e845e7527b1afc1bf3eff059ec5fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698800843, "uuid": "e196a765-9eff-4fa6-adae-43ba461f3c87", "comment": "Malware payload (njrat)", "value": "3960a5554d0d9b855f23bf870d1b0add4e33fa3b4829b56df119b721b31d36f180b8742151a5e98e3735c93f503ee807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698800843, "uuid": "c3bf0f75-2839-4189-af71-730d497d497c", "value": "T1A8B22A4E3FA98856C5BC177486A6965003B0A1470413EE2FCCC564DBAFB3AD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698800843, "uuid": "bc2af40f-67e6-4fd4-ace8-7b487ff526f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698800843, "uuid": "544f5b32-4081-440a-9d3d-8e5872c2deac", "value": "384:v+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZyE:Im+71d5XRpcnuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698800843, "uuid": "73735c7d-39cd-453c-8d18-f0aac685691c", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698800843, "uuid": "240d8cb3-9158-42f8-940c-f2e98865d101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698800843, "uuid": "48665eb4-b5c4-48b0-86fc-9718df48bade", "value": "bRdP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf7eed0-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820102, "uuid": "56547334-8039-41e3-baff-09a1187865e1", "comment": "Malware payload", "value": "6308bd6a815659afe1f66786ec75ed12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820102, "uuid": "1efd21b7-5c57-4334-8aad-9c5a9ea90851", "comment": "Malware payload", "value": "895e8e6ee4a3577c175f78833c6e9c61a5fad8d3708befa924ddca2262daf378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820102, "uuid": "e7bb2069-c881-4f8f-9ae1-4a229fb3f730", "comment": "Malware payload", "value": "37b5d6b39d1eca91123133546cc27eaeccd68a0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820102, "uuid": "6623b902-6a63-425a-8d3b-3ba35e5f3e11", "comment": "Malware payload", "value": "810b13ad2314ce876bb262d29ea1d513b6ce079b02ea357b8715eafd4e15e6b15197633e896cff73cfcf67f27f9c8d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820102, "uuid": "8cba7679-c5f0-45bf-aaf7-334392084d89", "value": "T1A00332DC722471DFC867D072CEA95D74AA6078BF830B4217A09722AEDA5D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820102, "uuid": "1a2a917d-fd49-4a21-92a1-0ff09c2def95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820102, "uuid": "83c1a217-3709-4bc1-98b7-581925e8322d", "value": "768:8T4kQBwu9B/2mTqZPNuntpZDVQRUAmyjI:8sBnBt+ZPUDGRAyjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820102, "uuid": "f9d62cfe-9e87-4192-b1ea-7c4a5f762067", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820102, "uuid": "230e81ba-4b11-468b-a9f0-dd31dffed6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820102, "uuid": "a6e3ca1f-e3da-4bc0-847e-125ea6089cba", "value": "NMKLPO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f414dff2-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880703, "uuid": "2b5e5df3-8773-482c-a971-ecd5d856c577", "comment": "Malware payload", "value": "1f587492bd6d6225cc925f18f0407c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880703, "uuid": "14b01002-97a1-48d9-a2c9-8864ebb19290", "comment": "Malware payload", "value": "8a847c605bde4c3a8f73142c60ba675f71c56cfe874ee872a871e1f336a622da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880703, "uuid": "ec6292ec-cf17-4117-9def-4387c90a3b10", "comment": "Malware payload", "value": "cba138593246ea4e1d8572708f7cb7747ae0eb81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880703, "uuid": "b960e02c-5174-4736-8472-6089687cf744", "comment": "Malware payload", "value": "8f0a9df3eb8e6ff9aca9efd28d39ca1b3b1fe4885208abd99e3b4ab42830f8be768be7bf90a1efcc647eb889dab6561e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880703, "uuid": "adf41b57-afdb-4495-9645-38489c935d71", "value": "T1ACE5CF11B741C035EAA711B68E7EDA6D46287D201B2518CBB3CC3E6D5F726E27D3128B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880703, "uuid": "88459e80-7bfc-4323-a950-42fd4f02c119", "value": "e4bf5fe72e8f452d5a4586d1455d2f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880703, "uuid": "419ccf29-8842-446a-8849-6b5504df67ac", "value": "49152:B85/PEQ3oMcdqllfgaYChNxZvlv57O4qGgUcPL8Jr9hg6krnMRfKZhf:B85/8Q3ov4lfQCHZH7xtior9hg6koRy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880703, "uuid": "5dc24401-6513-49a9-83fd-97b1e506c899", "value": 3049336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880703, "uuid": "007bd7fd-10a9-4772-ab1a-fb9349a87c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880703, "uuid": "bde754ff-9789-4fe3-83e1-3cd5266615cf", "value": "SecuriteInfo.com.BScope.TrojanDropper.Dinwod.16769.5740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc62a398-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880717, "uuid": "a66c9f55-4658-4b5d-aeca-9c9b008ac724", "comment": "Malware payload", "value": "6f348918b553bf7c167ba27067b928a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880717, "uuid": "21a21b12-ca8c-4d8d-8362-f1f7fd623999", "comment": "Malware payload", "value": "8ab4ccafd5507ff66c8495ad3ab09228a0cdd70b7fdb33814bc04c56d60d0694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880717, "uuid": "d2036562-5148-4119-bc73-ece6e5eddf39", "comment": "Malware payload", "value": "0bd7a9df3981cd3486873c41e7443820d1e8f8fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880717, "uuid": "c14423dd-e360-4b88-9424-467d39603e02", "comment": "Malware payload", "value": "c748a28e932ddfc9ec7896f1390d5cf0cd12592651559e45bfbac945a5218fa156410d0858ba8e6617bdd811ec24e623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880717, "uuid": "1c243714-5a87-4df7-80da-02684759b9d8", "value": "T1D5942A2372E1C424F1214236DDB197E7E96DFD625324651BB288BA2DEF33250CF3A616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880717, "uuid": "120cf86d-a4e7-453a-920b-7010d5c4bb71", "value": "2ec3794441edd0885a7d0ce3032ac832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880717, "uuid": "cd61ecaa-6ecb-4d13-8c6e-78a2516c6e4a", "value": "6144:45xmTJzTJHuwkfrkSNwwCUkiP0Q3ZrMK5vmfSzpa8XaYlrfNRbNfdNlaj:45QfHuwkztNwPJQ3l1lJXaYIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880717, "uuid": "32e09971-cf23-45d3-a0c2-8d1b9cb53d59", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880717, "uuid": "d01f8c8c-ee6e-4000-9370-d8d124768354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880717, "uuid": "ef86bfff-657b-4349-b1f7-17fc7e812b74", "value": "SecuriteInfo.com.Backdoor.VB.131.7645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b801dc-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819925, "uuid": "d60bba2c-2f38-4604-937c-4dce8a59f8ca", "comment": "Malware payload (DarkCloud)", "value": "16176ed4d665a34c7ebdec58a7a81af0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819925, "uuid": "6182d71a-97bc-468b-af0f-f6f183d0e883", "comment": "Malware payload (DarkCloud)", "value": "8bcea0e85866e00681b5ce6c14c70ac359d07abf85a057d5ffc4a816a644e13b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819925, "uuid": "4c94da61-f8d9-4874-8ed6-8e2304b3e7e8", "comment": "Malware payload (DarkCloud)", "value": "248c9fd12c230df81cbda633463b5517af05fbe4", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819925, "uuid": "5c184f41-21d8-42c0-b22c-3e3c342d493d", "comment": "Malware payload (DarkCloud)", "value": "a3118af7a150de1e4b51172dbf7c0d77562b0f7b7928ff00dfb420edd3ce9e7d16da638208fb14d14bfcbf25d5840d75", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819925, "uuid": "ee6c1079-33eb-404a-889d-5c7083ecdf88", "value": "T17EC4DF513D5D4205D97EF7F0A2E34ED2832EBC299D298006D9F5B249957222BCCC2F9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819925, "uuid": "ffb28f63-f120-4a0a-8308-ad48b3aac56a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819925, "uuid": "cc516b95-a214-44fb-9a4b-310ce13dd602", "value": "12288:pAicOl1SeVWVUiFA/dTa3ILCGmvx16+jFGIVKsti1Ub7Czd:6VU80dO30CGmJY+JGIbU1vzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819925, "uuid": "d3c542b3-1b6c-4f87-b869-d19b83cd0f56", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819925, "uuid": "bbfedaed-b0c6-4b3d-ae69-d8c71ab121fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819925, "uuid": "ae413c96-93e9-4096-b48d-fa884a5a68e9", "value": "t4567898765d0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cac4c2-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833547, "uuid": "6ebfa62e-01ba-4ee1-aac2-ebba1db97a4d", "comment": "Malware payload", "value": "a096634da2771fe5991cac35dc197e0f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833547, "uuid": "c22a0d97-1200-47bc-a65f-081af39c1270", "comment": "Malware payload", "value": "8c94ccafd5a2f4fc746c3dcf1e38e88db3e51598ae7c679f5e4b101f7bafbf43", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833547, "uuid": "9cac2c94-4f57-4287-a5aa-074d757eb054", "comment": "Malware payload", "value": "c245c6415e8b8913700cc7501d3aa1371332cd5e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833547, "uuid": "9fba0303-1e5e-4c7e-8b90-301c48a1ea04", "comment": "Malware payload", "value": "141b1a4114a3b87b404317abbfee7103c870d989e02a05ad4f66cf687ba97d178472fd391ab0b605cbc064bb9ac71adb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833547, "uuid": "abda5ed1-9c86-42a9-9a5b-2201d2e6e97a", "value": "T1A3141208F565DB1A55AFD23ED91288801C27737E7F0E6B549E830528FF68E383705AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833547, "uuid": "9a91b72f-bf09-41af-8a8f-94b476d92595", "value": "3072:EgjVXGR+visDrSu2eIDgdoVbHTmqZjLcnQep9il3WbVIEeRvJy63+RyU3JMKM4Wz:LxE3svJ2NDgdoVzmq5LcnQU9i32jIvJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833547, "uuid": "398eb8d2-5ad5-4aea-9a05-e27dcc50f0e0", "value": 194482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833547, "uuid": "0dc52e06-662d-487e-9934-5360fa2181bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833547, "uuid": "a6071713-1d82-4e11-88bf-9907f0475998", "value": "Nulla1t.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afb5b83-7909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698879077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879077, "uuid": "07a6fd5d-9a55-4ffe-9129-8e007509d8b9", "comment": "Malware payload (Mirai)", "value": "f958381b3dd03f4ff70bd6d3cb301caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879077, "uuid": "182a7bb0-2e13-448e-88fd-3dfc9e7fb5a5", "comment": "Malware payload (Mirai)", "value": "8ca3f3afefdcdbc0e69a4334530a8f92248355f460aa981b78c24c8e9c934fa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879077, "uuid": "69922415-54fc-4339-9816-37b4a8e48098", "comment": "Malware payload (Mirai)", "value": "12f0a9e2992a64d199708fd0d8f2a0afbbba8250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879077, "uuid": "7b368295-9723-4b5c-86b2-a5a1fc55bfb0", "comment": "Malware payload (Mirai)", "value": "fb5d7f3a53d99dee0b62361aa1596ec0fd130c63473e15218c79588beb4aedb43a3c7d07460623a756749e349b5b9ea8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879077, "uuid": "505e87ad-fc86-4768-9b4e-14757beb4786", "value": "T176C2E19415A2EF16C4354C72CAB48E831E7696B873A132B13F8917D7D52428ECDB8B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879077, "uuid": "656abc50-1dba-42cf-b552-d37874e404ee", "value": "768:9ZqbD9poewFRgjRm6O7NxKnSXQnskn+T6Os3Uozh:9s/9KgV+jDXQsm+TCzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698879077, "uuid": "445915af-e29d-439c-ac3d-018007c750e6", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698879077, "uuid": "1550b2ba-98bb-4b09-9c21-fe92c222ec8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879077, "uuid": "69cce849-9634-4f99-bd25-abd187d14ba0", "value": "f958381b3dd03f4ff70bd6d3cb301caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3487ecb-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698820009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820009, "uuid": "fae8c310-f1cd-4522-abdd-09a925c78f6e", "comment": "Malware payload (DarkCloud)", "value": "93aa02f9d3e6cad28fbb22ce0b32966e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820009, "uuid": "6472ed98-ab18-4dce-a72d-0a788ae0afb8", "comment": "Malware payload (DarkCloud)", "value": "8cf77a7dc3990a9bace47ff27082f1c535375b16eaf2a08209956969c55bb854", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820009, "uuid": "e20f9e44-92df-42fb-bd1d-0bbbbd52a378", "comment": "Malware payload (DarkCloud)", "value": "49f77909b362e392d9e6c42a480ce571b8a2fd67", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820009, "uuid": "ffbeac94-420b-4a0c-a442-384d6678628b", "comment": "Malware payload (DarkCloud)", "value": "168aacf06fab10b365fd755efbb11e568efbabf2e16d5fbb0503b3b8c6a15e83d4ecbc2c91e9d2d92aa32a2fb5d562ed", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820009, "uuid": "ac8a9053-7e28-4e63-bc5b-4ccef7cdf37f", "value": "T1A4F4CF0032694FC7F3798BF25470260897B63D2A662EE3595EC252CE2E73B1087D7A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820009, "uuid": "31ae8b31-3165-4356-860b-95e1319410d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820009, "uuid": "9e0e1c4c-86aa-43ab-bcaa-898708fa0be4", "value": "24576:gHcQdQEg7GoXhrDpDe/Tu+YxilykINcwq:gfQhJBo/Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820009, "uuid": "e25c2327-4bf5-4308-8c38-7ea8cc12c3a6", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820009, "uuid": "7c09b570-ecdd-441d-9f6d-0fededb40c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820009, "uuid": "970d6f66-64fb-4089-9f5f-5a70a74580e3", "value": "D2CAQ00878900098778900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797deed5-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698855587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855587, "uuid": "1be2847c-f0db-4066-8c21-a65110947997", "comment": "Malware payload", "value": "435349e522547c3b399763931bf3a85c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855587, "uuid": "4de18b39-0b52-4789-88b8-6fca400315b2", "comment": "Malware payload", "value": "8e30b2ee061da11247938e23e08171d24954c1b7afd09268e98e1cde1ff87cfa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855587, "uuid": "1c924cec-14fb-49ea-9c52-6ff33d483ed9", "comment": "Malware payload", "value": "0108cb42f12dee27d8407a6bed5aac0f42ba8789", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855587, "uuid": "7b1aa913-c687-43e3-924f-f5b5641b9c34", "comment": "Malware payload", "value": "c32144208ae35fa77d78c75407230de7d1931fae63f73cdf9d40605ff092ba2da3f0443d6e9c13f1613ea8ce767f71fd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855587, "uuid": "e26ede3d-348d-4bcf-b476-26b11161f34f", "value": "T191D319E2B29BCC79CB6D0BB149E5CA5B62336C60DE1203073375B3AA5F766B1150352E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855587, "uuid": "60867603-fe3b-44c6-8567-ea37f38f0f1d", "value": "3072:Yv7MDSd031eTZpDm+TGDHidAkTG5E8B/6/smWbosjZfiiD6:e7MDSd031eTZpDm+TGDHidAkTG5E8B/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855587, "uuid": "1464146a-e789-47c7-a926-715e740a9cd3", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855587, "uuid": "95695938-c99f-4fac-98e8-1c41b404d600", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855587, "uuid": "f8e08bd0-4a1b-49ad-8909-2a3e1680e618", "value": "DHL-1898668516-IV.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d49ec8-788a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698824741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824741, "uuid": "d51223fe-f93c-458b-9f15-2d23cfbc00e5", "comment": "Malware payload (RedLineStealer)", "value": "09dabc1bc515b8541815d52d228faf63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824741, "uuid": "92175699-9ca1-4de5-ad61-b0f02acd0297", "comment": "Malware payload (RedLineStealer)", "value": "8eb6f512ec7e18a1c59102f0474b6c7ddbffb0c8b841db2d1ca26765417f3398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824741, "uuid": "42b9e456-9c89-4462-8d7a-56c90e2c3601", "comment": "Malware payload (RedLineStealer)", "value": "911e533b6a22f7b41a755781ac63298e8f5abc53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824741, "uuid": "e5e4a901-3582-486a-8887-c6da1e72c6d9", "comment": "Malware payload (RedLineStealer)", "value": "69421dc454f7f67cf16fe6e19842406d90e55c0b3b94cff1c01a2e37a4bbffebddfdd1a1c6bb9c833f198131901adb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824741, "uuid": "1ea83a3b-530a-4d33-bf97-8beaff395351", "value": "T12C75232BABF81469E9B517B158F703C3073BBC7199B58AA723218C5F0831991E13A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824741, "uuid": "c49fc74a-413f-47bb-878b-f5777637ced0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824741, "uuid": "f091fed3-34c8-42f1-94b4-5420bcdde1f7", "value": "49152:a0DMEECnu+NSSuX0h2ZSjGaQh9rOJvBp:hgou+3jh2laW9uvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824741, "uuid": "3ee49e4d-cc16-49a2-84cd-7c79bc527f4b", "value": 1613824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824741, "uuid": "268e67e9-a6a1-4ea5-90df-dacbdb81ca58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824741, "uuid": "6f053fae-4654-4da2-83e3-5046d18c6cf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c05935-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698825913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825913, "uuid": "03219ece-0f1e-4ea7-be09-5f63ccd64323", "comment": "Malware payload (RemcosRAT)", "value": "e4be2ef27f86a57da83fdf9bf131785c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825913, "uuid": "a252e2ef-dfb9-4fb8-b486-bacd83f64357", "comment": "Malware payload (RemcosRAT)", "value": "8eee3203e37325544b2b3461b11410bc8084002f3853fcc243d3148050af8b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825913, "uuid": "f6d2d8f2-67d7-4bf1-82fe-59b3c69cc1d1", "comment": "Malware payload (RemcosRAT)", "value": "b537abd6ce11b074f65030fb3891eeb6752d722b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825913, "uuid": "581624d0-d635-4bc9-b53c-4686f462332b", "comment": "Malware payload (RemcosRAT)", "value": "dba3dbcd612f6ee0e7604370aca06d007febdb882d0487221c3b1637de811f86c6a322a9f0b9af519163cfe20d72d2c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825913, "uuid": "ae68bc83-80b3-433c-bd89-fb7b81dd9fc8", "value": "T1A7C4CE0756894BABC8EEF4F335E6A6AB6CC24CD80E4116C307643E96F8B7D56E7C1184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825913, "uuid": "1282277b-7bdb-4813-b44f-aa83598e5fb4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825913, "uuid": "ed8a7131-c41e-4f34-b720-e8f02ee3c94a", "value": "12288:vslxYfPKiEcyh00dgjOx9507cE3yfzGYlbd:v46n+h0TOX5il3c9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825913, "uuid": "b727fe59-e344-4db3-ba2c-899da2a1fe2e", "value": 565767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825913, "uuid": "50038159-0eb7-4901-8e69-b6a881c59160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825913, "uuid": "db5a97f8-a662-4662-90c4-3c85b90cb6be", "value": "RHLP00098890080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178b256c-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833518, "uuid": "797f95bb-8baf-4e36-adea-5bd14604ca62", "comment": "Malware payload", "value": "2d33076153e712b3cef6ea35a9403de2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833518, "uuid": "82456663-154d-46a6-a6ca-650d3d662314", "comment": "Malware payload", "value": "8f3bcf14c0285bf5808bbd25c8b562bdc4b867417e858759ee679217b5e56b23", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833518, "uuid": "36a143cf-4865-4edc-8348-556260c588f4", "comment": "Malware payload", "value": "779a5bfa877ddc0773c7022376e254b7785fd476", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833518, "uuid": "40caaa57-8ad3-4018-a2c1-d6be43c5caf7", "comment": "Malware payload", "value": "64892d71bdce1d9d137e3fed29cc2c252431de1d833cdce6a15b3b5ddc3c72ee321916fada69501ed1ab08a498446685", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833518, "uuid": "9a1cdd53-1226-4cae-a353-f48b2ed6d476", "value": "T114B312D7A6C60D82D52613140F796FE1D8F5BE7FC564E46F816A83D2B82EC8C0E30996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833518, "uuid": "3a798760-0281-4535-aa21-bb000419a40f", "value": "3072:jnRWWP3nBszEuY0azro+gmKIcR543rtTFL1Sii9:N3MELrA7mKIU5GZTFLwie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833518, "uuid": "38df4a2b-e100-4bce-b595-51b8b739227b", "value": 114234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833518, "uuid": "097f1b9e-bb90-414e-a03f-08d6bee2e9a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833518, "uuid": "8a9a2788-acd3-484d-8ad6-9e64b7fdc30b", "value": "Animih.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0de679-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698819995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819995, "uuid": "f108b330-10a0-41e6-ba54-e94d9c511dad", "comment": "Malware payload (AgentTesla)", "value": "8cc5d514f1d2ba1d4a7eec602d861f15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819995, "uuid": "5c453635-cf3f-48d0-9ade-0737c7a23771", "comment": "Malware payload (AgentTesla)", "value": "9005c9522aa361a5fdc143f907b8fced088d2a92297fa7c32a510048a063f5ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819995, "uuid": "b2389c48-5769-4354-8560-ed370082e18a", "comment": "Malware payload (AgentTesla)", "value": "f572f5b0f8f35dcd5590357193c4e2a863be3b18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819995, "uuid": "b413ac87-bea7-4a76-9e15-cf12cbe58101", "comment": "Malware payload (AgentTesla)", "value": "c3f9775c061a3c2b6dbe95ddf01fce65d044501f9b207f70aef2b522d851a6a987027688b45cf0d39202e8aead7c33b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819995, "uuid": "77db55be-f878-41f3-be10-64566f1bb75d", "value": "T13AD4CF0072794F16E67E87F5A4B0140083F9367E753EE3495DC261DF2AB2B108AABB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819995, "uuid": "9d1f9649-3ccf-4700-8ae0-8dd15f8319b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819995, "uuid": "3740d228-72ac-4789-b1da-18c2c2407ec8", "value": "12288:6HcQgJKcwMpr3lGTAipzdCRh/Vm3FQ+nUGmpHgWLlykINcwAFj:6HcQdQEM0rnZmpHplykINcwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819995, "uuid": "282a7e23-5770-471a-8c97-c21b10d4d4bd", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819995, "uuid": "715457c1-7d5c-4f44-953b-93c3deb1788b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819995, "uuid": "0acd8ffa-257d-4426-92e2-49c82dab3000", "value": "RH2G0009000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a81b92-78c7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698850752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850752, "uuid": "1dd94b4d-e2df-40c6-ace8-00ae5720756d", "comment": "Malware payload", "value": "129cac10a8e779debac0cc1d76993e74", "object_relation": "md5", "Tag": [ { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850752, "uuid": "e3b6449c-9c87-43a2-bea7-78efe291fcd5", "comment": "Malware payload", "value": "90d64c99b8d5d74638dde88018f4c2573eeda4272dc57c33b0a96643d08c5a30", "object_relation": "sha256", "Tag": [ { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850752, "uuid": "d45fca8a-9eb8-4f4e-bd17-695f396c383e", "comment": "Malware payload", "value": "1779636711f56aeb622d26259966f179edcac2fd", "object_relation": "sha1", "Tag": [ { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850752, "uuid": "10475915-2f10-45f1-b667-beb48f50b4b7", "comment": "Malware payload", "value": "f1a5db99df660e69cd3e7d219b9f904afe1961d371ee5bd4685ee07aaf68c0601d24c32352299b0e0510bdf7ae2aaf3a", "object_relation": "sha3-384", "Tag": [ { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850752, "uuid": "bef49cc2-f949-4f6b-830d-3aa54589aa31", "value": "T10C13026B9CCAEBDD68A21C67A73A275E0F810CA7389C9189876345F011ABCF193035D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850752, "uuid": "046a38fb-5936-4458-9784-a25e2f8cbbf3", "value": "768:HdAGuu9oHdeWx+C5rkJ7ome/HcRTm+NYGI/nvQ5VAC0Pv0Hj5LfUR6uPN:lGHdeWxjgk98XFX5LfUY8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698850752, "uuid": "a16cfbc4-5679-4d4b-a0fa-d469a34f3e16", "value": 43078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698850752, "uuid": "1f14fcef-0b3b-450d-945d-66b1815705b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850752, "uuid": "f6e93c4a-1ae0-4422-bfa0-aa9bb08d16b9", "value": "updd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567dee1c-7892-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698828040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828040, "uuid": "1df40073-b991-4616-a5b2-a1a7b4b9a2c1", "comment": "Malware payload", "value": "da0085a97c38ead734885e5cced1847f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828040, "uuid": "54a3b2b5-fbde-42e7-9d2e-23111c5751e5", "comment": "Malware payload", "value": "9117bd328e37be121fb497596a2d0619a0eaca44752a1854523b8af46a5b0ceb", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828040, "uuid": "6023cd55-6aef-415c-a0d6-93becfe92f0e", "comment": "Malware payload", "value": "6ec0c1d6311656c76787297775a8d0cb0aa6c4c7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828040, "uuid": "05df2076-84c7-4bfb-b459-281e11f45e6e", "comment": "Malware payload", "value": "8c764df0606b2b223395a926d32e1ec7b25f484527f6eef2a02a85d6185412a235d00505827ff9df46bfeb068be7051f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828040, "uuid": "d27e9576-61a1-46ae-ad1f-b5ad1ea6e543", "value": "T1DE02193D4ED2F853D3E401B6C563E86121BF60C8048916E52FF5BB71093FE2A7A09359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828040, "uuid": "36ca625b-e838-4b4a-bf34-a2ded4f21529", "value": "192:UJ+Pz2hsJ6Q4vyuGtfMV1dnWrzKCq3mAhdNXkN2h:teQCydMV2/DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828040, "uuid": "9e4e7f2d-a906-487a-93a1-2f3e8551b04d", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828040, "uuid": "4fd5f305-7627-4533-a6ec-1b70a5ebd06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828040, "uuid": "54bab1fa-1b33-4197-86e2-dc21badaf1b2", "value": "wlbsctrl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65c5df6-7864-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698808525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698808525, "uuid": "f30265cc-a211-4216-b6a1-71a9705e4683", "comment": "Malware payload (AgentTesla)", "value": "c5f25a779940299ece2d998452543da8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698808525, "uuid": "e487c977-2aec-4c4d-bd1a-2b7a1fec9751", "comment": "Malware payload (AgentTesla)", "value": "924dbd780a4134731c44e5444186fe727245f9ebb5ed78c9f141c4ba05cd46b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698808525, "uuid": "1ccf685c-cfcc-48d4-aa2e-739b3c8224a8", "comment": "Malware payload (AgentTesla)", "value": "5b5acf133b232c0d4900095e1e150cc218c637c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698808525, "uuid": "1dc51dad-9a94-47dc-bdb6-bc1a4a925baa", "comment": "Malware payload (AgentTesla)", "value": "cf33f81f13d423b9e403af5508b1edb0fdb5dc65327785b29628bbf0debdabb5e3744be2b30eb8b9ac2c5e3baeb240da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698808525, "uuid": "41c8ebbd-5000-47cf-af4a-d69a1657cca8", "value": "T165C2B6109168D277DB7A1AFA5F7251410233AF88FCB1AB2A396C31855B333605936B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698808525, "uuid": "d5d3fb81-8900-4bec-80a0-0376aad5a133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698808525, "uuid": "b7b647ab-4553-4b22-96ff-eea34ca89381", "value": "384:oZ+yYEaGg/8g0nOmy+lpZ7yf2UANEbRoowvLM:ocy11e+lppyf2UANaRoowvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698808525, "uuid": "d50a76a7-d19a-4c1c-bb24-426bf5fa5df6", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698808525, "uuid": "7ba0ff41-1593-4793-9820-bb08cc5b58b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698808525, "uuid": "c9c9e7d1-e19f-489d-99c1-bde5cf28b5b6", "value": "SecuriteInfo.com.Win32.PWSX-gen.4954.31454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87ac356-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820098, "uuid": "fea8120d-f2a1-401e-9cdd-5afdf89fb345", "comment": "Malware payload", "value": "48025b46a6e55294c7948d012aafa3fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820098, "uuid": "b8b11a0f-3d0f-4730-ba4e-4cfaff15e519", "comment": "Malware payload", "value": "9291f554007c1cdb5cf816677d04adfaab5ceb809e52848a9a4b912bb3544bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820098, "uuid": "162a1139-e66d-4c27-b416-eec9c7541107", "comment": "Malware payload", "value": "68643e31faa64a307a08163f551a5289fd663244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820098, "uuid": "a5e36211-fe14-4ae7-a156-eea3b847a162", "comment": "Malware payload", "value": "b8f548df274470b82c092bee7e92bfb29452a8c647318b4fc10b7e5e64dfbfc75dc6bd949d0f4a0b80ae0f4a416bec9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820098, "uuid": "832ed842-9c7d-4685-9c34-9a967f94cd1a", "value": "T1AFF20F9C722031DFC86BD072CE995D64EA6078BB831B4217A05726AEDE5D997CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820098, "uuid": "967e9664-6d32-4259-9298-49efed4f72d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820098, "uuid": "225aced1-baf0-4736-907e-2dbdc25332dd", "value": "768:d7J3L+U54bZn3Xk+9VLLsCIf1zBOqAWnjryje:d7Jb+U54lXN7LQfddOqXnHyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820098, "uuid": "0ef8c6f1-1d2c-4312-800e-97b91ded7b78", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820098, "uuid": "e0f663de-be55-4371-9ffb-c9e88c1c2ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820098, "uuid": "6c18dd25-1b55-41dc-843e-08f1316919d2", "value": "PC 8137 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95de51d-78f3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698869894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869894, "uuid": "6945da41-652a-4c37-9e76-7f593ddd0400", "comment": "Malware payload (AgentTesla)", "value": "fa78672519360db57fd3e79868d5b9bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869894, "uuid": "d727a5ba-1420-426e-a76f-d9eb6705d654", "comment": "Malware payload (AgentTesla)", "value": "92a348e8f394142e957071d6da69538698b1746a8cbfe88ca63311a0028ae2d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869894, "uuid": "68f01b26-02ba-4d84-a75e-d40529ef5d51", "comment": "Malware payload (AgentTesla)", "value": "55441b73cb2a04f69d1a612c19b8185198af3797", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869894, "uuid": "39fcad0c-19e0-4e01-ba3c-472a8dcc5cb9", "comment": "Malware payload (AgentTesla)", "value": "4799693c98a10fc118721b82ce9529f6013d5cca3b6043fcfab69d8e1eed51839cf3978b50230397bd80d3a7976f74ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869894, "uuid": "2fef29af-8b3f-4a73-8f07-a57fe381d825", "value": "T102D423087765C256DE3E07F5A89091614335B11B6923F3492FE4B1FB0ABBF88CE21967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869894, "uuid": "b34a4261-ef67-4e2b-afe0-c6f56364937c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869894, "uuid": "297d4d5f-6b87-429e-a001-5c7be3e45e58", "value": "12288:l1Bao2rjk9NrDicle8fEhZfsN8jlQmstIOEdOw1H0LPztZwDhGc/Xp4ZmwaGSL3L:Uo9N6Se8EfsN8jlQmstIOEdOw1H0LRK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698869894, "uuid": "94024f9a-f8cf-4c6a-b9c1-54456612e143", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698869894, "uuid": "b21f10f6-7f27-4cdb-b640-e1947fd4c98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869894, "uuid": "2f2cfe30-92ca-4ecf-82fc-7954306f37d2", "value": "SecuriteInfo.com.Win32.PWSX-gen.20084.29054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247c64f8-7866-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698809058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809058, "uuid": "85ef1d4d-19e2-4522-bed8-5583a50a0cdb", "comment": "Malware payload (Amadey)", "value": "f6a85e451b93154c16a1b992c18626ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809058, "uuid": "df916525-d590-408d-8c18-2c1b596cb09e", "comment": "Malware payload (Amadey)", "value": "934a6769fe2fde5b39e294f9f81845b9eb7421279d8a9e26c611bf4a3a28545c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809058, "uuid": "d64c7002-900c-460f-af70-8d6ea5620c5d", "comment": "Malware payload (Amadey)", "value": "adef6ef37ea62e919f2c70e2aefee0e9b402fefd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698809058, "uuid": "3ab62dfd-9d15-48a2-9f88-18c86e7857c2", "comment": "Malware payload (Amadey)", "value": "2897d1bb40d9bc07748a63ab6e0b3470ff1fc730ab11aad102929fbef11973c05c73b83b38be2c975cfec0b8aa0f1d50", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809058, "uuid": "1f6471af-c258-4f43-ab17-d54b74622acc", "value": "T18C752353FAE89572CEB6277458FF03D30972BD621A35133E2B55A92E0CB2542D134B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809058, "uuid": "76fa0ea7-fb39-4ae0-a311-22eaa44c8368", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809058, "uuid": "fb7d4cf6-f6dc-457e-8a83-243a8eb2399c", "value": "49152:6wfBTHwOS4xhtDkW8LA8TiKnQ1X5o7EPF5HwdQ:7fFNS4xXzCA82KnQ1JoA9J+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698809058, "uuid": "565ffb9e-9b97-4c6d-aab9-813537944fa6", "value": 1619968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698809058, "uuid": "6e23a18d-da4b-4169-b8b1-3ebececb966c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698809058, "uuid": "582df1e9-a686-4d7b-a678-08eff8e8ae39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd6a794-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698819889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819889, "uuid": "6bb218ae-178c-44a4-98c7-ade0eb367eb1", "comment": "Malware payload (SnakeKeylogger)", "value": "72fe3433d4c9276fd64bc50aa0f5a0fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819889, "uuid": "e83867e8-1e12-44d5-88d2-eec1d16e6361", "comment": "Malware payload (SnakeKeylogger)", "value": "93670587fe2f78dc9db0a035d66b04ebde5227fefa698c18f283b6b5e84f70d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819889, "uuid": "c45fc6f9-0d8e-4ae9-8c19-8d34319958f1", "comment": "Malware payload (SnakeKeylogger)", "value": "c65e117e5f7bcfbd484c1395915eff5bb337a05f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819889, "uuid": "c7bd88ef-0337-41aa-9901-94aeb6c97dd3", "comment": "Malware payload (SnakeKeylogger)", "value": "1045ea5e548d04d88e39990d85ce9865125d11f183ec80c74f8e79fe2912494fe8bc0827316c849eb53e52a5e87df7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819889, "uuid": "94eda8c2-47fa-492a-9a56-ea8780a89048", "value": "T1BCC412447884809FC9C2BBF02A71515A5A36BCA91498C0DF4BF97F11F572217FC8ABAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819889, "uuid": "42de0304-d1d6-4d9e-898a-ec0b761db8dc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819889, "uuid": "6719cbf3-74ff-40f3-8c11-3a8a95f5345c", "value": "12288:KYrYwDlYwANplt3insCKpcf5/YtfhFieCIpdwMHP6cWGZhg70KGV:KYrYfwANFSnsCKpch2FieJcMIig7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819889, "uuid": "22aca49a-bbde-43ed-9110-14df14bf0682", "value": 572466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819889, "uuid": "54c00a15-7dcd-4332-bd44-56e2e8d763c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819889, "uuid": "50cf70f1-cfcb-4c20-ad1e-867196b568be", "value": "34578765ST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f4dde9-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833515, "uuid": "234c35ec-3682-445a-a23d-12a4460a3469", "comment": "Malware payload (AgentTesla)", "value": "e2f8f6d125c46f320aed64bdec12cc22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833515, "uuid": "09b1cbd8-378c-4928-82d1-174408f06f42", "comment": "Malware payload (AgentTesla)", "value": "93be4f14d79c66f35b32d4c27e86f554d85f0f44dadad705f07420ef382a3395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833515, "uuid": "4941efb9-b60f-4ae0-a04b-b4e300280b72", "comment": "Malware payload (AgentTesla)", "value": "bbda174a74ca7332b0d839251b338d3d7c692702", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833515, "uuid": "9d059738-64f5-4cc4-8c92-a722ac815eca", "comment": "Malware payload (AgentTesla)", "value": "0ee2fd6d797942334ea50a366eb81032e91be71633e52d94b850b7c0a989f926a3458ba1d8e8e56074e283c49c53068b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833515, "uuid": "dde20d6b-15f6-4916-9a52-927516aa49e9", "value": "T158E42380EA396202F1EF63F31D666151037726592C12E79C1EE984C538BAFD649E1F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833515, "uuid": "b692f7b2-052e-4f82-aed5-243ef147fb99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833515, "uuid": "64067d37-c966-40db-96c8-68f4daf0a0d7", "value": "12288:HfJG9VLYubyEjURDFlbhT+70zWTPv8sM9BSKsGyrbZqoAoairY4OWeqGB7HtSwAH:WY4HIZbo7SWTcsufAairY4OWeqGB7NAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833515, "uuid": "6b00a80e-5eda-4e9f-b777-befc2693dd0a", "value": 684416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833515, "uuid": "d298e3b3-7d5a-47db-9f94-9d6fd0a4874b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833515, "uuid": "512cbcbb-30cf-4282-97f6-dfb91049bd4f", "value": "90531MES_S Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c105cd9-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819782, "uuid": "203713e2-f2fd-4a34-9805-cb0b492c723b", "comment": "Malware payload", "value": "cbe02b3abc55e98e3dc7726ab59e7a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819782, "uuid": "5d4ff805-45c7-42c8-9ab3-3c42030f1228", "comment": "Malware payload", "value": "9443e5a728205a45c00fe0b9e0d5ed37dd905774e2d483f91bc09ddeb9d9206b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819782, "uuid": "d73f1daa-661d-4576-b174-96caeeab8cc8", "comment": "Malware payload", "value": "8d4ae1e852aa82d09ef60742491edf9651ad1391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819782, "uuid": "55b3974b-db30-4856-a6f6-a84ba055414b", "comment": "Malware payload", "value": "a1adaac7e80114b1d018b40a5f6b0e77615b740e2dc458f5981c28f9e767f7bcc07f32263fbf2e39c950c3dc936c8d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819782, "uuid": "7c56c3e2-3142-4ffc-aa77-084d50d237c2", "value": "T11E5401165E26202DD6953BF4B9B2A686047A5CC62133D15ACEB8BE0D7D33F07DCC912E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819782, "uuid": "949b24f7-fa60-4638-847b-4d158f0b8b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819782, "uuid": "6b399c39-8b43-4641-a2dd-3700506ce0af", "value": "6144:oQsL+39AMNtSePtk6k5NszpbePcv0DpXfQB0Qmo4bEVD:x3NtSaC6k5i9bKhQB0Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819782, "uuid": "cb89c0aa-c5f0-4ac7-9e6a-2b8492b617f2", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819782, "uuid": "b404ace5-8fff-4b26-b9ef-327868e9556f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819782, "uuid": "42e92dbb-884a-405e-bfa2-8bd83de32507", "value": "ROR965457890000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618a8856-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819469, "uuid": "a7329679-21be-4d41-93ee-c64da645eb1c", "comment": "Malware payload (Formbook)", "value": "ca0f0f0f5b8722d7c8f7701b51a4bf54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819469, "uuid": "ce651ba0-6335-4c25-af13-921e4dd1f44e", "comment": "Malware payload (Formbook)", "value": "94a600148c61771a7591e69f8c7493ad1245a7dbeb2cd001bc90aea9a540ff2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819469, "uuid": "3a24e166-543c-42aa-ac78-663f936d2eda", "comment": "Malware payload (Formbook)", "value": "d938d790a9f161e066d5b92f054628ec896b657e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819469, "uuid": "9c6f7219-70a7-4738-b1bb-36c89b54f5e3", "comment": "Malware payload (Formbook)", "value": "88726de1f2b831f912f243f9709514ed2ddb0157dd039c4827309c5ba63dd9154bf44de6d7ba976b18b73e21101c3aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819469, "uuid": "91a4ca47-8095-4b59-952f-5fc533cee819", "value": "T1EB920647728C9661D06A867F98E3D584A2E2CEA12433C70935E7BB8D1B33798CF91B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819469, "uuid": "df39049f-a7d3-4469-8611-c686008ab4e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819469, "uuid": "c9579e2c-1ab4-4395-bb62-1a2b47741331", "value": "384:HIE7cu+fIS35K9wwHLqMdInLJAkJGQ2xmKJxuZhP:H97cu7SFwHLqM2LDJGQ2xmKJqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819469, "uuid": "0d6a96a0-9928-4ff5-95f6-ab2d8d0446cf", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819469, "uuid": "1c5760b2-d0d8-4546-a619-8556750d3bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819469, "uuid": "d7e880ac-3ddc-4fd4-88db-2a082574cba5", "value": "Mxsmtmv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dc971e-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819952, "uuid": "ce872b44-2182-4b1d-80c6-6a751085decc", "comment": "Malware payload (Formbook)", "value": "958cb95438ce3e87d4589459ad9f1dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819952, "uuid": "b5cbc238-31ce-45de-8c8c-fd4bf097ec48", "comment": "Malware payload (Formbook)", "value": "94e024435cc8cafb2705bf98e9551feaa5d2ab426fcbcef9efde59fe9ccb9e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819952, "uuid": "c495d91b-79b2-41ae-b0b3-9fe1a17fdfa2", "comment": "Malware payload (Formbook)", "value": "428567998143c6a0fd8cce178335fef7c26078a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819952, "uuid": "93bc0f80-7cdd-4b49-8263-efaacdf7985e", "comment": "Malware payload (Formbook)", "value": "de26e13a279bbe6e515dc6dd0af0fe6093267af105dc9f637897f52b42c91b9450f46638091f139e8be226be9c4c3582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819952, "uuid": "fa4d5b51-7c2c-4fd6-8b7f-7e7a0da390e7", "value": "T1F3D4235835B2084BC4E43AF469B49696ABB1FD020064D11E57F8BE14BE32663CEDA73D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819952, "uuid": "48d1f192-362e-4d1d-8fe9-a93befaf9cab", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819952, "uuid": "181aa9a0-5468-4585-b04a-786beb1009ac", "value": "12288:wY7Y+3xUeQyX7sfNSjTZZmel48MCaHg82TfsDKC7wYgJctv:wY7YWzwfNy8el4XA8SC7wYFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819952, "uuid": "49d999d8-571a-49b3-9fd0-56e6fe4eb7e2", "value": 612797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819952, "uuid": "6f1bd6c0-bac6-47dd-9ca8-c036d9dbe72c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819952, "uuid": "680d2c9d-b834-4ac6-ade9-c9caa33c3a0a", "value": "9865456789TH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80adb0af-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698855599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855599, "uuid": "67bb9bc1-639c-42ae-9b92-c92cb0637f3f", "comment": "Malware payload (AgentTesla)", "value": "6b95c035445735c11db327f763177c66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855599, "uuid": "37927f06-8c1d-4533-b1cc-eb339683b347", "comment": "Malware payload (AgentTesla)", "value": "94f41b10238cb779f5362938093c577bcb1ed8ab3b4dec75b48ad735807072c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855599, "uuid": "7782a024-13e6-4a71-873a-c4ea2a9b76f9", "comment": "Malware payload (AgentTesla)", "value": "e32847939b84ace3cf921f595e51ddbb0d02b179", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855599, "uuid": "adf3abb7-a85d-4e0f-871a-0d12bdb01c9f", "comment": "Malware payload (AgentTesla)", "value": "fee1dd40e64087cf983ffb781b6eda8a7fe5e8bc90a7ab72ef9d72635dc39641e0ec264e92250a4b53e655d9c2129b9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855599, "uuid": "077e8832-1f49-4843-8cfa-ce5452d5c182", "value": "T1DB9413BBB292C207D46F23B8D785CA2DDA32FAB10189D1792E59C7CB1D832544F194F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855599, "uuid": "d6340f70-fc2b-4fc4-9b5b-deb65707857a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855599, "uuid": "2f46b4d0-e39f-4d02-b972-8e7db3c64c18", "value": "6144:SbyjS5FFRqt+eoEg6HorcoUrRQFyqw1d1sMGnjpnVAwuNWuM6qHfdw2I:+RPFGlZZ11ff6MkAwuIuM6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855599, "uuid": "1f5617a4-f877-45ab-9a0c-5c8859720c54", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855599, "uuid": "86e16b65-d58e-4a2e-ba51-5f129cbaa656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855599, "uuid": "f5339d9c-f272-4471-a21f-731f9ec53330", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f4e9ae-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698820011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820011, "uuid": "818f9547-9619-41c6-b45d-3cffbf20a8db", "comment": "Malware payload (RedLineStealer)", "value": "60f587656120e6048e4356a44e4e54a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820011, "uuid": "552b2aec-cf09-46bc-9b41-7e75269464b4", "comment": "Malware payload (RedLineStealer)", "value": "9517bf6088751038c0f438d5712ed803578063137203ee1ab9b76e2be4afb7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820011, "uuid": "6f12d512-40c2-4352-b63e-e9b0867a1d04", "comment": "Malware payload (RedLineStealer)", "value": "e446298fc079e582abe2c853a8f35e957ab9cedd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820011, "uuid": "85703e2e-2ca9-419d-8c9f-5a06e2cb1adc", "comment": "Malware payload (RedLineStealer)", "value": "cc93bcf463b53603f1442137041c67872c610d4051152d12f75a73327a3ca3948977e5744b3645fcb69c4be73ee841b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820011, "uuid": "c0c2b861-160a-4df0-b728-06a2a1e12255", "value": "T14A048D217180C0B3C87B153044DACB3A9E75347547A696D7B6DD27BA6F213E1A3392CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820011, "uuid": "4fa3d769-2bf2-4837-8976-d88fb101be11", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820011, "uuid": "c2a7b114-0438-459f-81eb-e2480a028ed6", "value": "3072:hDKW1LgppLRHMY0TBfJvjcTp5XiyMggfxvPXj5:hDKW1Lgbdl0TBBvjc/4vj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820011, "uuid": "84ae42fa-c390-492e-8c61-5e08b6b33af3", "value": 174144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820011, "uuid": "dd48540f-e057-4d16-bc0d-eef677c92f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820011, "uuid": "8506e3e8-99b6-4613-adff-d1a96dcfdc15", "value": "ORDER 6574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f74028-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698854697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854697, "uuid": "6bd90f89-db49-41ff-bfb9-dcc0f7c965be", "comment": "Malware payload (AgentTesla)", "value": "d576a5a0b9ca2a341dac797ace18370c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854697, "uuid": "9f840835-f7c8-4555-86c6-08d87c498abe", "comment": "Malware payload (AgentTesla)", "value": "952e36a177649e7fde033478b63546813508f514f284b92bfb863447807110f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854697, "uuid": "0ae34a6d-9e45-4470-a356-f2ba69c1bd5f", "comment": "Malware payload (AgentTesla)", "value": "1d60b06bfbd29a914e2be9d7634dd6b53344b18c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854697, "uuid": "42bd345a-8a14-44e8-8f77-6ef2c2bb3148", "comment": "Malware payload (AgentTesla)", "value": "0e061aad248d2a9d95ee65c7b7a99a930cae96066ecf90e11f1a4d9b9994102fcf624e09c46bbacf72246dd2e6075e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854697, "uuid": "180cc3db-4a45-4799-a942-69eff6767762", "value": "T1612523A16E337E6A675C023A20EB4DE40A750AD044DDD8DF935992C1434E386D7FB2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854697, "uuid": "d71bcab9-70ed-419c-b48a-a595e5234039", "value": "24576:exXODLtc2FxL8SEruhhdzaFRDd0W0emNAh66adhBPOlMkVA8+:ZDBjL8MPW7dvm2h6Rdhxv8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854697, "uuid": "30ce2a83-1e3b-4d57-814d-95279ad75b34", "value": 1033741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854697, "uuid": "13adae8b-8342-4893-b97a-8889b6d68722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854697, "uuid": "32acd5f9-433b-4ee7-8928-53ba24e2e4d3", "value": "Quotation 00109_00003517.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc63bad-78eb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698866281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866281, "uuid": "bb4ac941-71d4-42f2-8216-378e72b05204", "comment": "Malware payload", "value": "3e6ed1ceb52c1d4e9ef09cd3aebe7741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866281, "uuid": "30fb4f4d-ff0d-4adf-8220-50b9f83b86f9", "comment": "Malware payload", "value": "95d9d5b89db68830e63fd9a10a2f308a396f9ed6c15dcf9f7c5aec09521bffa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866281, "uuid": "045c911f-bf38-445b-aaa0-623b25c53426", "comment": "Malware payload", "value": "581b21ba4ec0a72d88323e3cab7879b1a93b9a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866281, "uuid": "d1c0048b-5f78-4ce3-b5d6-c0f01a856b10", "comment": "Malware payload", "value": "4c766ce2e0e23ff01c477bd3726c65c93fb45bfe792a6241730ee9f55969f3e4752151880bcda7d5436bca8509cc2447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866281, "uuid": "687fe1a2-196d-4dc3-8ad6-a7d290e1e8b9", "value": "T154A4AA92F25EF3E8DA276D7447713724412F6C1909F6068EB730F2DDEAB6AD409189B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866281, "uuid": "bf4fcb17-7b4a-45f6-b174-34343322e017", "value": "2aba094e0216215635ebd81a1f48adb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866281, "uuid": "89825631-fc71-40ad-b61a-96b0c69313d8", "value": "3072:L1M+yKVKnVo54uZVgUIf+WO86K20A6jfxMhjhHzlCzw7EoP06yt5RME0KtA/qyVG:8CqOVgUIfE86K2UjpuH0FKzqyVRztNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698866281, "uuid": "7d01b203-d622-43c5-a3a7-0324345b7bbb", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698866281, "uuid": "4eec40d0-23bd-48d0-a1d7-6adb5d3f4463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866281, "uuid": "96411250-06ae-4d0e-91fd-ff6730ace2ad", "value": "SecuriteInfo.com.Win64.DropperX-gen.31402.22171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e2d5f5-788c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698825625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825625, "uuid": "b3db2a28-150b-4df4-a1ce-76c19f3bc4ab", "comment": "Malware payload (AgentTesla)", "value": "939d0d919fedc323ad908c7d682b92dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825625, "uuid": "57f9234a-8b69-446b-868a-079164f04874", "comment": "Malware payload (AgentTesla)", "value": "96c9cf5a30490c3f3e98745ae345502e5226d9b3a3a94c7b187579573b7a3f27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825625, "uuid": "ba428c2d-ef45-4e0d-ab4a-5efb4c2fb34f", "comment": "Malware payload (AgentTesla)", "value": "db0404ad72f87607abc158f3ea09b47326e357d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825625, "uuid": "7ea635e2-b7b0-4835-89c7-2216cf97b4f4", "comment": "Malware payload (AgentTesla)", "value": "7a7b2177b80b4cb758961a9417ec78de04f4b22d616154294cca2fd53eef12b32d00faa5d7f69d69351d065fb46cd04c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825625, "uuid": "00016d0c-8a67-42e4-8146-bc894709ebac", "value": "T1582533811E2C2A910AA851693DE73E1D074D478CDC08F8E623D7DDEB1B9C21A5B1BEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825625, "uuid": "cdc534c7-f8cd-4de1-a073-3d8af3b869b4", "value": "24576:HP1bDi8vcEuiETnrYAi4L6+Dg5FrhL1bWVQNmbNdj4Hl1w:HKlg5Fb0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825625, "uuid": "04cf1312-3500-4272-b8d8-3a54bc0ec5c6", "value": 1032649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825625, "uuid": "85dcada7-d686-42b6-89f1-dfa28cfdf289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825625, "uuid": "a08474d3-e874-4214-8c13-10f7ab898f7a", "value": "Invoice Copy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183911fa-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698825788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825788, "uuid": "94d1a1a0-43b5-4ae4-93ed-302620dfcb5c", "comment": "Malware payload (DarkCloud)", "value": "813469ddd59834258dad4091d4619d88", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825788, "uuid": "b80a14ac-6c8d-4e56-a004-722129cf4120", "comment": "Malware payload (DarkCloud)", "value": "9714703fb69c23615c19813ef1c62c62baac3b9261ff56e9aa306166a24c255e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825788, "uuid": "7665c92c-7e0d-449c-b056-317a730f5e92", "comment": "Malware payload (DarkCloud)", "value": "3d12c649af0ab0a34bbefcde5c8d0b50601d927a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825788, "uuid": "168a6bab-6852-4cd0-9d3c-56f1d6e05164", "comment": "Malware payload (DarkCloud)", "value": "46cd4bc9348115fe7dc8aae9868f78013fc1f1992d6be19ff791019ca8a4e333038192245d9f57c611dd88cd013ab73b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825788, "uuid": "76ead0ac-e319-4fce-9c94-835d7fc7f692", "value": "T184053367702967A7D926FC40F9502B64B7622C5308D7CD6887DC82BF30EC4A47F32A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825788, "uuid": "2c19ac52-53fd-4d4c-93e3-dd4e953b09a7", "value": "24576:rDiAvki8JmggR3dow71FruiBJlStVJ1CBG3:SAvREmFdosB36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825788, "uuid": "98d0efda-89f6-418c-b29f-1f6d4d4e69f7", "value": 847219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825788, "uuid": "5393cd9d-8cd6-4844-a9f2-6934dec6946a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825788, "uuid": "d113bed4-471f-4274-b063-f76382267b4c", "value": "invoice and packing list.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb2fe0a-78d0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698854602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854602, "uuid": "fd3c08dd-9f9d-493d-b694-6e543556c998", "comment": "Malware payload (Formbook)", "value": "dce0701e59bc317e4e152268c58c8322", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854602, "uuid": "017bc728-7eb8-4ff2-ab18-3140420065e7", "comment": "Malware payload (Formbook)", "value": "97acc5c52513ead4ba018af7dd726edd3179f993099640681cd706db4d263f38", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854602, "uuid": "b11ebc64-7b3d-4401-8c02-eb063ea1629f", "comment": "Malware payload (Formbook)", "value": "c7bfa21c965c21fede51d40ed99a266c66ad3bfd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854602, "uuid": "16362f59-2a62-46ac-a391-2d5dc8d9220f", "comment": "Malware payload (Formbook)", "value": "b2d46052d3d3ea21adfc0cb28f8a1e9011bfc008150f2b9af5aa3c9536a098c95d29339c75477801bef1c2a936452669", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854602, "uuid": "c8994bd0-141b-4624-a4c5-68ff7e2c659f", "value": "T14455D003ED40CB83D41C83F46EA34EE90B16AF14EA965ACF115ABF4F3E706621D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854602, "uuid": "7a768976-5011-4364-8ed0-7b671003d2fb", "value": "24576:FsBFw6/LZyM3bVMw6/UZyw3bVbcITQpIshHJfOmN8yv06LBddawCx:F6/N13bV/6/GX3bVbDTZ+pfOmP86dad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854602, "uuid": "f503182a-2e9d-4340-b320-d30c4a804a4f", "value": 1290752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854602, "uuid": "28c3e938-9027-4339-9fbd-73cfa5c55aab", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854602, "uuid": "8953c864-e2aa-468c-b494-535718c525a9", "value": "RMW-2422.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2cb5a6-7857-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698802768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802768, "uuid": "ba491e0e-86ca-449a-909b-c312e1393607", "comment": "Malware payload (MarsStealer)", "value": "39e5bfdfc3eb3c304ee53407c1252c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802768, "uuid": "94f8d755-b037-4b4d-a2bf-1f39ada5f2b8", "comment": "Malware payload (MarsStealer)", "value": "97b63bd9ce81bc4d87fd55f6f51c95d27fca98878e346e6f5698afbf2e3a50ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802768, "uuid": "61ee0b2c-4511-453b-bf95-90e9081ebddb", "comment": "Malware payload (MarsStealer)", "value": "0294a6e83abe4495e3cbed29ba8239136125e7d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698802768, "uuid": "8a921ae4-f15b-4c0d-ab2e-6ce6816fbf98", "comment": "Malware payload (MarsStealer)", "value": "8114c74611b22f3a26b72892d07ad769a7c4277bcb04d5c4272e2b423b5570bd1d7d667841af5f94cac43fae4f1089f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802768, "uuid": "5b36cb58-6e74-4fef-8de5-0b5dce860077", "value": "T115046D1363E13D55F92A4B329E2ED1E4371EF5508EDA7BE632289A2F08B11F2C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802768, "uuid": "8f664303-538f-4052-9ce9-bbdf19791271", "value": "770cdb8cf8cd4da991843f0525f56478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802768, "uuid": "acb5d105-3cfa-4e3f-bd2b-da25176df8aa", "value": "3072:nJQxKU2no8aJMg+zq9wwmoXzEMPF/pbk4g+I:ykU2nzaJHlVRIApb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698802768, "uuid": "344f25dc-e75b-4d23-850f-7c97961df30c", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698802768, "uuid": "13dbd177-6759-4271-a54c-f42690fb0e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698802768, "uuid": "71ca42de-58aa-4c20-af12-34d51584dbc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b500a9-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698821539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821539, "uuid": "79c7f9f8-475d-4e7e-8718-3f816afb2c94", "comment": "Malware payload (Formbook)", "value": "61f0a077f9e486b7d9386856ef98429f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821539, "uuid": "6ce45891-9b89-4aa4-b08b-a0d7375b2ff4", "comment": "Malware payload (Formbook)", "value": "98266e6f5d23aad6132b20b3d2a9c3a0bf009eea9935fa9689e9d9ed66acf244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821539, "uuid": "d4841fa1-26ea-499f-9c15-e86c7ed8fae5", "comment": "Malware payload (Formbook)", "value": "83e314c0bb58be5968c953c26f92bbc52b2aaeec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821539, "uuid": "75b2b8b8-8c8f-4409-bef9-8e0ad63d7fdb", "comment": "Malware payload (Formbook)", "value": "53e899f3ff915d4b1b88b714c6d15e5dec4c93d2991af3cfb0025ac483fab924517c2125dfb4a1492202bc2cbc576df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821539, "uuid": "948bc3f5-7e81-4116-8f70-812da369205f", "value": "T120C4238976F95F04CEEA53F586A1C22083F126192E71EF4D2CCD26CF18B7B4857A0683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821539, "uuid": "dad0358e-366c-4bcd-8a8f-13a023fa620d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821539, "uuid": "1ddb86b2-66c1-4707-a5e1-0a7a73553ad1", "value": "12288:g8R69yqLFOjY2amJatWJ6f0b4R0NqYqXgoOdxfm4jPAuAKnr5NJ3w4qveYgpM6:n6XGJctVf7uqYFnmYPAuA8r5T3w49t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821539, "uuid": "e1948159-7ad2-4acf-a0b8-878278be4f46", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821539, "uuid": "22415247-11a5-42b7-bffd-fe100f355e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821539, "uuid": "2e88c517-761e-4e35-aed6-f7e40da5eac1", "value": "61f0a077f9e486b7d9386856ef98429f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcda3b1e-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820105, "uuid": "96b5a638-5cf0-40b2-af49-ee7be506f17c", "comment": "Malware payload", "value": "8b0d4a71701a57e948f39142743e448a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820105, "uuid": "7fb13e63-3c16-48ef-bc44-27dcedd5239f", "comment": "Malware payload", "value": "9846837a749f1679e599baf292705c7d8bfe98cf7fd65c94515106b692be3fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820105, "uuid": "ae6f512c-22d6-46be-8755-ef5999763ddc", "comment": "Malware payload", "value": "b2afb0bcf9d624cfc16c9cdb9cfcb7201abf0668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820105, "uuid": "dd8c4d13-0d4b-4463-8a15-c1dd919d976a", "comment": "Malware payload", "value": "a6d9287c37e1a9159d26995885f4fcdf0d8171988313c04c789d51c8fd4cd6ee21f000143e1d318e1cb2eeafabd72398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820105, "uuid": "6bfdc496-975c-42d7-a948-cb5e1f878d32", "value": "T1340330DC722071DFC86BC0728E995D74AA6078BB831B4217A06726AEDE5D997CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820105, "uuid": "0a68d5cc-8c2b-43b8-aadb-a6b15be47319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820105, "uuid": "276441d9-86cb-4174-8242-6ef616000222", "value": "384:QxbLsaEN5SaDw8431nS37UiDv95REN8U8WuFSONr1XjwbhEYzLYbjmjI:2Ls/cD843a5DVYASe1eGyjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820105, "uuid": "74f1d9d8-9bdf-4883-90cc-4dac07b682c9", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820105, "uuid": "2c26ad82-e96a-4750-89ca-959e9ff590d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820105, "uuid": "9bc9573a-e327-4ca9-a253-b8872845a9a8", "value": "NMKLPO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8798edc5-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819962, "uuid": "d9377175-9c11-4a82-8897-8009b818bb4d", "comment": "Malware payload (Formbook)", "value": "f6e96181863bdee3f54fb6e9be14f6a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819962, "uuid": "d3ac7d71-1803-4a9b-8c9a-f9a4696cf007", "comment": "Malware payload (Formbook)", "value": "98a474022a702b282eecd7c9c33afb76a111fbfb4df3c2f23f90cf491da967f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819962, "uuid": "b70ee98b-b38f-44c6-8332-ff034cad5ed9", "comment": "Malware payload (Formbook)", "value": "8562fce607053c5769f03d9e8636e44ecbf6096c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819962, "uuid": "03758e76-d025-4aa9-b0c4-8261512b08e1", "comment": "Malware payload (Formbook)", "value": "9292b4f10c2bcfbc8dce131844689456c9bf7c7e48d4c22fea3a50c819e445b335ca35a721f6bf500bba88ed660f25ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819962, "uuid": "cc632c6f-f53e-422c-9307-c6cf6928a254", "value": "T1879412896990D156D9E473F41EB009F7062A7CF11160835B5BB8BF3AAE72523DCCA32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819962, "uuid": "10ae0568-5190-425e-a0b1-b751c706befb", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819962, "uuid": "8119a7cd-c67a-4f3a-8252-8ac764c22426", "value": "6144:UnPdudwD/EVDigY6oSB5Erlw6S4KBV5SJP0HqGY6ZKvKFYmUDdQoTsrlgLcuw:UnPdLbooAClw6SRASHqwVUDSCgCLcuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819962, "uuid": "be57feff-110b-4afd-850c-e364cb524181", "value": 420391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819962, "uuid": "d3bb3651-0a47-495b-a7b2-753696f0967d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819962, "uuid": "22aa98be-1337-4023-8358-e0dbba3a53ca", "value": "TPHG000000877900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dd98ac-7889-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698824410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824410, "uuid": "0d846a89-669a-4855-8301-72f0a4c765f8", "comment": "Malware payload (njrat)", "value": "a8eb20b5ffa7a228cdc11459c011832f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824410, "uuid": "8946d8a7-141c-4627-b845-841b2401d11e", "comment": "Malware payload (njrat)", "value": "993d4e4c349596b00994431a9a589ab1caad520d1333979745c9a3a267060f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824410, "uuid": "06b85ed5-adb9-46bd-b743-f99bee5438fa", "comment": "Malware payload (njrat)", "value": "12a90d6de0a3c2d3e8bab291f64fbedbadfaab03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824410, "uuid": "0a910a11-8364-4e94-88b6-8c2d9b2664f3", "comment": "Malware payload (njrat)", "value": "bc53059ba509a802257693dfdb37c09d0574a2889385ea3171709d50a9d6c8800dd6aaef3ba61d5e2939ee726be3c151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824410, "uuid": "e9b4cf6b-9ce1-4ccf-8777-956348268eed", "value": "T12E14B45B7D488A05DA582A71C0EFB42003E55FF31A32E24F3A743E9D3F763A25D45A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824410, "uuid": "f6f4a345-a497-4775-ab01-db7e39da58f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824410, "uuid": "539bb105-293d-45d3-bc72-9be27da5adf1", "value": "3072:xY7saucIKZ59HLYNcYibPqHrhL1QvAIwFwUEQCn+TJhV:cl5VKcJbiH7QvBwFwUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824410, "uuid": "eb7b464a-37d3-44ea-a5c5-8b8663e915a4", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824410, "uuid": "05a61be0-6595-4046-82b4-7afe2c692a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824410, "uuid": "cba822fb-879f-4a50-b06c-00434285fd9b", "value": "a8eb20b5ffa7a228cdc11459c011832f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec0ce07-7882-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698821316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821316, "uuid": "c0f46bab-acd8-4c92-a6e3-708aaa367012", "comment": "Malware payload", "value": "7df9a680d9d91def3d83191670ac0566", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821316, "uuid": "aec3305e-304e-4023-9b30-4333644572cf", "comment": "Malware payload", "value": "996c340d98299d5c87010caf18fce4f718fef8fb6a0bf26ef5178c98931dec8c", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821316, "uuid": "f561706e-3472-4d2e-a572-64e541afbf97", "comment": "Malware payload", "value": "34f667ce0fd836adca893c33757148eb5cf34db9", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821316, "uuid": "e7151c3d-dc6d-47ad-8a70-5126a6905d90", "comment": "Malware payload", "value": "b947999814a2fe479125ab59b3fe4b20edf49af4f1b791f7d91a9804923930c1e81ea2a4a76360fbe79c2830a0f12ee3", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821316, "uuid": "fc6c61a7-20cd-4bac-a56a-f44c9869323c", "value": "T142A3D01EB250E80AC0A7EDBD4CC9D0C7A2183D666E42EB0F31607B1D59796C3539F69E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821316, "uuid": "c6f470e5-64c8-4d3a-97e7-a49157236c3a", "value": "3072:phzpKt0XdItNI86CffikZJawzXn9wqG6GtcL:phzGbBffikbNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821316, "uuid": "ef33052a-1b17-4200-8e37-d3ce215914fd", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821316, "uuid": "a7cbfa4f-6e5f-4e84-87c4-6089c30030f0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821316, "uuid": "e90be049-4831-4c02-a9b8-5a8e713eb260", "value": "cotizaci\ufffdn.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6a79f5-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819969, "uuid": "9cb51da1-9a2b-4a7c-8654-bc49e7f08aa8", "comment": "Malware payload (Formbook)", "value": "d7f3c90a679745fe1c207bbf496a8bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819969, "uuid": "2d07010e-d199-4239-8406-eef3161b9122", "comment": "Malware payload (Formbook)", "value": "9bc478175b70e409b23c70a1d891955cbb2b360a14473d6711e5d7a7a890f2a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819969, "uuid": "0363c8d6-85ff-43fe-a565-eba234b80f06", "comment": "Malware payload (Formbook)", "value": "0914c2f8a29be9c15aa7a192dc5443395ae8650d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819969, "uuid": "64f30830-0f25-4686-9ddf-24139fc705fb", "comment": "Malware payload (Formbook)", "value": "4d2e7383d71bf07970dd6f3f07ec37d1590187c69e6c69939e2fb9fa6c94c7e8f40d3318a418cc6121d507d83bc6b16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819969, "uuid": "cf7c979f-3a9d-40d3-a5ba-bb7d4271caf8", "value": "T10984125A24D1D05BC9D137F068B6A893A632BCE2063086C79FB43F39A932553DCCB65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819969, "uuid": "62a7ba5c-e6a9-41d6-a237-392e1edb9b26", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819969, "uuid": "0ec78716-a28d-48e6-8643-3ffd288e8fa5", "value": "6144:UnPdudwD/EVDi6qKS3Qboc4Yymm9JuK1xf7RCM/KImpuI+qZFE26tYU0Okmh7A2T:UnPdLbRKcnc5ydJuMvk3FEpYJO7hBzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819969, "uuid": "4545c1e3-1d92-4d45-ac0e-fbcd82855a9e", "value": 401596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819969, "uuid": "4554f5b2-0572-4507-b94c-17325678501b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819969, "uuid": "b1e8625b-2e8b-4415-a2f0-f22a0e4ea043", "value": "PEDO09865456890098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2801f428-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698833546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833546, "uuid": "a721fb27-fba5-47c6-b105-e90e385d2e2f", "comment": "Malware payload (Loki)", "value": "0d38de2d9dc5b032529ee6d20c37a1c3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833546, "uuid": "81e791a4-8bcc-478d-b114-b4b610ffe2a6", "comment": "Malware payload (Loki)", "value": "9be454135990b9f3dda107e5686a6b32e214bcfd574cef2f4829fa4a7de295a4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833546, "uuid": "57160620-43fa-4052-b43a-bef996417956", "comment": "Malware payload (Loki)", "value": "aff46d5d26d0a35d1ae85b3aba909d6da868ef24", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833546, "uuid": "decd1672-e156-4841-a188-085f0c9d1557", "comment": "Malware payload (Loki)", "value": "57fbe61cee50d0bcb18526cab809f5e8ffc5aa3adc92b9761bf6fcdd284c55b6ec4f7868eb8f86a8e63f9dbd11892ac2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833546, "uuid": "db31ebe4-5dc2-47ef-bb8c-949558888926", "value": "T1F9942332FCCC6F0B91A3676713F4029E7A55B6020D56C5FE6E08DAB0A5F4CC1EA5B069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833546, "uuid": "aaa4f27d-c04c-4fe6-bec8-d390f0c94fdd", "value": "12288:3kZfpiNdQCH67Z9UaZrrCPCAt5G7wwvjk:0ZfMTHkULPCAHGMwvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833546, "uuid": "61226db5-20e6-486f-ba54-9545dccd1a45", "value": 435275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833546, "uuid": "91444d62-ac47-4f01-9ad2-967e507e882b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833546, "uuid": "1dadd972-4571-4e66-8cfc-c1e35e08c821", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7c29d5-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880721, "uuid": "9a7da599-5723-4f2a-acd0-37537291c5c9", "comment": "Malware payload", "value": "891babc2fd7d99b891ccd078df006c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880721, "uuid": "ce15d2e8-53ae-4382-b470-28dfdf5b2e22", "comment": "Malware payload", "value": "9bf5a9b007993e34aa7e8daa9205627c84357f0034ed42de6b2c3b974c9beb5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880721, "uuid": "e522201f-3a1b-4b40-9de9-658db5ec6f9d", "comment": "Malware payload", "value": "4b711e2abb2d4234ef7e4bced4bb07878ba78129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880721, "uuid": "e58add86-0644-4c7f-a2cb-f8f41396aab5", "comment": "Malware payload", "value": "f3109402e8e6e60c069d0955504158351ac22d8aff1bda746b8f57adb2ef6b4d9d6cc5c81086956e979f19fa5406a021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880721, "uuid": "481f40b4-78a0-4ee8-adf9-3fc71b2dac27", "value": "T17BE49E91F5F3C0F0D6DA397104B6A3365A2BF50706359BE75298DDF4CEB21A09D3A222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880721, "uuid": "752f0b4d-027f-44e4-bdfb-9ade16269c6b", "value": "6144:EwjyyBxfEmOsVr/QkCbZyNyz9mUtKFsflg1tddXiXUAO0BwsW:EwW6hh/QkCFdY2lKvdXik0ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880721, "uuid": "0e3d6573-6381-4fed-99d5-8df62b2ef8ef", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880721, "uuid": "ffdba633-a2fa-4c39-a391-3cfed5c8b913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880721, "uuid": "3c15a444-6558-4f59-8fda-8bb82955ecac", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1SMBV9B.17780.25768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74376f66-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819930, "uuid": "7cd7aeba-fec5-404e-8abd-03058f8ca934", "comment": "Malware payload (DarkCloud)", "value": "cb6efa797319725cfb1424ba7a03bc6c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819930, "uuid": "8be86f87-1f41-4091-9fd6-ef9ecff3969a", "comment": "Malware payload (DarkCloud)", "value": "9cea2f9c37fe29d7dca80adc57c2cb5b721a5fb0c6811074a13da634e7b8740b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819930, "uuid": "ea9a3349-bc42-4dc9-b126-58766547a8b1", "comment": "Malware payload (DarkCloud)", "value": "287461937b5c10dffe4571edf39506d32a43a86d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819930, "uuid": "03f70124-2ca7-4fe5-8e80-506c862b2197", "comment": "Malware payload (DarkCloud)", "value": "3ee6679bb521e3543156e9e98add13c5761923f376ad87a8813e7b727bd8859dacf2bbb04b8bab41d66a4ed5a073823c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819930, "uuid": "0a3bd921-d184-4323-a236-026c17924fcc", "value": "T1CCB4121979A2D50FC5E035F92D75612A2B70BCA01320C1576BF1BF69FA72213EC8936E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819930, "uuid": "1e1b5c77-49c5-479d-9bce-ae080ed65228", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819930, "uuid": "5a718c7f-9641-4153-9261-1b06b1e81e46", "value": "12288:wYQ5PScfIVMzYMewERaNnufieBuUPTzUb:wYQ56ZVSVxoalufiRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819930, "uuid": "2ac99ffd-7551-4af7-86db-3e5069a67937", "value": 499707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819930, "uuid": "ffcf5050-cda0-4043-8e20-df50b2dc8bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819930, "uuid": "161530a9-059a-4dc8-ac1c-a26d43dd15be", "value": "RFQ0765456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b77460d-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819808, "uuid": "959f655c-37ab-400b-844d-0fa591a02a3a", "comment": "Malware payload", "value": "c134b298b1919d6e520907d06de5d4e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819808, "uuid": "6ccc23cb-6e08-49c6-97a0-87bcb94e7e6b", "comment": "Malware payload", "value": "9d122ec3dee5c91a262a8637c8023bc65cae31c944608dd8170a0586dccebecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819808, "uuid": "b7dbe81a-7c91-41ed-bf26-85b4e9d802ab", "comment": "Malware payload", "value": "0012d636946e58f2e457e80077e44acaae5336be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819808, "uuid": "54035e2b-e648-4f2e-ba2b-f5f247851f98", "comment": "Malware payload", "value": "b74adf5d72bfc9e87f5f518efcb56f2fc3af2a063f72784485617bf397f5074c712d73af0d1fadca0138cb9422f66d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819808, "uuid": "83e22c9a-d287-4b19-bf60-124e54761f06", "value": "T184534B666C91580ACAD4BBF429F091572A31BDE10520C1CBA8FDBF299E73313EDC51AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819808, "uuid": "fdc2a00f-1e8e-4f35-afa4-6510dd892e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819808, "uuid": "f3dad26e-9296-4943-8c63-4035d5f143e6", "value": "1536:1fIeVPYEu+M2630VDcM7TPxdF8o75F943hh:1fzVgEu+yEVDcMfxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819808, "uuid": "ed3cbe32-b4fc-4b33-98e2-ba6e8bbb44ad", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819808, "uuid": "60714138-2146-4e42-9d0e-9321e9eb16bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819808, "uuid": "e80d21b4-d657-477d-9a8f-af928f951a07", "value": "\u039d\u03ad\u03b1 \u03a0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1 \u03ba\u03b1\u03b9 \u0395\u03c1\u03ce\u03c4\u03b7\u03c3\u03b7_SKBMT 0107333_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e15395c-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821235, "uuid": "cf75c104-cd91-4a6a-8d4d-25933900a359", "comment": "Malware payload (GuLoader)", "value": "e694956dd9c113fbc759db1e978576a4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821235, "uuid": "7319614c-69d4-4fd5-99f1-033c8794782d", "comment": "Malware payload (GuLoader)", "value": "9d26fc8d853b4c53fb0fc10e84939790b8bcdc1d8c1c1de43ec36ff204ed5d92", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821235, "uuid": "c38f50be-4eb3-4765-a825-b54e212971a9", "comment": "Malware payload (GuLoader)", "value": "5e901b13dc38ff3c934dda1d620ac2368f3026aa", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821235, "uuid": "d27e4a63-d3b2-4473-8b64-42397dce3fea", "comment": "Malware payload (GuLoader)", "value": "4dde60beab09c74b27f289cefb2f3199fa7e5a896264725eb127afa2c00a70728d4e35b6e2eda9b8bbbba07cedd2ba8b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821235, "uuid": "ef5b2423-13a0-4bf4-8fdb-5efbbb10f3c9", "value": "T18C936DF2DB94161D494B27AEDD424972CDB9811D3613063ABFED078EA20B54C83FEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821235, "uuid": "f944836e-2291-4769-b0c3-6b228ddb8af8", "value": "1536:AtWVkKDBxCjcPljwZ9tXbLZNyIi+CWiwKQtJHOXtS1Kiw2OFeBujpy4:aOFBxyc9jwZ95LRi+r3LtV2tSYiw2see", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821235, "uuid": "904d6ab3-9d67-4b8e-94de-df3de9794c53", "value": 90591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821235, "uuid": "4cbcd862-c54a-4c7e-b2a0-9687c23d5196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821235, "uuid": "ed00219e-25d6-4ff9-8b2f-695908e85a44", "value": "RFQ-10004_PTT \u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8f9f1b-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698842470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842470, "uuid": "9c2dfb2f-1a24-49d8-8d26-89822703dbe8", "comment": "Malware payload (DarkCloud)", "value": "646e4ffd27508f00e576738f8783a2eb", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842470, "uuid": "a0cb51e6-d312-41e6-8a03-c5437a95cdeb", "comment": "Malware payload (DarkCloud)", "value": "9e22008ae9937889b559db9b0ece411cc2cf3b0f3552564515482bba24a50064", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842470, "uuid": "aa384d39-001d-4a2d-af25-5855d63a6240", "comment": "Malware payload (DarkCloud)", "value": "3c94ee6c0f800d5dda8a47d4537c18d1497d2419", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842470, "uuid": "46c82c87-5bce-48ca-bf04-2596d1187287", "comment": "Malware payload (DarkCloud)", "value": "02272fcb196bf633177d3bdc86b17c05c3e37a63508d14a0fb8f6fa126c40807e2e64486a9951b30cbc809771d8f156e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842470, "uuid": "e613af1e-d25b-4af9-84c1-615f10687d37", "value": "T1411523ECF1613E4118B2E757211D77BF99E32E0908DD679A883F3062B6D7A50AC621C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842470, "uuid": "e4d800db-5879-49a1-948f-1b08982184a3", "value": "24576:MC4W6oBr/34gDdiB522Drc/VjrIBuk4JIe2:cWfrv4QiB523/NrPXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842470, "uuid": "0b558e4b-111f-4d41-913b-fb63bf4d6518", "value": 921548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842470, "uuid": "11eee554-b6ad-4385-9534-195761473707", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842470, "uuid": "a1ee7840-ef4b-4841-8489-4443fe795a20", "value": "SOA.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7dfd09-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698820021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820021, "uuid": "8aea3e8e-2b40-4ef4-9f3f-259cd8b6649e", "comment": "Malware payload (GuLoader)", "value": "166211f0267604a47117bccd31755123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820021, "uuid": "b31c97e4-679a-4c39-9cbe-dc8627632a6e", "comment": "Malware payload (GuLoader)", "value": "9e8efe576bee6d88098dde6861431893c77060b4ca51b233f11cf57b9a0d2695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820021, "uuid": "f4eaa394-dc9b-4ce1-aed8-1e6b01a6d742", "comment": "Malware payload (GuLoader)", "value": "8aec76a8605017750d9eb9da940b74f5e3cebe94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820021, "uuid": "d61281ed-7075-404d-82c5-1f6339ce7d06", "comment": "Malware payload (GuLoader)", "value": "edbdd43d3273db4583b983bb8b3f98c00b414d581d57fc955070672ef7b3d248150111bd0875f52b6b3432178ac6285a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820021, "uuid": "31ef6665-1f22-4995-9b76-b7025e920707", "value": "T177B42351A4F1D85BF0A303B58E37533B87279FFC4290472B27C06A0A75977496C2E997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820021, "uuid": "4a625e8f-2a6a-4b80-942f-9dccc7ca2b7a", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820021, "uuid": "7a38c133-3d4d-4468-931a-ca098df5329c", "value": "12288:3A3E0KimrSQmOd9v2HeYTIzaDmackeYW1TJvmTxku:3A3EgQmmefCw9ckedFmVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820021, "uuid": "4e03c30a-6403-4d4c-afc1-52fec656a4be", "value": 508870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820021, "uuid": "7fbe275e-b13c-4fa5-96a4-cf93ec465d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820021, "uuid": "fced8773-5507-42b4-b3e1-b26b4b9cbe53", "value": "ORDER7643456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ae9b15-78db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859372, "uuid": "a004e96d-9d2d-40e6-b122-16a90221033e", "comment": "Malware payload", "value": "980d0fc4eaec88155ca8472bb54d2277", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859372, "uuid": "f5dc3c2f-528c-4d28-a5e2-7e4dac9730c7", "comment": "Malware payload", "value": "9f06f35cde4f5e657bf9d5a4b6214e9116e741391847d375799d435c489eecb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859372, "uuid": "133584c7-acad-4a11-af5d-12d70f51ca19", "comment": "Malware payload", "value": "ca2c13bd6249556406326d1c6e97f4bfd8bab6c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859372, "uuid": "b6e96138-1f59-4997-9ae7-3926d485ecf1", "comment": "Malware payload", "value": "28069ee2c7fda29d07f940853e9c4bf36da7b1dec2f41808786f7984c159ff44b4bf13c278cd1a7dbd14a15bd3336174", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859372, "uuid": "0cccc7f1-858d-4e5d-862f-e5c0f4d0c289", "value": "T1CCA402C1EAEA3E73E547D374391F55EEE269D15083A6D31704CEAB1213903B8E877289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859372, "uuid": "1fca4177-461e-4ed8-9b8d-ae4cfc1f5dfc", "value": "6eda519ace6fb530d1f7f0dfef24e789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859372, "uuid": "4dcabe71-94e4-4d05-9888-532c685bee81", "value": "6144:ManKyevIOgpMMrxVxtjR9QsyfWYWfi7iXBu3i0eXW3OTwyM1c3OPjoSABq+8Mx9n:R1pBjT4W3iORuuXHTwyac3aoSQB2eVK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859372, "uuid": "67239d31-22b0-4ca7-af5f-948daa1aafb5", "value": 488736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859372, "uuid": "4e7f7890-d61a-40c8-b84d-ac559e284d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859372, "uuid": "79f0439e-bff1-4fb2-b43a-fae355db489e", "value": "SecuriteInfo.com.TrojanDropper.Binder.326.8473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6590cf-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698820047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820047, "uuid": "36a392f6-ca0b-45b2-b561-654cb3345606", "comment": "Malware payload (AveMariaRAT)", "value": "35344d1fcd9ffa45919867c070bd338e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820047, "uuid": "e4efc1b5-c23a-44e0-afb9-6273d7ac910b", "comment": "Malware payload (AveMariaRAT)", "value": "9f6de85e6ac6ca0e2a0e1912f3d950c3765425d076e87627c9a58b033747c5af", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820047, "uuid": "09efa8c8-401a-4846-824f-134e07caa141", "comment": "Malware payload (AveMariaRAT)", "value": "89a58723de7565bda85eebab7130c44c07fa3c95", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820047, "uuid": "83f67073-6564-4014-a6cd-f01e932beeec", "comment": "Malware payload (AveMariaRAT)", "value": "a8c86fb7656ce1f211590197bf5292dbdf9a7acfccbe293000c4bcce7b7613b964c4d26a9a8bf9730a3d48180aea8294", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820047, "uuid": "8ecb2803-c26a-49de-a805-1787490d8127", "value": "T182F43354E0245543EA7213399C285E271AF6903B22F98B0A8B6C3C9C76BF799C57F343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820047, "uuid": "4421ed89-bd67-4161-8ed3-51a5ab0c19bc", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820047, "uuid": "29672751-4d86-4fd0-8295-8f67f670918e", "value": "12288:RfL0y6hGqeyfhzX5KU6ZF2ft7qS0jo/q6vNu4fX5nbdAwWkTHo:RfL0bh7ey+Ot7Zi6LfpbdAjWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820047, "uuid": "8ecfba24-97e5-4362-aca2-7286c32bfba7", "value": 788617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820047, "uuid": "e95b5351-9800-4f09-ae85-00058980ade4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820047, "uuid": "df5cd057-ed1d-4587-af2b-3187cb2db6ef", "value": "FADTOP098765400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1e669e-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698833522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833522, "uuid": "9385042d-ace5-445e-a6b4-f0f2afb4c93d", "comment": "Malware payload (RemcosRAT)", "value": "dfb6a2f03da3734d3c4dff82eb189d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833522, "uuid": "9b50c466-7957-44d6-adda-ba026551f4a5", "comment": "Malware payload (RemcosRAT)", "value": "a0f0836993f57ab1ec12ce9f7cbbcac9b12074be93410426de24c12ab21fb2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833522, "uuid": "00b4b017-63ed-41b2-b14c-8ebb972d214c", "comment": "Malware payload (RemcosRAT)", "value": "313d8c19730300db562ce8de2d660061d0ee12db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833522, "uuid": "031d76b4-cb9d-403e-b522-6550f250588c", "comment": "Malware payload (RemcosRAT)", "value": "f3cb7fc54ee49a8db2c230e7c082305ff3e2a2ad2175f9dd9846db98ea52cba9182068be60c2f68a70c09e829a768918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833522, "uuid": "54707994-000a-4dd8-b4e8-144db1bf893a", "value": "T1ED4533954A4384E7DD541EB6DF6DC6339E6A303B38B906772B310357B2D3A88049EB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833522, "uuid": "c19dd1b4-acca-458a-94f6-195228521b17", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833522, "uuid": "447011c9-a705-4982-bb21-a816b1e6b2db", "value": "24576:KbsPV4cjA74AN50hXgjDQQh1rt/QOl3LXoJcuXgcGVf:rPV9joTAwDQQBoK3jpuSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833522, "uuid": "fe2a7a15-1638-4c35-ae92-63f20b83a45e", "value": 1182702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833522, "uuid": "73add154-69ff-4aee-88bb-3a267483dd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833522, "uuid": "f05d37f1-8511-464d-8f26-ee1cf7b41491", "value": "Annual Leave Application Approval-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcc43ad-78dc-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698859808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859808, "uuid": "4c27726e-f641-4185-926f-bb77c914f176", "comment": "Malware payload (RedLineStealer)", "value": "9eb836b02cfd94c624bbbfd6e2f287b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859808, "uuid": "8920ebcf-bb41-4702-b224-9f1b484d52f6", "comment": "Malware payload (RedLineStealer)", "value": "a23ab45827494e672a57c422d842e1a0c53393b2f28335dff19b76d61b2dac29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859808, "uuid": "4e8de9cc-2425-497b-9fcc-75415b3876fe", "comment": "Malware payload (RedLineStealer)", "value": "546654f60624b50e1ddcc015b6f34400cea038b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859808, "uuid": "3da5ce04-56bb-493e-965e-11f51a06a548", "comment": "Malware payload (RedLineStealer)", "value": "6cf6356995d18b08550b5bbebcf26f50431183bb2d2c7b35eece4f0dac67c4d470351b5e4bc8b36d3236674a78b91eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859808, "uuid": "d3efaf26-7535-41f9-99c1-54f50c5907d1", "value": "T1C7846C3C5A6040F5F5F52C33E8DDA8622462E278DF04A9AB338245BDB9BCAD2F17D115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859808, "uuid": "7f06b49a-0b2d-489f-9779-85c46d4fe736", "value": "bf63f020692ed4388d1a16e28cd91c9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859808, "uuid": "2e54c8ca-6ded-48f3-aa85-b3598d14fb01", "value": "6144:jcMDWS+DCrTjUsagmTxnclVB+WK22eo3pgHFOOUHCONh:YMD+CrTORAFaxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859808, "uuid": "a0b40fc4-00ec-49d3-a0d9-47311039bbf2", "value": 386880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859808, "uuid": "b13566a1-0ebf-41ee-8362-1ea7a85b656e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859808, "uuid": "8ea7fbeb-a9cb-4df0-b4c8-0df3c049a4da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf98c5f-7892-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698828294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828294, "uuid": "bcec3682-0e89-41a0-b5dc-0812970ceb09", "comment": "Malware payload", "value": "929b12bc9f9e5f8e854de1d46ebf40d9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828294, "uuid": "e70f9a90-bb2b-4caf-ab7d-b8cf1a55435e", "comment": "Malware payload", "value": "a2598161e1efff623de6128ad8aafba9da0300b6f86e8c951e616bd19f0a572b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828294, "uuid": "4a081f49-8cf9-4e83-a9bb-0b1a8be8a231", "comment": "Malware payload", "value": "c1fbe0fc31099b71315355da25a7036ea51a8627", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828294, "uuid": "627adf25-03a2-44b4-bb6d-8bfe91576815", "comment": "Malware payload", "value": "87de1214f559f63639b5ceac04b0f346fbb2faaec42af9041adf779efcc886063c35354fd6030008c9cb52ae66e8b0c7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828294, "uuid": "de8a6798-7fe8-45c4-9e33-efb97d08284a", "value": "T11492943819921230D9EB53F4D77BCA60451D429D9D93F6B9FABC1BD049AAF81CB1C2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828294, "uuid": "c516f778-e6a6-4121-869e-c1089a23ef4b", "value": "b552436fca61b3d053aae8e1e0ee5d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828294, "uuid": "8113adde-7e88-4ce6-b3dd-9d41dbea37f2", "value": "384:Ffl/UMj8vN2Gti4KgTUjub9ttBuMsUdIxc9:9l/UAGSvgTgux9sUdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828294, "uuid": "e448a258-5926-4b04-b71c-7c097789f385", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828294, "uuid": "d937451c-a963-4b74-99a9-c1e76d35a091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828294, "uuid": "216d3b70-834f-4430-93d9-82a9b62603f3", "value": "CyveraConsole.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf5b0e1-78f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698871190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698871190, "uuid": "de859761-16de-4555-b81e-a7775b755d8b", "comment": "Malware payload", "value": "e7fde851ba4de827ab8a8d144865672c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698871190, "uuid": "1aeca56b-8001-43e1-a078-1800b49cbce6", "comment": "Malware payload", "value": "a414c3f98693f6dea965c62a299669650810303a65f9b78e8939182b94083b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698871190, "uuid": "94f108a6-8297-4913-adbd-b12a71346687", "comment": "Malware payload", "value": "118df12b93d5f70f180f972db82c0a05a9c06f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698871190, "uuid": "6965ea3c-0796-45a3-996b-dd991f42fb57", "comment": "Malware payload", "value": "54973d764becd00d723ac29dff6abce2b08ad1f2201a7138cccb538994dfe509d895a58c4f1ac7368fed4c10d1a5577a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698871190, "uuid": "6292d67f-9330-410c-9bb0-af981c144b0e", "value": "T134247C1352F17C61F6274737AF2AC1B4769EB9608F457B9B22549E2F08712F2C672306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698871190, "uuid": "408340d5-dc62-4909-a60b-895375105e1f", "value": "c8a352bf73a61d8e36f530e1798f43a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698871190, "uuid": "f16a3079-0431-44c9-9ef0-cf9a2f63f1a6", "value": "3072:4fwo3S/iTrnQXhNLPioTOycGZjztDVmoySXCq9FrGAly7v+A0cLjguk:3ozrnQ2oatGxztlyAJrGAlyDh0cLEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698871190, "uuid": "1c0537dd-9493-42b3-a2bd-005b3729795d", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698871190, "uuid": "4a326231-11bc-420c-879e-749480fd851b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698871190, "uuid": "49334c2d-795d-4e7b-bc7c-7f9f34995d6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2180ecbd-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Netsky)", "timestamp": 1698833535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833535, "uuid": "0871510e-83e4-4cea-b933-521913e2ffd6", "comment": "Malware payload (Netsky)", "value": "325a37c50c3c06ffd72dceb977400c4d", "object_relation": "md5", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833535, "uuid": "dd52ef36-c615-4045-81fb-18441c401528", "comment": "Malware payload (Netsky)", "value": "a6d0ade40843a1f2fd1b7ca608578a7d9c9fa9be1a4bbb852608dc09b3788bd0", "object_relation": "sha256", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833535, "uuid": "b5e8112d-1fff-45c9-8d1b-9a14abf2201a", "comment": "Malware payload (Netsky)", "value": "48b29d1830318e4de00af763e9a4a859ecdae6b7", "object_relation": "sha1", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833535, "uuid": "eb272919-3d8a-4856-96e4-e38c7b27a9cf", "comment": "Malware payload (Netsky)", "value": "f6114d9db2ae935c09dadcf792e95981b7fcd5ce13bc32f41aed4aee474f15b51a7219f220b859bb53fe94906cc001aa", "object_relation": "sha3-384", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833535, "uuid": "387989d0-ebaa-4476-b7bb-6509d48e93af", "value": "T1FFD2D016EA075828CE5D0F3A406F6E35E43675054F2B019ABC2E22E53F616F49D39CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833535, "uuid": "20c6cafc-753c-41df-9db0-cba8d96da87c", "value": "768:lWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDLx:UySsz6jGeyZx+l0TR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833535, "uuid": "5b172ec7-cf52-4ecb-8ae5-3ab9a1603b2d", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833535, "uuid": "bbc4ef11-1723-41a5-aca4-145c84aeaa9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833535, "uuid": "f23690ec-24e7-48d4-9a94-97497d30e2fa", "value": "email.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299b40db-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833548, "uuid": "d50b9b9c-ec2b-461e-b9bb-4f558fb603f6", "comment": "Malware payload", "value": "8204fa2e43fee05a36cd4fb6f997ca54", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833548, "uuid": "4c6df251-df77-40c6-b3cd-37810fe6115a", "comment": "Malware payload", "value": "a77efec09ea33ef7eed24b7c458925d71fdb5243646dccd8bcdea3426a347dec", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833548, "uuid": "6362f734-b419-4c09-9dd8-f48760c6db2a", "comment": "Malware payload", "value": "cf1ba0362e0eed6cc95b5f9c651c7b588038f18b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833548, "uuid": "66ec4741-3933-4ba5-b6b0-aa4b9aea196e", "comment": "Malware payload", "value": "1d046c4f637e25e96fbeaea867f9d8873d461ac7acb5d995b6a228d11ab4d650c77cd7fb20f859a35fe6f98d099f45d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833548, "uuid": "fdd69861-c80a-4c52-ba28-09f7bf01bd0a", "value": "T19BA423065FAC9FDAC04E373683414AE9DFEC07AF6E26558943B98F3851DBE480AC56C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833548, "uuid": "4df05f24-f032-468d-987f-d3a49c5e472f", "value": "12288:NLlTWT3X298WB3ktM3RMfb+4W+T4sw9CbmZZjqtt2O:amzktM3RIa1E47CbmZoOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833548, "uuid": "51cf77b9-1e81-4d4d-840f-acf09e25ea81", "value": 473154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833548, "uuid": "2793a1e2-9f76-4b0f-8a76-a0bb115dab41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833548, "uuid": "cb789c8f-1bd3-4d9e-aaf6-e28876c0139e", "value": "Orden.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5182fc66-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698825884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825884, "uuid": "b0033aab-5d12-41f7-80f3-6f6f362ab94c", "comment": "Malware payload (AgentTesla)", "value": "3bf2640500bad6b101924ffa8e418472", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825884, "uuid": "a5c15383-39c6-4090-9de4-b4f25e6de2ef", "comment": "Malware payload (AgentTesla)", "value": "a97990c38c5ee874e22171ab9482121a5ee8ef871161c05fdd05093ce3b02f55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825884, "uuid": "4564ac9c-5af9-4009-b1ce-f093e582736e", "comment": "Malware payload (AgentTesla)", "value": "11ea4bde8011bc667ac0b9cfa95e58a5db3b11c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825884, "uuid": "a17d2450-840d-486f-bd48-9e6a19dfa503", "comment": "Malware payload (AgentTesla)", "value": "e409c3172ab48921aa3223cb59a18a72d2ff61e28f38638483af7fed5a2fdefe0d5483e65d848aa6500a48ccef9b1719", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825884, "uuid": "ef405623-d9e9-451d-ac44-4d254a3399f0", "value": "T116542389D8FB34EDB4C2D110292021D21A5A4DA0CDC5D46F5E98FE467CADFE23D1C4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825884, "uuid": "d300f12a-29eb-4b97-b099-0f7c42322113", "value": "6144:UvGJ83JuL+BD6h2phkepaRE7BWqDmbnltFYM0qqiJPSCeJKGfekO:UvhK+BDW2phWatmhLroi4JKGf7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825884, "uuid": "8b0fc446-b12f-4f66-a819-72c95af059a1", "value": 283070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825884, "uuid": "f34aef5f-a45a-41ba-8ff7-607b6a0f5cbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825884, "uuid": "f2d729f3-7732-483d-a6a7-8c89baa40b59", "value": "ORP0987654567000.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260f416b-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833542, "uuid": "0dae0ae6-3a2b-408c-9511-7c916f5fe319", "comment": "Malware payload (AgentTesla)", "value": "dce8cfd73a95c70e5b3e518c8dd29b7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833542, "uuid": "a1f8e6d8-b182-4da2-bd90-b48a622d694e", "comment": "Malware payload (AgentTesla)", "value": "a9a1d51a9985a11b9ce8c9a8c0aff3de6399a1ac70a94d07e8a990afc4b57c08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833542, "uuid": "5410702c-685a-440c-b43e-6c7b57ff325c", "comment": "Malware payload (AgentTesla)", "value": "ddc8fae3d31ae2f2428055e4180285d813d95c00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833542, "uuid": "ce8203aa-ef1d-43dd-853c-7ec261d9a4f0", "comment": "Malware payload (AgentTesla)", "value": "beddfd963a3436d433d306aaf6fdd633281da8b86d6c3b3cc10fc9a60f191aae80142099dddd47ea761f6b57b041f976", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833542, "uuid": "8cecfcd9-3343-4623-bc12-3174c86afc80", "value": "T1DFC312507CE1DA1AD5121AB2ABF520B72BEF3174C32B487FB5253228ED5521389B0FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833542, "uuid": "229de026-0985-4862-94bc-48e5d640c8df", "value": "3072:SP4yWV1aezhd5cWQ75Uxn6fpHNELoyJbrr0BIcPDjzMNZ6zVO/AZNk:SP4pQgL52qVOpEhIDjYW4kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833542, "uuid": "b2036af5-fb72-44df-a5e1-6973df3e53d5", "value": 118945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833542, "uuid": "bdb44a6e-f565-45fd-9a71-ed2dbf7a45e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833542, "uuid": "d4dc7059-1cee-482f-b350-19bb1ebe395a", "value": "K_810USD.31.10.2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07df0869-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880736, "uuid": "8accb993-370d-4792-beb6-ca2d19c95019", "comment": "Malware payload", "value": "ffcf2307d613ea3472db0ac89e3f4813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880736, "uuid": "67443b21-f3fd-45e4-9940-d690d56e0e90", "comment": "Malware payload", "value": "aa12e8c9a19b9c09f17724d778eeca554ac097aa27c0220d573c51427f06af4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880736, "uuid": "782c0834-c66c-4ff8-9b8e-764dd12c088a", "comment": "Malware payload", "value": "16be70b09c7a2d97adaacf80f51fecf94b87f7f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880736, "uuid": "09e29df3-0f58-4804-ae18-4c753df9c3eb", "comment": "Malware payload", "value": "3f7cbcc26522cb07927e1ff05ab69484390911d7ef8a5286e55fa1f9b6bceb518cfbe05c6129f1295af28d03d80f9197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880736, "uuid": "e8028994-063a-4f83-84bf-e22572d1a335", "value": "T1D9158E02F7C784C6DED278B1197FE7126F3AE518532A44FBA3B45C334A51481AA2D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880736, "uuid": "9d505e52-7f23-4b46-bcb4-800e9e2fabb4", "value": "12288:8PYU1ii0BQVKBOETix6Bg4Y3GgZfLtFBV:W34QMU96e4YDTBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880736, "uuid": "ec7078c0-7339-428d-8d36-771dc7304efe", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880736, "uuid": "c52ad0b0-5bc6-493d-888a-d22acc112182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880736, "uuid": "73eee71c-e58b-42ff-b86b-2814aa3bbabe", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.3289.17037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d336846e-78c4-11ee-8907-42010a9c0042", "comment": "Malware payload (Urelas)", "timestamp": 1698849724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849724, "uuid": "10c773aa-0a40-472e-8113-e4d6eba58277", "comment": "Malware payload (Urelas)", "value": "0f57e9244e178d9efa38e637a168c4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849724, "uuid": "daab26b9-f355-46ac-9fb1-86de6e50e1bd", "comment": "Malware payload (Urelas)", "value": "aabb3ad22745bf2957265ecb89ee43aa8c7b5a20ab451fd7dea0f45e108e1087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849724, "uuid": "f964411d-222f-49ff-9278-1018e26fe3e4", "comment": "Malware payload (Urelas)", "value": "50d22f20b4f5005dae30fd4a58ae5d9e20731b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849724, "uuid": "97b71285-2a97-45db-9b00-b06442f9bede", "comment": "Malware payload (Urelas)", "value": "17ad507fc65c72e1fb7d2614cb7d1782688bc7fca207d2d139acac5c661924d57d024beac572d8a7f7a6698bdf77d875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849724, "uuid": "1b204f2f-4f52-4ed4-b22c-704c4b1d58d4", "value": "T1BF149E00B2D58030D0BA4630069A9B21593DFD716BA94EDFB7C4699DCA787C1BA31F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849724, "uuid": "09605f88-2cab-4a0d-9478-b0c522f93746", "value": "d0a02458b96b0a6cde3068c96d1cdba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849724, "uuid": "b415fc53-8fb7-4b4d-bf5b-dfa802996783", "value": "3072:nl6CNlACeMKV6ETiiXd60irnsegFWL5QJReMSJN4at5:nQCNSv6p8lOseQWLyJQ3Ji65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849724, "uuid": "1a52b34e-0f41-4a47-9fef-00ae21181fd6", "value": 201758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849724, "uuid": "6aa67ab0-2c3d-4b2b-be0d-0ecda27ff1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849724, "uuid": "0e0f22d5-3fff-40cf-b324-c020d187e600", "value": "aabb3ad22745bf2957265ecb89ee43aa8c7b5a20ab451fd7dea0f45e108e1087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1bc062-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880718, "uuid": "fd3cd79f-bd0d-439a-98da-2b73afd54345", "comment": "Malware payload", "value": "766beb7401f594b3778d7f5d5fb49333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880718, "uuid": "18c6925f-4c6b-4110-8f46-ecbdeb372fd2", "comment": "Malware payload", "value": "ab54a98f5d53c3ebf316fe6ed868a18fc3f4dcd09702185bf672c2d6a35f23b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880718, "uuid": "44ee0f21-4bb4-497c-a8a7-229dbaf9476e", "comment": "Malware payload", "value": "b649474c08c1a6b3edc252b2ea39e10d95f0f75f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880718, "uuid": "2992c26c-ff55-465c-bc01-ace8045dd999", "comment": "Malware payload", "value": "777c2c367f2b7034455501b8ea521c19e776a78eb4ae569845a17a9e679616d058a3d9259b276632534813efa02fc2c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880718, "uuid": "03f56d41-7f22-44c5-b554-9bf60b475cce", "value": "T1D555AE56FB8640D0EB05397204B757316B78DD8A0F34CFD7E194ED2E1D33292AA362A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880718, "uuid": "2c660416-364b-42f5-990d-ec92a2819be1", "value": "12288:kYIWLmWEkZjzK2BAAc2pdK66ud0OAPtn3XP4mrkQRlj70G30uyn:kjWLBZfK2BAAcIdD6uWJPtn7rkDG3Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880718, "uuid": "b050fda3-e5f0-4864-a998-ad3d8ce68c8b", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880718, "uuid": "ce02bdd0-1649-4476-a382-8c99381cd936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880718, "uuid": "f027026a-3dbf-4bfa-8571-5192b95841a5", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15EXSUN.2676.32561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd8ab46-786e-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698812862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812862, "uuid": "b74d6d5e-adf5-434d-a98d-3664a1974926", "comment": "Malware payload (MarsStealer)", "value": "38641e438c5dba6d0fd27549359b6ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812862, "uuid": "dff3fd0a-dac3-4c2b-8fc8-7c944646c55b", "comment": "Malware payload (MarsStealer)", "value": "ac69894fed204b5f69601fb0e231975316fe0a09bb1b79217f722e9fffba8c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812862, "uuid": "22464a79-32e9-4807-b82c-bc3686f2003e", "comment": "Malware payload (MarsStealer)", "value": "a0f424de70449d2232ba72c060910d77af994c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812862, "uuid": "08032739-0b4b-461a-ab50-26db7cdae6a5", "comment": "Malware payload (MarsStealer)", "value": "abcd3313f9eb12b4b91dcd9b2e269aa2301e2f72561527df939050eff0e5f334e03dfa651dc1561ce3872746a776180e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812862, "uuid": "6b3e6ef8-2554-4c49-b0d1-6f9a261ad2d9", "value": "T1C5047D03A3E17D55F9264B369E2ED1E4361EF5608EDABBE93218CA2F04F11B2D163351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812862, "uuid": "e5a670a6-e075-42e4-8957-a36be6cc4521", "value": "770cdb8cf8cd4da991843f0525f56478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812862, "uuid": "6413a2d0-8b74-4f30-9576-74e29998c4aa", "value": "1536:rGa9QtwZKSheDWZOZ3DpQMq7jNKwVuxpWi5Ixe/QLebi7sHZKpnZDbH5UE2FM2SO:rTQCEvIM3D6x7jgnxpWu6eC6GZxUJqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698812862, "uuid": "ba9e8003-c4fc-4966-a578-3104b8bdb254", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698812862, "uuid": "857419cd-705d-4bc6-a676-a0b8aaacc2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812862, "uuid": "26a543af-3136-4863-af01-b3d8b9cc7319", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e776ad9-78da-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698859058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859058, "uuid": "21cfbfc1-cf8c-4774-a6e4-9b13acbd6b07", "comment": "Malware payload (Formbook)", "value": "b559f853c534c533f75d09966aec1a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859058, "uuid": "a6aa0342-0173-4e32-9935-12275f5991a2", "comment": "Malware payload (Formbook)", "value": "ad5097f981c366a853537cc8a7d745da73615e051c523b92f6ca7dcb80ea82b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859058, "uuid": "e3263ee0-b173-4267-b6c2-f97ce9e5773a", "comment": "Malware payload (Formbook)", "value": "3822223b422b6b0fbe2c0441ca83eff06534aae8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859058, "uuid": "01db69f3-4bac-4e19-af25-a034662504b9", "comment": "Malware payload (Formbook)", "value": "09e3f32790f7db9c868f2bb650fc625e91d0cb05f9df75299ec05d772f04ea3cbefd18ed7ac5bf8a6c8909d65d2a6ecf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859058, "uuid": "53a50670-4d09-4380-9741-9ca7e956a641", "value": "T14A74237A2CE34CF7D562117112B3F775F7BC602139B25A8787A89F3D25168A7D893202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859058, "uuid": "299f8489-3037-4e84-ab48-2e16074d5485", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859058, "uuid": "bdf44f36-c258-4b6f-aea4-06c2632603fa", "value": "6144:F8LxBsoenoyrZmqRtTAroFnjvAIQ7tCehB1pKo5apdHYtOSqM2o7YtENjBYK3C1:/oentn3TAAnbhQ7tCehBadpY4bPjtEN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859058, "uuid": "ced76f6e-fbf7-45d0-9f50-0073a711c978", "value": 370480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859058, "uuid": "bc531ded-391c-4fb0-af4d-ca09a997e489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859058, "uuid": "68d4afa6-dd24-4ec5-b70b-1639fa04ffc4", "value": "b559f853c534c533f75d09966aec1a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea94585-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698833530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833530, "uuid": "b42d6811-5deb-4659-9569-3757303666ce", "comment": "Malware payload (RemcosRAT)", "value": "d1d6a5f8c4fdeb6ca94550107dfd4ee7", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833530, "uuid": "929adca7-bae6-48a3-ae20-8f5c82b6ee23", "comment": "Malware payload (RemcosRAT)", "value": "ae8ad4fc018d78223764e913df3399e89966acf0556f630bd41110b1dca00d0e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833530, "uuid": "06a7be26-bf28-49be-b7f4-85ae90411d41", "comment": "Malware payload (RemcosRAT)", "value": "f2e7c166bf3202c6a2d961a9cf36a5f17fdaf55b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833530, "uuid": "94e14f38-836c-4fed-a5d9-9253a5540cd3", "comment": "Malware payload (RemcosRAT)", "value": "e6d969e5948737778a79431c5f4cfe6e381bce90708c88a0b1ff40c8dd3d9b4b0226987ed789fce73627a689a2daa5cc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833530, "uuid": "a116bb56-51ad-4439-87d7-6ec57455fe0b", "value": "T1DDD42320090ED53A8573E17873CC0513BEB1ACD683DD9E4BD648E23A6F1E38A5D84B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833530, "uuid": "a18b9911-169a-4211-92cc-d5a5812b1b87", "value": "12288:XrChJ7mK1Zn61YYxpqHf+OuW432kAjy9XLvjDwLEESflu86TfFtMdX6+:EJT961VK9ZfjabvfFfluBtMdX6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833530, "uuid": "864c9622-c30c-4395-8f51-4468dd713d16", "value": 602812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833530, "uuid": "8d6d017c-227a-4055-84db-e0a27170d363", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833530, "uuid": "59b0dc7e-0955-447d-bf7e-3aee90ea815e", "value": "DHRI_kurumsal kimlik rehberi-2023.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb489537-78ec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698866971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866971, "uuid": "5073727c-1503-4c7f-a06a-0f3b6f7e2d76", "comment": "Malware payload", "value": "bb045fed46770f7e0f38b80400e54cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866971, "uuid": "db5ff7b3-7631-4dee-b6ef-dec135d724a5", "comment": "Malware payload", "value": "aeaa1d57c6bffc140e7c78c919e343b0ace6275b140f5f939cd18028bea3a78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866971, "uuid": "1debbf18-810c-4c56-8d1d-7674ee8d99f1", "comment": "Malware payload", "value": "1a8144d14281db7d0334ad3dd68c43b0e68ec070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698866971, "uuid": "f857d60f-5408-4f21-ab19-4f98c1eb5c76", "comment": "Malware payload", "value": "d0ca62b32e1e6f6e6e07454ac1453bc6d3009931ef1c9be9bc70d6e8ed1ddf8e473b5d92ca8b11daae0d2b669c91d44f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866971, "uuid": "8e7b11bb-f922-44c6-9fe3-f4ef0a4a3095", "value": "T11F558D71B402D037E1A101F5A67E9BA611ADBA3017AB08D7B7C05E7D94F19C36236F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866971, "uuid": "078cfc6c-f795-446b-9ec2-99c9892a3a96", "value": "25c8ae30cd1820a1b5b2591280c2ac98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866971, "uuid": "721763af-560d-4ed6-9965-a5945f1e3e98", "value": "24576:MF9uwNfSKYFODIbxDtU9jyuSmsLNvwqsbQJWBMFbSFv/XsTRY09W54KycnnC3:qgKal12UpkbQJW2FbSFXXsT99W54Kycm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698866971, "uuid": "f2a5cbe9-95ff-4217-8bd8-d8de9eb9c665", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698866971, "uuid": "a5162584-e8bf-4855-bc16-f10a78d06f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698866971, "uuid": "f10f107a-cfd8-4239-9e4e-4fae52d53136", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb981420-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820076, "uuid": "dcd82bd3-4731-4e9c-978d-f0c106a040da", "comment": "Malware payload (AgentTesla)", "value": "5365d6e86212cd31b86f2d3efe9e2ff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820076, "uuid": "001ac12b-6b6d-4e56-b9e8-0b5af4d702dc", "comment": "Malware payload (AgentTesla)", "value": "af9c0723265969f5777f97b8fd8a3b8110999a1ad4314bd956bda20081fdade9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820076, "uuid": "e67e91aa-094e-46c5-8445-8998775a6d23", "comment": "Malware payload (AgentTesla)", "value": "501794929ae34caab7e6d3dbe106933a78d7f6fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820076, "uuid": "2a4bffcd-a0fd-4bac-bc40-b3f2358ce943", "comment": "Malware payload (AgentTesla)", "value": "517906dd099e4a3545ca135614ddfc06ed234d3d5697b8b9f63cd2d233ba09648b75c3a26d9750f9e6110ba6e8a01674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820076, "uuid": "8b8a90b0-181b-4160-9d2a-a608d9cd6616", "value": "T16924B09BB50274CFCC4BC932C9DA4C28AB71A7AB6343C147A04B239D8E4D7979F151E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820076, "uuid": "c3b55e41-e050-45b6-ad8f-dffaac2f5e57", "value": "6144:gnXQFAnv6VJ5UDEjuHb+/WZtWcfmiSzvjyvj5:QQWnv6VJ5UD2uHb+/WZJaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820076, "uuid": "4e6d8591-8235-45f1-86a6-a44b6c49d640", "value": 226944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820076, "uuid": "fc00e477-3492-469e-8e74-8f0d61b6201e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820076, "uuid": "63770973-6ae9-474f-a0a7-9de6718a2f5d", "value": "99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1da847b-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698855305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855305, "uuid": "728233ca-bbaf-4975-8b61-780f84017fff", "comment": "Malware payload (MysticStealer)", "value": "534860a3a2a1ff00741586ef5bc75580", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855305, "uuid": "8990915c-e2cf-4ea9-a090-b79844cf5141", "comment": "Malware payload (MysticStealer)", "value": "afad9b62a94c1a4a51d6ec252c80f93e875d234e448b3a92e0435276dd4f8837", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855305, "uuid": "22dbc142-fa5b-48a0-8db3-18962c68e88b", "comment": "Malware payload (MysticStealer)", "value": "8f638188191e3539c288265aa3dc76ef3b68676b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855305, "uuid": "3ef5b713-4508-400a-a229-2482ca379010", "comment": "Malware payload (MysticStealer)", "value": "5481154ec1f55f3775e996683aabaa92f1f66ffd20c9e54adc3fb69a0b2488a5091d4bc99b69e48ba90d41fb460601fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855305, "uuid": "7b5fe515-f345-492a-9ef9-ecc1061c53fd", "value": "T14C06F7F47251BEE60F74591DF38F80B26C27B86BF0BE5E8A22961D5D81C4244D9E6CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855305, "uuid": "d5e65ecd-3444-4953-9bf8-92a5e1938702", "value": "49152:8JaL9zbfzCXhp+fBjAfcyg/VqmLpY5GoE1iw1sUYvKjHOVvTkhw6pirgf+9hMxYC:Mch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855305, "uuid": "57d977ab-3c14-496f-a4c2-c2724c5de21b", "value": 3672660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855305, "uuid": "45f4de9e-c264-416e-8a80-bfd1d5c07ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855305, "uuid": "b0cf360e-ce1d-4e68-a5f7-b495224fb19e", "value": "INVOICE_87016385.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5281bd90-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819873, "uuid": "9b58a4fe-d573-42d8-b334-20549eef1efc", "comment": "Malware payload", "value": "dbe4131e9bd249270759f5cb9f7ff4cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819873, "uuid": "7b4bdd1a-435b-4fd6-9231-16d1f28f13ee", "comment": "Malware payload", "value": "b17f58e6cca96d1ca8b64bf14484507c0550ea86e4cbb3c9c6d66a6c39f6cc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819873, "uuid": "0b7fc8ef-0fcc-47a2-a3c9-e7ee1df805b3", "comment": "Malware payload", "value": "bdb970d67630d18f1cdd3c4073811bea5e639fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819873, "uuid": "649d3d81-9354-44ec-aba6-1c2755980faa", "comment": "Malware payload", "value": "9f1e9a91e0bf7f513910c2a1cd7b16e2f617be39a3190607d9dbce1a24c7a57ac007e072040188b3e73dfbc63f6a2bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819873, "uuid": "6cb7f233-591d-4e7f-8b8a-3379ad8437e9", "value": "T135B35B066A875215C4987AF8A4F2512217B3AFC62233C18B79B87B454E72783EFC178D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819873, "uuid": "e99949a6-cabb-4ab4-ab98-5de7391aec5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819873, "uuid": "02455ff9-37e7-48d4-aff7-f791216d55d0", "value": "1536:ayg+MxvHhjH/WS2uxFHbJ7OmZCgXOA630VDFi7TPxdF8o75F943hh:iR/CuxFHbJpZXGEVDFifxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819873, "uuid": "3755c225-ec30-4eed-b2e1-0c7894f71ed9", "value": 110152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819873, "uuid": "5f5387f7-f08b-4560-b2eb-f70133072fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819873, "uuid": "353c42dd-bab8-4f6b-a578-e894980077ac", "value": "TR Factura_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1a3ff8-78a8-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698837743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837743, "uuid": "a2f4f7a0-8e20-4aac-a20c-32356684a2dc", "comment": "Malware payload (RemcosRAT)", "value": "bf8a372e172c89863c51d56b93b57fd2", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837743, "uuid": "db1f5522-4b65-4cb2-bd29-b3febaa9b938", "comment": "Malware payload (RemcosRAT)", "value": "b1e62fed9f0bdb7ece3916960c6dec797895ce10488b1df01a0b881d470d40db", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837743, "uuid": "a1c317ca-7b75-4a8c-836d-a51ef122e9b4", "comment": "Malware payload (RemcosRAT)", "value": "dde790afc426361f6c019b1d652c4516a7efe822", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698837743, "uuid": "45f6b3a5-7300-4f6f-8fb7-54897da23d20", "comment": "Malware payload (RemcosRAT)", "value": "60795fd8472ddc93540cb5c9cad8407f10eb42f0b843a9b2fa13232a4eb88c6be895e46c152e86a388dd844bbc7bf85d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698837743, "uuid": "a8b7d00e-2e7d-4bef-be4d-ee4a4d059d0b", "value": "T1E234323FEA860B19415B58CDA06E2FCD1160E3796B311F956BADB0D7B414C291822BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698837743, "uuid": "1c36a068-4e50-4f32-af55-165571e4bfb0", "value": "1536:9RWUS2EBdyGNW1cLAYecpcd3qaclctjWn/Ydzpc1cPzc+c3M4s0oqcRQcDWYgpV/:acuGD7r2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698837743, "uuid": "6a13b8d1-4c94-416c-a60b-53d68241b388", "value": 232006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698837743, "uuid": "677928fe-93ce-4ac6-94b1-35c42fe03dc4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698837743, "uuid": "13d8419c-ec08-4d3b-a32c-1dffffd57079", "value": "RE_S01232_223017283_24.10.2023 30-15-18.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85360a20-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698854318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854318, "uuid": "0c3bfe91-234c-46dd-ae9f-a1698d33a70c", "comment": "Malware payload (GuLoader)", "value": "a951367936161bc1dbb20eb588a6da95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854318, "uuid": "2c67d798-bb60-455e-9936-6e68ef8bf8ac", "comment": "Malware payload (GuLoader)", "value": "b5233a8b0c90711e8382d0898799c86c61ad1a1d6f93c0105057ec4bd199ca4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854318, "uuid": "3b0f25a3-eaac-48ae-a383-028ac08fc65f", "comment": "Malware payload (GuLoader)", "value": "f1031fbc04c659943c2a34d2f45490b36ed2cc6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854318, "uuid": "60add032-0e1b-48f3-9485-6b1e60460702", "comment": "Malware payload (GuLoader)", "value": "89a404f7115030accbfa098062cc05b8b8e2dd8ed291a1583b9d16654ffc936b125608230707378b8d4dc2929da24e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854318, "uuid": "af9b082a-8b0b-486d-97ac-f1b19ca0da9c", "value": "T18B6523201955D107C35239BD4A62C2E972B16E45F910D6E3EB3CBF9DB8B61C0BB09BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854318, "uuid": "f982758a-d24f-4d01-82d1-336cadd1f681", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854318, "uuid": "2bfa22e4-2988-4c55-bfb2-a3deeb67d235", "value": "24576:4Kk6Zhc5+m5Ruww7T0OTRYoBLwbpclU12Z1owyMsMtBH9I9QoP8YfyWhk2xRUAS5:9kb5+o4wwb3BwbylFZ1l7wQokD09OuPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854318, "uuid": "93f7871d-7d3f-4bce-ae8e-4e5b85a95ddb", "value": 1514491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854318, "uuid": "4f30e803-f271-4919-92e5-a840acd5820a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854318, "uuid": "55148abf-bf34-4d82-bf28-87382df6655e", "value": "RENDEL\u00c9SI sz\u00e1m 4956655r7e-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da60f022-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821389, "uuid": "d543ab79-4f81-4ca1-9068-477c18491ec9", "comment": "Malware payload (GuLoader)", "value": "1d7d9b2e50da621729a70b6c5fc9caa2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821389, "uuid": "bb0a5a10-42dc-46fc-84fb-83c0a9a6dd0b", "comment": "Malware payload (GuLoader)", "value": "b52cdb52cff6aa924641c657d6c072e23024ec823582e6c476b6d7b9012f977f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821389, "uuid": "bab47086-f420-4343-9654-e02c7d6f5084", "comment": "Malware payload (GuLoader)", "value": "51926e5a1d6fc35d7ecb91542116a941e5ab9266", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821389, "uuid": "de0c01d3-a01d-411e-8dac-6ca39028aeef", "comment": "Malware payload (GuLoader)", "value": "f3da5be339c5c513a09fa3e9746c14c396cdd1d3c87bb8399c5f2cb8998714069cd6b7faf00231f4a9e05a84e73d111c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821389, "uuid": "13da2fa3-cb82-4d7a-b2e6-2319234fbd81", "value": "T16D935DE2DB94161D494727AEDD424972CD7C811D7613063ABFED078EB20B88C93BEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821389, "uuid": "606fef62-60f2-490f-a317-166a9eb811da", "value": "1536:GtWVqKDXxoccPljwqZhzbbZC8Iy+2WpwjQbyX9k6u18Giw6OFeBDjpy4:0OHXxTc9jwqZRbEy+PKkbqa6u3iw6sez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821389, "uuid": "42722274-501d-4290-af41-108e1bc670be", "value": 90844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821389, "uuid": "6d942a5d-6061-4225-bcf7-5f9fd1ca6a0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821389, "uuid": "6b8e9dde-92bc-43db-9e6f-3eb47f6a9366", "value": "Demande de prix U-bordeaux-montaigne france202310-31FR\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5427f5-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698820056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820056, "uuid": "d9614117-ad4c-4221-a160-e0c48fef1250", "comment": "Malware payload", "value": "1e5357c93013f5254eb3d95dca15e8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820056, "uuid": "ed2634e0-51e1-4b2b-88ee-fe003f00e842", "comment": "Malware payload", "value": "b5cfcdc1bbd12c5d8417b4be1890e98c4181b7fb0dcd9b269524b019a5d66df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820056, "uuid": "6dcff04c-5497-4f49-9eb2-ed3068b761de", "comment": "Malware payload", "value": "f143a43dfcf9868fdf1a020fe199d7020d8dcd59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820056, "uuid": "b60e55df-d38c-434c-b155-2d0989ae66b1", "comment": "Malware payload", "value": "0de902064c4e1d20c57736f1b051d7256b6c79096c5a6619d8664a5325209b90bdd3270bb285d9d2bd45b8181e8debc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820056, "uuid": "291e2846-0d74-4fa6-b989-af92f9984f0d", "value": "T1620330DD721072DFC867D0728EA95D64EA6078BF831B421790A326AEDE5D497CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820056, "uuid": "c6ad5260-6d0c-4b9c-92ee-9b29277b2fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820056, "uuid": "7396b204-36eb-4cff-9bf0-75140b2c9e81", "value": "384:xSALv1OrLIafB34LPeN8U8WVAmc+fnsYftOTLR/ehEYTLYbjmjI:xSAgrU43HwbOsYfYPZemyjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820056, "uuid": "cd297a7a-a060-402b-8d74-0e04c221a989", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820056, "uuid": "8cfd3a40-3a12-4eae-bd7b-558939846dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820056, "uuid": "1758958f-383f-4867-808f-58566cba3eca", "value": "Quote0807318940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe21bfb-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698820050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820050, "uuid": "f14e33b6-fe28-4578-a1b0-5ecbc753a668", "comment": "Malware payload (AveMariaRAT)", "value": "67402da400ada59436a91b26a1bdf358", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820050, "uuid": "8eb66b0d-1648-4b75-9a76-395845a3a9d3", "comment": "Malware payload (AveMariaRAT)", "value": "b7772e6959c773d04203373a3adcff3bc81b667726cf4f7155c9135331b21760", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820050, "uuid": "0af7a63b-78fb-43eb-97b9-768c2cfcb797", "comment": "Malware payload (AveMariaRAT)", "value": "662ebf818c49a600d122fe367b24e4d2998259e9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820050, "uuid": "a9ad4c6c-c5f1-4744-a48b-5d4091f675f1", "comment": "Malware payload (AveMariaRAT)", "value": "0bd13dfc4a845e7cc9a658b852f53990317d310aa1950f2e4346848698938080b93b57bca97603fd8cdd11e380cf74d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820050, "uuid": "fc09ba7d-5549-46b6-a09c-5dfac52d833c", "value": "T15AF42321F2908CDBC8F98B7229397A6F4EB65CA4FE44386D7BC07715A0516914B9FF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820050, "uuid": "2ec8493b-1d9b-4326-a29d-9ade8902d19e", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820050, "uuid": "ea427c06-37f3-44a5-a8ed-89f0858fb650", "value": "24576:RfL0hKAOj09taoR5KYEL78IVU/i9MWLT1NIQJH6Yz:dw9IhL/8z3kxJH6Yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820050, "uuid": "4239189c-3f8b-4162-bc37-638162b6646a", "value": 788660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820050, "uuid": "da8f8bee-4310-4745-a88f-818140b5c9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820050, "uuid": "ea10d26d-6f2b-428f-ab56-f01afcfd73b4", "value": "GHK-0987654567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02725c80-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880727, "uuid": "513dd817-8b14-4be1-b955-0940e32ff498", "comment": "Malware payload", "value": "e09313dbeeeca537bbd4e87b52cbd317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880727, "uuid": "93bc572d-43bc-4c42-b2c9-284c943aeb65", "comment": "Malware payload", "value": "b79cbb56e34e791c0030109f9c0358df8fda6be51d9a038c8d10e532f84cc489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880727, "uuid": "6434dc15-6883-4f3d-959f-edc556f22a8e", "comment": "Malware payload", "value": "6af0986c7add0ffe6f5e5ecad51a0b44f7a43a64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880727, "uuid": "cb69aade-4f29-430b-961b-a70081a70a9b", "comment": "Malware payload", "value": "90ce408e17a21834bd3de7ef4a63611492ac2291e4447b57d53faa0d10e4a0f44b5eb9e4910c5a63f219af4f932ea0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880727, "uuid": "715cd4e3-78eb-4170-96b8-336f68879a6f", "value": "T16B9533865C125936E0A18035F8CBD9609F55DBF88A34F783034708467FF261FA9F66A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880727, "uuid": "6258e4ea-c2d5-4cd4-a08f-4c1e4a9189d4", "value": "f8cf992caff47fb043d8256d71771d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880727, "uuid": "503cd953-1c95-4cc2-8a4e-9927387aa78f", "value": "49152:lf5CweNFGSlrry9YkN64NP9JEKFkOqiJWphUNNqeBqTyCW89Y:l5CwePFxy9Yb4NPXRsiJTNqeByy/89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880727, "uuid": "7e1d83c5-e4ea-4df9-bc91-b8af23b1d459", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880727, "uuid": "fa5a1471-b356-4935-8612-86b9c7733fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880727, "uuid": "a78448b6-c690-4316-be77-ab135bcb2a59", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27173.29057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60ede11-790e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698881565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698881565, "uuid": "0c2f6a6a-9c52-4c18-b787-b82efb498b60", "comment": "Malware payload", "value": "3f7e2310b4bc327ff524d314711b1857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698881565, "uuid": "33756bae-1c24-404c-b951-3e4d10f265b2", "comment": "Malware payload", "value": "b876aced86b0a17b4469db3a1bd3b18e01ba292eb205fd2796c117aa3cf0e2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698881565, "uuid": "52eb4794-e2fc-49e1-89a2-68e656f8b6d4", "comment": "Malware payload", "value": "15db575ca2db44ff893a4bf4b7fb87bc54fc4c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698881565, "uuid": "321c4bf3-9c4b-42df-abe0-0a2f4ef772fa", "comment": "Malware payload", "value": "33a8a2aab3815a36bf84364a47d92ee8281b70451489cbfa923f77946791a244abf4bddd49c50b56cf76234a7958d682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698881565, "uuid": "87f8c668-c440-4fc0-a8e8-a20f39999dd8", "value": "T1CF247C1352F1BC61F6274773AE2AC1A4769EB5608F557B9B22549E2F09B13F2C272303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698881565, "uuid": "f09f612a-3589-4415-ba02-379f050fa04a", "value": "986bd7e9a23efe5404746408f2b31f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698881565, "uuid": "1e61f791-d326-4ff1-b56b-70a5489711c8", "value": "6144:poA9lWT6X4+Gv8egWCYJ5Uv5tH7SUrpLEw:/lk6X4J8egW5UxtHm2Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698881565, "uuid": "b0f447f2-599f-41a2-92da-0d9ef14dbcd3", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698881565, "uuid": "f4d4c5f0-10b9-46bb-af55-5952deb97f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698881565, "uuid": "71ef35b2-8731-4962-92dc-10b7efaec698", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4604cda-78de-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698860866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860866, "uuid": "bec6f6f1-c3bd-45c4-9f09-2e2ade35fa2c", "comment": "Malware payload (RemcosRAT)", "value": "e02a020b9184bc97405f337e6463fb8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860866, "uuid": "23517e36-7654-4504-a66e-cc080a1408d4", "comment": "Malware payload (RemcosRAT)", "value": "b89c5a9c7ae50cdd6825a645c72d8a7009c38f0372db4fe5224c7e2af8200be4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860866, "uuid": "0acb4624-deb3-409e-84c4-644d87f59771", "comment": "Malware payload (RemcosRAT)", "value": "7e1263cdfc1038fe0cfcab9bd651330b1e2583f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698860866, "uuid": "3693d477-c2a3-4c4c-b481-13683ab23a7b", "comment": "Malware payload (RemcosRAT)", "value": "09c9b1d5f1917c6473ff9c7e5a739fa0e9d5fdb044cf88b4530eacc6d5e36069c10b6c202d4f3b6b5e8b6ce10e65c341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860866, "uuid": "91e96856-b692-4668-a2c7-8d9b27d3422a", "value": "T10205F140A50C5283F1A63B38C8AEE3B72A55AD619EF5880F62D17C3B757D45BBC382D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860866, "uuid": "b76b6333-9c58-43c3-baaf-a9fdb316a215", "value": "d1d5c692ee20bbf9340f0575f4c087d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860866, "uuid": "855773b6-3fea-461c-9d7a-714219518623", "value": "12288:EassGvch66hNN0XKCstHcOkh2Saw7biHondcOFcWnuo:EddMbwKllcPowMonlzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698860866, "uuid": "30e02201-7ac1-419d-a114-c01a81d7bc67", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698860866, "uuid": "bc9482e7-134a-49d1-87c0-c3dc15bb9705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698860866, "uuid": "9523b731-927c-485e-8fc9-aed76305500e", "value": "LauncherPatcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50045830-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698819439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819439, "uuid": "d4374277-b17a-41a5-9ae2-427fecbf89c2", "comment": "Malware payload (SnakeKeylogger)", "value": "6948d3ae7ef630dd997b7d09e17159a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819439, "uuid": "72856072-3933-4f5d-954b-a95ac6111b03", "comment": "Malware payload (SnakeKeylogger)", "value": "b8c9a4161e9621de6e7fa177230bd3841a575a00f0456b54efab368046479722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819439, "uuid": "f798ec7e-5129-4b66-906a-e666dd4d52c8", "comment": "Malware payload (SnakeKeylogger)", "value": "f22729b5b442119a1de75e12af90e3d97a1de68c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819439, "uuid": "7aafe921-5f8a-4894-a35f-7141c5ab3ed0", "comment": "Malware payload (SnakeKeylogger)", "value": "486deffd08a0366ffef55a63bce2fb231b5c56ad19bdce4afcb9755fdc33407742f3d17a51eaf2d38e87854ce47f2591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819439, "uuid": "ed8e3fb7-6ac2-437c-97b8-71d5add59203", "value": "T14DE47B68A156C899F65F437291ECFFB013B271E3E1C8C75792A82284D7D9FD60D8128E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819439, "uuid": "8fa8c9a2-eb34-43e7-830e-aceb64167300", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819439, "uuid": "bb50fb55-9208-428f-ad94-1fbab809b0b4", "value": "12288:6p11OhPAWlfRexM/YUPH6NFusNkmXuQcKyHQu:6O5AWlfRAFNMSMQcKBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819439, "uuid": "bd8a4178-e1fb-4f65-b972-9df47b3f5bae", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819439, "uuid": "2ba2b7b3-3f25-43d1-b995-8015b32bc0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819439, "uuid": "6e231295-5305-4235-99c5-878eefc2d283", "value": "U1su8hmVj4ourFo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd0c646-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833529, "uuid": "ada47199-4dd4-4b95-bf7b-728f86409dfb", "comment": "Malware payload", "value": "248b4d4f33fb7db3fc76fe526520e1ee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833529, "uuid": "f445ebb4-ac51-4a08-a876-1ee55bd45f34", "comment": "Malware payload", "value": "b98ec1576e81fed83435e274fe09f2250ad5a921d7cc1fa19fa91962b6d89bdb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833529, "uuid": "9fdb73f8-fb09-40c6-af0e-60894441d189", "comment": "Malware payload", "value": "3b2cf56f3f38aadfe8621f6fee6ee94ff1a7f968", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833529, "uuid": "01588c7e-def6-4998-b31f-d6918a945d52", "comment": "Malware payload", "value": "f1f01f5e04e559a5452a6779f600f8f3576c513aaa328b2d1ac91addac4cd31a0470fcf44ced5efbbfbeff42b757868e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833529, "uuid": "d897e14c-e761-449a-a6be-d4a1e947d7ca", "value": "T1DC141274D55DD654FBA4600F4BCA2EBA3E8D7C368031F88B4100A7AD4A62F4BA3C3617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833529, "uuid": "22eae4ca-57cc-4b0d-a68b-c16c61c7d54d", "value": "6144:EnQHjNx4Us+ksbQBCn9bk/56irmcE5or/arJK:CQHjNdYBgVQ68r/ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833529, "uuid": "eb340013-bf7e-42a3-a3da-4478190d51a8", "value": 199115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833529, "uuid": "1dfd0e95-b62a-49f2-aa90-333a66312871", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833529, "uuid": "31ce8929-7233-4f6c-9225-843d975d0e1a", "value": "Delectuso.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c9d20c-78db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859369, "uuid": "74b96a99-9dc8-4d40-9edd-82e9c363f10e", "comment": "Malware payload", "value": "9875c08e48826d3555bd636646ff0026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859369, "uuid": "cedc3550-5b5a-4108-acb8-a90f8944d5be", "comment": "Malware payload", "value": "bad72dba10c1eda6671aa7fdef831e23b7fededfc4f0b71d55a31f70f78d8dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859369, "uuid": "8a2a9b0a-1577-4495-a8a6-06839c006c21", "comment": "Malware payload", "value": "ae31ec804c4f146819627677254698c14142d752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859369, "uuid": "517e59c5-054c-4c8e-9d92-8a63839935f5", "comment": "Malware payload", "value": "2ce907cb7aa208a9eaebd4a703b68bfbbae17f471c926c85ca1f00fd5e1d5017b9cf2b271c2db1edcdab2ebf0ec8a15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859369, "uuid": "3d6caa99-2702-4bde-85ec-2bad36b55e8f", "value": "T1AAC3AD0456C1504FF05E433220D86FB3E6B7AD3129553C43EF22ABDABEA45F6A61C297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859369, "uuid": "dbd762a5-aa6c-4ed9-8382-e6fef02c58bf", "value": "3072:vOFIJ3oVdYUKi6wWl2k8C6U1MlNEdEjdq8I:vcIhoXsl2k8/NLQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859369, "uuid": "5000765d-7317-4f00-93f7-3011cd01eec2", "value": 126054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859369, "uuid": "debca500-d79a-4eaf-bf23-9ebdaf1ba35c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859369, "uuid": "df096c79-0a3c-4536-b143-100424ff74ba", "value": "SecuriteInfo.com.W32.A-250cbb44.Eldorado.28761.31829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acee8765-78a4-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698835916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698835916, "uuid": "88a5075e-b1e1-4339-a73b-a29932fe0cf6", "comment": "Malware payload (Smoke Loader)", "value": "36cf36a3c8fa1e1a5233ffdf9330ddd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698835916, "uuid": "370b1009-7b85-4228-886d-f71834c2026b", "comment": "Malware payload (Smoke Loader)", "value": "bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698835916, "uuid": "cd77b457-42be-41fa-bb05-1146289aeeef", "comment": "Malware payload (Smoke Loader)", "value": "a42407109009e07fc2e6a56b529f6a0fb070de0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698835916, "uuid": "e225a6ba-59f3-438a-8c1d-30d72e0edf7e", "comment": "Malware payload (Smoke Loader)", "value": "fff4ea4099dfccdf2c5b018c54d39dd0023775af67eaf3011af96326da9f40160ab24be89b41e5264e0de5386286c923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698835916, "uuid": "658f48d7-90ee-43fb-b876-47e329fa6e64", "value": "T190540114A1F07B15DCE98BF09CB183A51372341B3425E75DDCC9E4C93046BE98BD9A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698835916, "uuid": "1593dae2-f366-4b82-9835-def2e16a4f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698835916, "uuid": "8ce23ecd-1ee0-4ce7-9d72-3cf76debab9d", "value": "6144:/9Y90LApw57eljENjT3NjDdYZTYkRgoq80msoqGLIf6Af1lc+:/O908AwjEDj+TYkL0roqmIf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698835916, "uuid": "8ce12041-b770-47e6-9a99-639ea9afa5dc", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698835916, "uuid": "3ce8b2b0-c37d-444b-820f-4e829f31a0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698835916, "uuid": "4a21663d-9f1b-47da-a64a-6fd3ee830f4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970022c4-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821276, "uuid": "55bcd15a-a422-4e85-954e-ae698699ad7a", "comment": "Malware payload (GuLoader)", "value": "c8268a3df5b5482622a268e05778ec60", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821276, "uuid": "701b5407-2644-473c-a1dc-a8581d1037d6", "comment": "Malware payload (GuLoader)", "value": "bd507ae47d810144a22828e8e9a0cd84764116c0e6147a35d665e6acf88fb82c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821276, "uuid": "5d8223de-79f9-4e21-9604-4bd9a8dfe21d", "comment": "Malware payload (GuLoader)", "value": "4682bb810967aafbb3a5106f746a8702c6f0e474", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821276, "uuid": "6bcc752e-b3cd-4038-9f81-0f6bec49f486", "comment": "Malware payload (GuLoader)", "value": "57a68bbf0c830917b2d7eab852d147e88e01f3cc5890d176d7ab67b9cba11025957bb52c85922888e48b69ff9c584cd5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821276, "uuid": "12d16f53-62e1-4534-badf-37295af820b3", "value": "T123336CA2DA56070B4D4B27C9DD824981C1BD801D15364526FFD913CEA30B66CE3BEF1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821276, "uuid": "aa5fa023-6fb3-472b-8a40-7caa5c5847d0", "value": "768:hVsvoMUhiysh5D1FrWIcC0q4XYEU5UMoKaXly8km40a5CgIdYBffotLEDrC3t6Af:DV8Xh53r/cC0qLEUdXVS2ZQtL+rBFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821276, "uuid": "80fee8a5-d8f3-402a-adaa-369aa9242ca7", "value": 53447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821276, "uuid": "f7bca2ac-173d-4447-9cba-85f2c59163aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821276, "uuid": "0dee1284-db1e-4677-8359-fd62db40aa3b", "value": "Tutelar.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9ae951-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698825906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825906, "uuid": "f7a4c1de-7b05-445c-bf2e-79b357170454", "comment": "Malware payload (RemcosRAT)", "value": "b8a586aec9f2c272126227e60f7e5307", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825906, "uuid": "18050604-a80d-4d97-be45-90c622034104", "comment": "Malware payload (RemcosRAT)", "value": "bd94efceec1d52d34bfb50433b26901d14edc877938ffbaf01b77a7f59240551", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825906, "uuid": "1718222f-46ca-4a01-a852-7c1045994245", "comment": "Malware payload (RemcosRAT)", "value": "51492a3045c34f729b8e7498a48e370bd44e70b4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825906, "uuid": "7b25cf3b-5670-49c0-b43c-47c5c0e3b397", "comment": "Malware payload (RemcosRAT)", "value": "13eb2c881905458bf03b6a6f9aeb5e231bf7b5ce40ef7e0915d432eb7857735e8a53ec2eec9d2de68f78add8169610d3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825906, "uuid": "15ae1771-6a66-4976-86ed-158357e05dd7", "value": "T15E84232ECFEF619E0EC6D502F7062C661C894195AEC72FFA07634401FCE4AE2F5A51A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825906, "uuid": "ac330e94-3cbd-4743-ad97-1ffb66c942c4", "value": "12288:cYWtV6iEcyho0BAjKxir503ES3yfziY1Be:cXDahofKor5kD3cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825906, "uuid": "bc72e35e-62a6-4dbe-ad22-2a6f9029e030", "value": 396576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825906, "uuid": "ba2b22bd-1c25-4f9c-b46b-a89c12843bdd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825906, "uuid": "a471acba-ca0d-4ab3-a900-0e3037c40bb4", "value": "RHLP00098890080.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3eb7c6-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698819779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819779, "uuid": "9c3a81bb-9d14-4dca-a633-579e05411111", "comment": "Malware payload (AveMariaRAT)", "value": "0c5500b50fe34fe3554a39751bfb5ab9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819779, "uuid": "7af8b768-85ea-46e9-945f-9b39f4daac28", "comment": "Malware payload (AveMariaRAT)", "value": "bde714b8a52d884f1ac46a23e613e4bb8690c6e0a7f801ff9289242acfcd6f64", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819779, "uuid": "6ef85f0b-ea3e-4d16-b082-b77644919d30", "comment": "Malware payload (AveMariaRAT)", "value": "fed6dacaec2a50aa73a23fcbb264a11d7a7cf3bd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819779, "uuid": "0badf7f0-635a-4755-98f6-83bcb49f2e18", "comment": "Malware payload (AveMariaRAT)", "value": "8e551774ed55c0129a7f25e33c79a03bf71bcb2f6cfbca87f5e013b49cb611db3181f3223ff017596b72003f6d97fcb9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819779, "uuid": "00dcd0e6-adde-4c7e-bf77-12f49770c984", "value": "T1A644ADB27AA25018C994B7F544B0004A56349E833813DF8224BF7B196EB13E7EEDD59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819779, "uuid": "577665ad-5d6a-4557-8323-0a4d85eb8977", "value": "3072:Lha4tVxxZ83BEaFiIjJ7qgTe5c3oBo5uO/z7bhFWM82NYnyiqEVD4rfxvXX4:laMwSaFiIJqge4oBo5uO/ftrrEVDEn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819779, "uuid": "1a08c195-e483-4bef-97fb-eddc17904bb3", "value": 268360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819779, "uuid": "65db923d-1af0-4530-9f73-bfb493e6df03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819779, "uuid": "7059ab83-9431-4693-b480-a1dfb6dd2fb4", "value": "Commercial invoice & PL_xlxs__________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b20544f-7892-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698828048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828048, "uuid": "bbd2ac12-1e54-49b8-8145-cfe86c10362b", "comment": "Malware payload (Formbook)", "value": "147306fc892646cd7e4ddd8cdd0b18a7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828048, "uuid": "fa3912dd-eaeb-4c6b-a9b0-16978849cbeb", "comment": "Malware payload (Formbook)", "value": "be9cc5cd9b4db90edc62987c19fab231f5404880ce7e8dab20febab3f7c5bfa7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828048, "uuid": "24e156d4-79d2-4ade-99e2-e2d0687d56e0", "comment": "Malware payload (Formbook)", "value": "9e93bff3114ead48dea2b5876ac2b5ea928f8c7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828048, "uuid": "0771a856-4641-4d1b-88ad-35e33cedbd21", "comment": "Malware payload (Formbook)", "value": "962343ab86cf8665893659392530ad9918bf95d70fdb4f356e048b712e2ad0e5e3ca5375b7b6138465e868871777ee54", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828048, "uuid": "74cd74a2-833a-431e-801d-1402eb091485", "value": "T1CFE4236AD5FAC5DBCA39B447BF584E583E503D4850025F7853A20BB4ACABF4E42E10BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828048, "uuid": "1388241e-f8ec-43b8-a73d-16ae03e52bda", "value": "12288:yzw/hmfjsgpEBAUYGtwvVPHpFRZhjULkY8TXTHnEZ9gzCKrZZRBVteZXc5iCS0k2:yz7fYgpUYSwd/pzZ+mDcOeABXeSkC1A2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828048, "uuid": "1ac5f6bd-5690-4a61-a8b4-226f3a6c3ada", "value": 718362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828048, "uuid": "1f5794f8-6281-45cd-8edf-4d0e4d089cef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828048, "uuid": "7fffb156-dae8-483a-80f5-4cea320fe0c7", "value": "Shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb8a836-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880716, "uuid": "bf6333b6-2a8a-4d72-ae1e-1cd8b077c1d5", "comment": "Malware payload", "value": "910dcaa1e38602fd253fffbcb1ebb556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880716, "uuid": "b0be8564-f1ef-4978-b4e8-61467588f32f", "comment": "Malware payload", "value": "bf1a9e98ada181bece31f531f34c56d2bb952a5f8f4414e19953182b0f60c9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880716, "uuid": "145a6b1f-1158-41d4-a128-12c7ef1b0232", "comment": "Malware payload", "value": "7a7daecd5e2333a3394f8ea464c463e0b7467cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880716, "uuid": "145d5059-7c82-407f-a88b-b3d4c048c02b", "comment": "Malware payload", "value": "88a107b9057f24b67cac6e9a4b59c2c04b59552ffb661d6127bb31fb53a6872bd4e2509e75244aa79123eabf23b91f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880716, "uuid": "ede46821-d869-4888-aea7-793bc905cb7a", "value": "T181F523D1D5582377E262A8F11027518EDA2E0EE2213DF97513F33A8279312FAB53758E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880716, "uuid": "6d10f4bc-0c30-4fdc-861e-3cfb12637b8a", "value": "6402e18c92baac551b11b48770d51536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880716, "uuid": "ff063065-94d4-4970-9567-4533ef3c40df", "value": "49152:jgd1PujA4v42CynNvSd0h1gtH8YmYkyOHl4PNt1VuRENc8nMw39X8eFA/6fRBY4Q:I6hQw8P8YDfRDVuYJD8aGkUMM3Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880716, "uuid": "f90512bb-dc47-4fba-a889-9e1e0846c610", "value": 3600384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880716, "uuid": "8cd7242d-938b-434b-8c27-d4a4c1f61041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880716, "uuid": "7cb15758-a2a2-411d-87f7-1dd53d63f63a", "value": "SecuriteInfo.com.FileRepMalware.11022.8536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b486d0bf-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698820037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820037, "uuid": "62236cfa-4168-44ad-94ae-ccd2484bad7e", "comment": "Malware payload (GuLoader)", "value": "9cecc409f4f9637375b042b196012854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820037, "uuid": "d74bf458-57a6-4a95-92fb-d4cbaddd3138", "comment": "Malware payload (GuLoader)", "value": "bfb89b8cfb7e0bef091052feef1b6334007932f8db57417445d0476ac22eb1f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820037, "uuid": "adf060b8-c2ec-49a2-8254-13132f5568df", "comment": "Malware payload (GuLoader)", "value": "f6c07a9f0d98e34247d91de3c1a5a996e8d98791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820037, "uuid": "841b649f-e233-4294-bbb8-97b5616fa8e3", "comment": "Malware payload (GuLoader)", "value": "eef86285611e2fb91e4d50284cddd3481db39fe9c2bd3ce9fc64cd326989fedc4f182820b5d992889b0bd1cf2326e9b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820037, "uuid": "fa2a7f3f-f928-44cd-9343-c4cdbcf9c3a9", "value": "T1D665330401FE9C8BE130237016D6DF3F7D877E629C9522469BEA7D6A9C36103E879A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820037, "uuid": "a60ae611-a703-42ee-afeb-0e872e086852", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820037, "uuid": "0a2e76bd-473d-4e6d-b8b6-ee0d484c357d", "value": "24576:jA1n0X5beihrDORQaNrgddweDnbdGNcvJWf2yKIkLin3fkm46kuwaZuvRAn0lVb2:D5beihH4QQgddweNhWf2/Lc3fk62miiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820037, "uuid": "5da858a5-d853-4959-a577-591b09159e83", "value": 1503236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820037, "uuid": "8fe9f226-6c0f-4983-abd2-fc388152fc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820037, "uuid": "7c120369-855e-4629-b1e5-92221d0e06de", "value": "INVOICE-98656789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867f2dc0-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1698855609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855609, "uuid": "f7ccc7db-8eba-45de-a118-ee5808a6a0b8", "comment": "Malware payload (NanoCore)", "value": "00e7aab668ba6a8dcecf186d5fc789c3", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855609, "uuid": "56df178f-baa2-4091-a2df-f331deed7928", "comment": "Malware payload (NanoCore)", "value": "c014e9ea2000ac1f4663379a97c30cc53701ea83b02e4de0e8d34e4758de76d2", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855609, "uuid": "899b0d10-e4dd-4b38-bc50-3bccd6ca7c55", "comment": "Malware payload (NanoCore)", "value": "d639abff79d812e4aa885c364566af1862c80a12", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855609, "uuid": "5ff4f438-dec9-4881-98bb-c42b522f718b", "comment": "Malware payload (NanoCore)", "value": "92b917234ac139056c98d751b64d861450062ec52285f38793199fa2b2eaccd791fc63c4f96b407f911c6a461877ff23", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855609, "uuid": "197c252c-4b5c-4500-8594-3e0bc9d0789f", "value": "T1DA14BF2577A94A2FE2DF86B9B12241139779C2E798C3F3DE28E455B24F163E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855609, "uuid": "0a935226-7bd3-42f6-81b8-1173685021ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855609, "uuid": "5320cec6-6d87-4297-9447-d26f24ab39c1", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIdsVWLjxKXC0CSlMBjJtS9v3JK:gLV6Bta6dtJmakIM5jWvUo4MBNti5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855609, "uuid": "3fe65a37-f878-4e0e-80c7-add31c0987a3", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855609, "uuid": "777d21a7-5376-43d6-967b-88dc26fc42a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855609, "uuid": "08df8d11-d002-47be-b0cb-8ed60d602bf7", "value": "1698855607bbf071db6973fd66d1a3c06d92c94a4ce3d4b267b5a3f447487ad428b5901478136.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcb2f39-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698833532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833532, "uuid": "f57b1258-aca7-46bf-855b-4dfde6a44e86", "comment": "Malware payload (zgRAT)", "value": "6c3470e5f5e908a3ec167494f92ad3ff", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833532, "uuid": "76f77f92-cc6d-4941-bb4d-1da5a95fda98", "comment": "Malware payload (zgRAT)", "value": "c0264eec4e395c3bd9a5821e7273db8091659ce8c8b9fff8da0911461a6e35c7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833532, "uuid": "3f0e85ac-9fa1-4ba8-b1f2-b6d36db6be60", "comment": "Malware payload (zgRAT)", "value": "adfa4b2560ca758cfafbe52843023288d04a0588", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833532, "uuid": "9466ad9a-6fb4-4553-8126-280d418a6478", "comment": "Malware payload (zgRAT)", "value": "8452eaccf37afd5b749ba6ab91ce3fc756ca1f1987070d161cca6ae056da20f75c89c88c21f92fb5e8951a7853ccf560", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833532, "uuid": "b296d5f9-9c22-45e9-9d5a-dde5c9c78ab6", "value": "T123535A2166DBF408B1517F624BC539E68F2BBBE4277B601EE304170A8A62F458D45BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833532, "uuid": "f0d83254-9854-437c-8277-289d5de1cd67", "value": "384:/mX7ZRYMYM7KfzMfzrfzQrDgmVXH15H2gPq:/mXdJ7KfzMfzrfzQrDgA726q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833532, "uuid": "de7ccab5-e6b3-4715-9176-ad3baf86f765", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833532, "uuid": "a039b7af-89d7-460d-bc4f-890a8c5ad541", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833532, "uuid": "78c7eb12-e58e-4771-b387-efcedddafa2b", "value": "documentosdhl080869.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad9a0bd-7858-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698803083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698803083, "uuid": "87baaf8d-8e67-4cc2-802e-26dc599b52ef", "comment": "Malware payload (RedLineStealer)", "value": "227e079e196474e1d0cc1012129edfec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698803083, "uuid": "95cd0c6a-9e7d-460b-902f-f05019f79869", "comment": "Malware payload (RedLineStealer)", "value": "c0a814071b61136589ed07da216f842be99122c592615b63122be04581059200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698803083, "uuid": "418db9d7-0d93-46f8-9433-c97e83f5c0e2", "comment": "Malware payload (RedLineStealer)", "value": "5648b0823e5035ae88b71676acc47f7070977a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698803083, "uuid": "53a664c1-f26e-4b6e-a308-349317e23d44", "comment": "Malware payload (RedLineStealer)", "value": "29df89537ce690ae07dbed7cbc06327d410c8d8c7d4875a043d52d5dd3dcfb2b3a242c856af179069bd113b7eb75c34a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698803083, "uuid": "cc61cd13-79ae-4e1e-8e80-75f0b8238eac", "value": "T15975232DA7E89132D9F943706CFD82C708BB7D6169B5A3373309D91A28F2594A331727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698803083, "uuid": "a7a400a8-208b-4fb2-8e67-90c72ffa9eb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698803083, "uuid": "59011d6c-52c7-4aa8-9e22-d24881562b1a", "value": "24576:8ygPIkjz+U8ON6sh0BjVuAKvB985XJFWy6APuw0Yu/SeT2xwX0VYSy3Axt:rgPIkjaU8ON6zZuAKvLkz+X0+Sye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698803083, "uuid": "5b41acce-73fd-4cbc-97fa-fa0540174519", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698803083, "uuid": "8c02dddd-1b7b-46e3-b2f1-9f0ffa0b23cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698803083, "uuid": "c614c995-6df8-412a-bb7e-0299eaaf9c28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6310737-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1698855286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855286, "uuid": "620e44af-622e-40a2-b526-cac721e4838e", "comment": "Malware payload (XWorm)", "value": "a77659b5de23b65e87927a7b4ba6920a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855286, "uuid": "dc96802b-5145-4d09-9ac9-cada0377329a", "comment": "Malware payload (XWorm)", "value": "c2d8e44e81e4fac1a35f0a25feb30f3b24b702b20bd21de7986c4392c4479007", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855286, "uuid": "6ab32ecc-304e-4e03-b5b8-ea145bce3563", "comment": "Malware payload (XWorm)", "value": "2321eb83c7c0e91c358600df16259d168548e2e0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855286, "uuid": "87d771c9-2ea2-4158-b863-b19d2403cd5c", "comment": "Malware payload (XWorm)", "value": "317803b982841b21f59a30543ecea851be17eedb17a55154189203cbaa5f3d1a145eecc762e9ccd06a5f0c1da70b43ea", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855286, "uuid": "448f2b13-e28e-4a0d-a8c1-8bbad9491f76", "value": "T1D303B85035FFA04C71B3AF611BE4B6E98E9FFB76652AA0AE1444034B8B63E40CD51772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855286, "uuid": "f8b20823-d444-4978-9eaa-365795a2d0e0", "value": "768:cHfFpvnbQHk2hdiwXCXUXxXlX4XwwFcl4SWSh:cT8jhdiwXCXUXxXlX4Xwycl4SWSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855286, "uuid": "5fe46e79-de9c-43ca-9444-8ad32a5737ea", "value": 40480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855286, "uuid": "f3a7116a-1551-4327-aeb8-a931107da65f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855286, "uuid": "95fb8d3a-ed8b-46cd-9b1b-3e9b07c83eaa", "value": "Lista degli ordini.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f01771-788d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698825892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825892, "uuid": "853c4163-dee0-40f5-86fe-2a0648f42b24", "comment": "Malware payload (AgentTesla)", "value": "1270e1a595a40a6d38cf5534594ea202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825892, "uuid": "7bf65a21-cd6f-4d47-8be7-63b67fe13234", "comment": "Malware payload (AgentTesla)", "value": "c4340dfe60004f2e5274ac4877cab731b01f4b03f708007c6b54e0335fb02b65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825892, "uuid": "a0514199-6666-4648-b500-6efc5fb3eec7", "comment": "Malware payload (AgentTesla)", "value": "73caae4f89e508930c14ce2df23a16b7498d80f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825892, "uuid": "d5ce7a9f-2f17-4bb2-87cb-0ea83e3520bc", "comment": "Malware payload (AgentTesla)", "value": "04b5d0e22b5c5bdba0183eefca2a699571cf4eee695fc73105eb51c603a40e828c6a3a05721274cf9058a2c07359904f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825892, "uuid": "c56d406b-d1c6-474a-8299-0f42953f75b1", "value": "T12E541286F5F228FEF8D39230186A9B65E3364C64C4C1E10B47D4BE1A6DB97D2990D1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825892, "uuid": "5cc5c3da-c4c6-46be-8272-5b30c906dd6b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825892, "uuid": "da2ba770-45c6-4518-9fca-5d220e1e8d23", "value": "6144:h8LxBn/GR3JgL+ZD6h2pBkeraRE7pWqDmbjl1FYW0Uq+JXSCeJJ5vNk5:su58+ZDW2pB0EtmdTvo+kJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825892, "uuid": "f129977d-b8d5-409e-b194-e35c6f96b6e8", "value": 300307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825892, "uuid": "649e1b43-9341-4ba7-923a-59a6f4a3cdf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825892, "uuid": "2c9ea27f-b667-4dce-9e6c-11e8b3538ff3", "value": "ORP0987654567000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e24109-7892-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698827990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827990, "uuid": "d16f21d4-06cf-4cd7-8517-6b440032a6c0", "comment": "Malware payload (Formbook)", "value": "bda390aaf27430a350651dce8ec64978", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827990, "uuid": "7a8b670d-dc82-4eb1-88bb-da882c6f6f71", "comment": "Malware payload (Formbook)", "value": "c46345e2ef42b919913e819fe8d5ccc35ed5401c6d2db80304efc5d85c50e6f2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827990, "uuid": "623fd9bf-bddd-4b2e-8e52-11bf6ace9993", "comment": "Malware payload (Formbook)", "value": "87edea43b62796e1480063207bbc742d88477fc8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827990, "uuid": "bb065397-e73e-4f6d-9fb5-9405454075d4", "comment": "Malware payload (Formbook)", "value": "d450db5072bda8104a974f7bea9e9db4c781ce8e0b8e201ef0d0960a4e9bedccb01247c77d9665fca59b246fb6d7cdbc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827990, "uuid": "e8389419-fae2-423a-afd5-1274a36b0182", "value": "T104E4236AD5FAC5DBCA38B447BF584E583E503D5850025F7853A20BB4ACABB4E43E10BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827990, "uuid": "f4100b78-d202-425c-933d-e71c467b2350", "value": "12288:Pzw/hmfjsgpEBAUYGtwvVPHpFRZhjULkY8TXTHnEZ9gzCKrZZRBVteZXc5iCS0kh:Pz7fYgpUYSwd/pzZ+mDcOeABXeSkC1Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827990, "uuid": "c617656b-ce56-41d0-9265-260af9bd521f", "value": 718358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827990, "uuid": "ec083198-64f4-49cf-b3a8-63c0c57333ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827990, "uuid": "6502fd6d-73e4-4c6e-98f5-35978f2c9f3c", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a9e9e7-7907-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698878233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878233, "uuid": "20b386d5-c0e9-493e-9dc9-9de61f0cd18d", "comment": "Malware payload", "value": "18055926fc6bebb1f519fe3188473565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878233, "uuid": "d1c970e5-b136-4518-9ad4-dd7a92af5e2a", "comment": "Malware payload", "value": "c4a2e403dc091a191ae09578bf914baf70fd9b2d9593f8061dc953cbd431e5b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878233, "uuid": "b2e1308a-2768-42a1-89ad-41850c0eb1d9", "comment": "Malware payload", "value": "4b35d30c0b45f050610c8032f7f2ead68cf32aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878233, "uuid": "c43d7064-057e-4b70-b653-3713b9d89071", "comment": "Malware payload", "value": "4a0da840617d3df914029a6297380099ae110b79cb6cfcb772a129c54fc26d77f88f7412a7dbbf5af614a80edb7bbf31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878233, "uuid": "9b86d0e2-2250-47a5-bac1-83027f42ddb9", "value": "T1A0D6023DA3ACD0A780B6EC2BA8911670B49F705149A2F2039FE84164EF65DECFD257D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878233, "uuid": "183eb5ae-121d-4aed-822a-f6aeb862e5cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878233, "uuid": "1edff086-30c1-4e2b-b5ef-7468c7226942", "value": "196608:VXJJnYZkz7SKwTEu/qEIshS35kTuB4c6IT2laHaDs4GHEx2z1P+3vXSTlWCFJx:VX00GKwTVqg43OFyaHgS2xQ/STX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698878233, "uuid": "d0720253-fc72-4fa7-bded-f89de26e0b80", "value": 13109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698878233, "uuid": "61aa34f2-1272-492c-baa5-443452d409d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878233, "uuid": "604c044a-3f08-4173-9484-3b655d1499a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fad23d-786d-11ee-8907-42010a9c0042", "comment": "Malware payload (Meduza)", "timestamp": 1698812205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812205, "uuid": "f4ebe249-ec75-436c-8037-2046cd131492", "comment": "Malware payload (Meduza)", "value": "c4ba9b24e18c91a0499a78e46c77f44c", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812205, "uuid": "c0263939-0af8-426a-ad51-6b9fc51ca302", "comment": "Malware payload (Meduza)", "value": "c4cf68a873fbe1829045d33bec782ce3dd4efede9be82c634f814f4cdde328a0", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812205, "uuid": "3d22691c-88af-4cba-aedd-e1d9a8f44a3d", "comment": "Malware payload (Meduza)", "value": "3832a41bd6b5cb8674fb4a9ddd8d35720bb9a4f1", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698812205, "uuid": "f52d2a48-0617-413a-83fe-c6d42f735721", "comment": "Malware payload (Meduza)", "value": "225bc4a3d6432263d9de98f1b8d483575473722a9e57fc0fa03af123bb1f3169c460530ff56522b1e9e5eef8c9ea374a", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812205, "uuid": "68cbd9f5-0f99-4f63-a53a-4bfb771369de", "value": "T1D96423A6E393C642F4C10A778C2FC7B921CDD6A9D1DDBFA5070D46225C86CB6A5231CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812205, "uuid": "3028aede-0e70-44c6-b7b7-08ead06c5186", "value": "6144:+Rc2EeGA2pGYjjr2x7CoI4SWW2XDEEkGzeRH0579HyWK2I0O3CWWGTY9y+o:QNGjjr2x2ovSWZfkLRHk7pNK2Ir3CW3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698812205, "uuid": "a2be7de0-a15e-4cbb-8d73-1ef62e6847e1", "value": 330719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698812205, "uuid": "4c226a43-b06c-4b79-9e34-ad7248e9e3f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698812205, "uuid": "8d61886c-9dbc-4218-afd9-e9774dabd61f", "value": "Metamask_Beta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b98983-7891-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827871, "uuid": "a6933df4-403f-4a7c-87d7-7624eca1d4a4", "comment": "Malware payload", "value": "1176381da7dea356f3377a59a6f0e799", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827871, "uuid": "d72e1e70-2d7b-481a-99b4-e399c7a04230", "comment": "Malware payload", "value": "c5b4542d61af74cf7454d7f1c8d96218d709de38f94ccfa7c16b15f726dc08c0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827871, "uuid": "d0a9e7c3-a0b8-4e00-8c0e-f96ce51e4a02", "comment": "Malware payload", "value": "32a1651bb810bbe58df73bc2d2c2fa702ca7abd0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827871, "uuid": "144f34b1-f290-4898-94e3-759e706e9a90", "comment": "Malware payload", "value": "ffe22f1d330d83135f9a4d59aab373ef034c9b8853a9174d3cc5d65037bf845e03fb6f4337ed728419673c4c4368db8b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827871, "uuid": "ac78dc7f-75dd-4d37-be36-ca65b417cab4", "value": "T1B27295899DB3B563F644603258CE1CE385E39FF4650325682A98357FC89B16B52EC3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827871, "uuid": "031812f7-5e6d-4a5b-9c18-e724a82aa19c", "value": "192:rJ+Pz25wcwpLpbptYpt5prprRRpHBpHB0RGp4qySZo48Bl0aHJ48gst/0fhRf9U1:oO38Y82Rf9Uu+046IUCHzfTXNoonuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827871, "uuid": "ea4d8f43-ba88-42d1-a26a-af206b2b86b3", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827871, "uuid": "c9d2266c-c621-4201-8c3c-170f6da83bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827871, "uuid": "90f0f0d2-d949-4e6d-9f1f-8ddec81785f0", "value": "wlbsctrl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35819810-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821542, "uuid": "79030fc5-c0d7-4022-9b09-be173786c5b2", "comment": "Malware payload (AgentTesla)", "value": "41dbc73bee1ef87c88c302956a0dc3aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821542, "uuid": "44dc769c-493a-497e-8274-4a2ef252ef59", "comment": "Malware payload (AgentTesla)", "value": "c62329dbc6a7f5ed969e32302f051442b4181feb66b80f5bb9d2a9a0e2477af0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821542, "uuid": "61364956-e667-4603-b9df-0b3140b2a33a", "comment": "Malware payload (AgentTesla)", "value": "d021025c40f7dfd15d114a8a9abae755202d8df9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821542, "uuid": "1a384faf-9db9-465a-8efc-f9533df27655", "comment": "Malware payload (AgentTesla)", "value": "730233ae8215472edc594639ee22caa6cd841e645002c01806ec278c052a9a341fd603644a1a29340e6554061234449e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821542, "uuid": "4ba56435-dada-43a7-9741-c0a7159bd0ea", "value": "T155D422453BF88A56CBB8C7F44466C16423F690266962E70E3ECE33CD05E7B9146E17A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821542, "uuid": "04b122f1-4af7-46e3-aa69-263fa18110b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821542, "uuid": "6f6ee6d4-6720-4daf-bcb5-fbae0f32f38c", "value": "12288:+8E69yqLyGhzKGoBznouDqTHJizCeaH/siK8jGgG3/yY95:Y6XVzKGoBT4W6RK8hPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821542, "uuid": "c4221288-ceb8-4289-a62b-0767234f0161", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821542, "uuid": "f55ae5e0-f60d-4a2f-a14b-9aec8dbb9aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821542, "uuid": "a7b4af9f-7f4f-4693-a49f-e88787c36486", "value": "Petronas196887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2591cfcf-789e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698833112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833112, "uuid": "0708ee83-8304-43c4-a781-55eb0a37b3d0", "comment": "Malware payload (LummaStealer)", "value": "af1d425db05520962f4a587ab397f188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833112, "uuid": "c56e92bb-22fb-41b4-8ce0-c4f1bebf4498", "comment": "Malware payload (LummaStealer)", "value": "c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833112, "uuid": "f0093e06-8d00-4f4b-bb79-1c00232eee2f", "comment": "Malware payload (LummaStealer)", "value": "51d4246fe8af0eeedd6e53da017a77ca265e9033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833112, "uuid": "d1386b69-bd68-468d-a41c-e0397c5e4c5a", "comment": "Malware payload (LummaStealer)", "value": "a59313a326a74795ba11b9642b38ff685b3c5d9f5f7faf31064eff8da8d4f24fc88b36f75a16e53f03ca78febb92c37f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833112, "uuid": "00982b9d-b7c7-4b6a-aa90-fd15e3ba6a8c", "value": "T13EF523726DC5513CE49A72F55217EE3EB1BA2EB87461CD4A98B8EB47CC139A4E13010F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833112, "uuid": "91537ab0-bb8b-42b8-83eb-8e09729a96ec", "value": "5c4ca581bd0c16fde33f63c4ab8ff974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833112, "uuid": "c4842963-4698-41ea-ab23-719cacb87c91", "value": "98304:/d4Y8CE49/sE8ZGPTJFLehalsqqXlGbaWaE0QMf9410wD:/l8fYsj8THLnGqcl7NZQMl4Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833112, "uuid": "73e4092e-7fd1-42a1-8f56-2507be57d10e", "value": 3346072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833112, "uuid": "30844bda-be2f-45c8-ab91-58ae05ec1b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833112, "uuid": "fc306be7-60e6-446f-823c-4bdbb17cbfd7", "value": "af1d425db05520962f4a587ab397f188.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1befd8-78da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859163, "uuid": "25aed6c5-5e3f-4e49-91af-5fe08172204a", "comment": "Malware payload", "value": "c003ceed32075bc7f2badbb474ea85a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859163, "uuid": "48cf9193-f3c7-42fc-8f1c-3934e4e7361c", "comment": "Malware payload", "value": "c77aeea8df56c68cf64ac5486a0d5774a1bd8dc6f94e3fa8ae447ff78ec12ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859163, "uuid": "ba6a1589-4a62-42e1-9907-cc566e1b5765", "comment": "Malware payload", "value": "44b4f6bb6730456a7d88b67ed0c7d90d0140b5a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859163, "uuid": "61250caa-3cf0-4430-bd61-561cf42caea1", "comment": "Malware payload", "value": "c5c3987a09c0a04ecb0a05c5d435494ae6e0958f8ad51235ee4ee22346a9bdd07ef65c0d9166703c5f5b996e6dd1d219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859163, "uuid": "f75ad7e7-3a21-4fea-b4a0-19c022abab04", "value": "T1BD550251F3F1664EE5EA8636AE2467E0537264237703E35ACC40E1DA382D7DB8BC1693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859163, "uuid": "5e753cb1-49e3-434e-9b32-0e9af2adbf55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859163, "uuid": "24fecf10-27c7-4b6a-bc08-08b66d535caa", "value": "24576:1mHjtcfR2p9iZRGJVLdRrSyE0uzlRZLfre43ccbv6oKmf8WDbuGfM:8HjtJae3jnE1zU43cGv6oKmfFDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859163, "uuid": "071aa4e2-fd71-4b62-8a2e-fbca5cf69548", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859163, "uuid": "79b6dc66-c713-4001-bbce-8a7393cb8660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859163, "uuid": "fb9286d3-10cc-4825-b3a7-6f8b646cce9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cedba43-78c1-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698848264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848264, "uuid": "58d481cb-83ef-49a8-92cf-ab1104dca847", "comment": "Malware payload (MarsStealer)", "value": "e388c54a173e4d45495d51e26164ae6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848264, "uuid": "d0b32235-75fe-4ad9-85c2-47fc57756a0b", "comment": "Malware payload (MarsStealer)", "value": "c796f0643d421491278d4d27f14f6707cacaacf1c34b5c35f61d4f4f7d39c074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848264, "uuid": "e699be68-4247-4959-bca1-55a73cd32b34", "comment": "Malware payload (MarsStealer)", "value": "50e20cca7502795e5f0458977df9f78777c9b9a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698848264, "uuid": "fca6deb2-029c-4f04-93a4-5a5b56940aba", "comment": "Malware payload (MarsStealer)", "value": "b74b332817e11dd7a9cb092da11a3dd262f19bac846f2de71385b3a88775a349f29e663b1c03492fdc2b35bdf004e76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848264, "uuid": "6befd34e-334c-4503-8467-4a89888e3835", "value": "T19D247D1312F17C61F6274B73AE2AC1B476DEB9608F5577AB12559E2F08712F2C272322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848264, "uuid": "50a5f771-2177-49ef-a52b-12a55ca2ada5", "value": "6776bdc6cd9718cb3b20cc8cf36749b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848264, "uuid": "16e96810-6de7-448a-96c8-9e9b240ebec2", "value": "3072:afKoS0pZM9FPRqgri16FVUlvsrUNBhzZ+RcWs4watIEc4ULjguk:Xos9FPA6FeFbNGch4BvULEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698848264, "uuid": "179af934-d5f6-4d8b-98f2-182e3f83ac40", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698848264, "uuid": "56e4f01e-364c-4994-afc3-05f8f3b5dc63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698848264, "uuid": "231ced57-b60e-4ac0-8a83-83283f829e4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ca5284-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1698821273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821273, "uuid": "1347a514-4928-432f-83bf-4774e127b835", "comment": "Malware payload (NanoCore)", "value": "70c3d59f8a145950e4b422792754142b", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821273, "uuid": "85621783-ce80-4e16-85aa-4d5fa4828547", "comment": "Malware payload (NanoCore)", "value": "c88e31c32d3d4221a11f04876b94bf4bb37c386dd310054b335652e797061054", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821273, "uuid": "4f775e42-92b6-4806-8909-0bd73340474b", "comment": "Malware payload (NanoCore)", "value": "924ec773984747f473c2efaa24062725f9e7fedb", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821273, "uuid": "77bfb72a-bb08-4459-9e5e-3fedaab63637", "comment": "Malware payload (NanoCore)", "value": "39652f21d94ed9eebea376e9ac28ed87e045a27dc646746c1eb1ee120399ac54e6f514a8f4857c463c8a311fff547028", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821273, "uuid": "f27303a0-3a4e-43c8-bf0a-7288cb3ed5f3", "value": "T12A935CF2DB94161D4D4B27AADC424972CD78812D2627063EFFED078DA20B55C93BEB09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821273, "uuid": "a3be66b1-d0ce-4be7-a888-8bfbfa8be312", "value": "1536:EtWVkKDLxYQcPljwi5pjbjZcAIs+XWgwjQbr06wXNVm1Oiw2OFeB7jpy4:GOFLxlc9jwi5Bjas+mNkn06Musiw2ser", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821273, "uuid": "372e4285-28c2-4d37-9985-40d90fc3e886", "value": 91100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821273, "uuid": "99b6796e-66d9-4757-af76-438a68b2c627", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821273, "uuid": "fd407ac4-b5c8-40ee-bb78-a0f0ca44ee1c", "value": "reference Drawing 20230821.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9666cc7-78c4-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698849708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849708, "uuid": "819204d5-09a4-43f8-b338-78a8e31e1586", "comment": "Malware payload (Mirai)", "value": "657b54a8d4a93349390ed020bba8ad1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849708, "uuid": "9c34744a-1106-4656-be5b-d90b384173c8", "comment": "Malware payload (Mirai)", "value": "c8d2ca8eaf72457b8bc328d25beeeea8da3a30bc06c7e5e42597f55666ebe061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849708, "uuid": "4cf825aa-0376-4808-af84-1dce8a66c59e", "comment": "Malware payload (Mirai)", "value": "4617bf99778ce29590b898bdd3a624da809e7426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849708, "uuid": "093f7c9c-bb7b-4d99-ad36-b0e134dfcfd6", "comment": "Malware payload (Mirai)", "value": "04c10765bbb6ccc6b24f8d6a5dca0b3ac8c500d769f5baa45610a3bbda8a70b9ceeb4f67d9d3e04c712a180172e9311d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849708, "uuid": "96dda12c-71a0-4313-bdd6-1da5cc4e05db", "value": "T112B32A85BC91D926C6C123B7FA2F118D331563ECE2EA3142DE142F6837CA95E1E36746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849708, "uuid": "b08af1a0-13fa-4988-ace4-00ac8e03750b", "value": "1536:L7t7l5Uw+YONWoScIGMhrMx8lt25wjqytq5xwZ6BTV3U5t5xEnheeo+A+afu1wK8:lH7+YONWG/th46gpahNojN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849708, "uuid": "7b7993d8-1729-439f-9ad0-ddd561c35666", "value": 108156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849708, "uuid": "b3efd76c-d90c-41db-8767-cdb7f8694dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849708, "uuid": "1c8f096b-60a6-4739-bc41-83c156e9afb0", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481c428e-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698854215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854215, "uuid": "9c7cca22-3db1-4794-8ea2-2594f49fd3a1", "comment": "Malware payload (GuLoader)", "value": "73d5f9855c4d47c3aa05bfb8ca56046d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854215, "uuid": "5edf77b5-0946-4a99-8705-0554bfc5e320", "comment": "Malware payload (GuLoader)", "value": "c8e57002690405c86819cc968d03545bce3def0f19dc9ed60614fef7e339fcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854215, "uuid": "25d0c48b-9627-42d0-a269-eb1ffcb8d9a5", "comment": "Malware payload (GuLoader)", "value": "d4ab79f679fcb5958ddd89ca12fc8683967450f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854215, "uuid": "63b5cc88-fb85-4bb2-8771-13fc0c6c47fd", "comment": "Malware payload (GuLoader)", "value": "2583125a4a4cdc8cc1675514ef1ca270e039c084eb0f6207cd6be2d2818bf624446daea841df505a9754a7e1cea1f0f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854215, "uuid": "5629540c-a815-431e-9541-1acd4496a9f0", "value": "T1C76523185998D213C39129BD0E76C2F566B1AD80F91146D3BB3CFFCDA87A2D06B09BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854215, "uuid": "10ca9596-1c46-4488-af83-9250d0c8ec23", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854215, "uuid": "c54b29de-c80e-49f4-9e61-bcc2faf24906", "value": "24576:4Kk6Z4rx4Gcs5PR8qdLwbpclU12Z1owyMsMtBH9I9QoP8YfyWhk2xRUASHJcPW8V:9k9HFP60wbylFZ1l7wQokD09OuPWHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854215, "uuid": "4c5f1fc5-fe73-4a8a-b231-5fa3c65e2394", "value": 1530598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854215, "uuid": "9902cc4f-a00f-4b15-8c94-bcab7402505f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854215, "uuid": "f9d3d6c3-d788-449c-97f1-708e47b6756e", "value": "B\u016aTIN\u0172 U\u017dSAKYM\u0172 S\u0104RA\u0160AS-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b443f3e-78c3-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698849013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849013, "uuid": "66d89ae9-2f45-49c7-a96e-d3f7b9ceecc0", "comment": "Malware payload (RemcosRAT)", "value": "61b0695383e7ff2c0788f734403b62f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849013, "uuid": "3d69341a-c3e1-4020-961b-8ffde41b1b16", "comment": "Malware payload (RemcosRAT)", "value": "ca49853927005b03dcbfc86f17f34e28120cb37f0a9cd9ead30b38f9c9a7b816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849013, "uuid": "bccccb38-9f6b-4286-8f5d-8a8c36bc7382", "comment": "Malware payload (RemcosRAT)", "value": "3e8e5f324e652b5e41dedc832539dc2d3d858f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849013, "uuid": "079162d8-ceb2-44c8-a518-8b7e7df7bc63", "comment": "Malware payload (RemcosRAT)", "value": "7c3c97cf55720be58fc58332f12b04b0a054ca87e8cc9fbe12b2ad0dee6dd57f7543e03e4e0118b3bfb6c5c73a86e170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849013, "uuid": "0072e29b-db16-463f-b3a8-f48800d8146e", "value": "T17F05AEF0317D83C3E1A19EB10F8A86B0B9F175AC98D0160DA1F5DB2E93D2395149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849013, "uuid": "e562c61f-cf8f-4c09-89a3-b507cec60483", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849013, "uuid": "cf6298db-8a1b-4547-8520-a1544bf7d000", "value": "24576:PoGHiOzzjIgkstEMIt6RWG+PB7LIHz//z+E3l:PV5PIg/tlJJGB7LIHz//T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849013, "uuid": "21bf892e-79be-4743-832a-3ab1d7973648", "value": 818256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849013, "uuid": "e2f26d74-a178-4512-88f0-6e0243cfabeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849013, "uuid": "9b0d500d-ac1d-46cd-88c9-086de4172225", "value": "FACTURA0009800P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4256abf-78f2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698869429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869429, "uuid": "20049d43-254a-4d2d-8834-7e6c84468542", "comment": "Malware payload", "value": "ff52534d17cce480431ebc18856a266e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869429, "uuid": "75d26d92-b4c4-4ba2-a299-f6d46e99d9a4", "comment": "Malware payload", "value": "ca4d6d6cb1565c60619174b2938402351cc88e7ede46f26d7a3873088db514b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869429, "uuid": "5e338ec3-a9f3-4094-abd7-e8f52de5e085", "comment": "Malware payload", "value": "92e44f9efdf1cbf597663db9b2ac7a596dfc60c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698869429, "uuid": "d30f2333-7be2-442f-b840-b743d0889e32", "comment": "Malware payload", "value": "f3c3e83bdba211a4f5fc496a7d412a337a88beb01ed96b9b053399cca457922ffb6b1fbdc4237cc740ff0382641d911d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869429, "uuid": "f597a799-423a-44d2-97c0-63dac104ab2e", "value": "T142246B1352E13DA1F6274B33AE2AC1B8769EB4608F55779B12599E2F0C716F2C272312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869429, "uuid": "2f0d09b5-7d66-4d84-8eb1-98da2457bcb9", "value": "c8a352bf73a61d8e36f530e1798f43a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869429, "uuid": "8cad0dbc-47c2-4221-a262-5d4c9e468819", "value": "3072:EffoO5zlz4qFhNAwcCD01ZebhE/hNW1IX3DMyXOLom71+JxC8tBgU4AzALjguk:8oMz4qACo3+o3IMxFJxvzzcLEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698869429, "uuid": "24315543-7d58-49a2-a97a-9a6ad4a8d8a1", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698869429, "uuid": "792607c4-a961-404f-a84d-52d5ad522e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698869429, "uuid": "3547205b-63e9-49da-8f50-115a6356ea28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b01a73-790d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880733, "uuid": "338eddf3-ccaf-464e-805a-fa4373389452", "comment": "Malware payload", "value": "0a372e49563cf3504a5b7ace0b9037b2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880733, "uuid": "2bd48013-cc24-4953-ad8d-90cb0c2c7a6e", "comment": "Malware payload", "value": "cad2889c295c04e5a388e2b26c4c2b109413bf8fdf9682c2e7bf8280efeeda2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880733, "uuid": "338e41a9-c895-457c-8e5f-33e462a121eb", "comment": "Malware payload", "value": "c18bc7dd558e250f70d0b06d3e6a2cc74cdda414", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880733, "uuid": "f4686c30-6150-4390-98da-d07aabaf29d8", "comment": "Malware payload", "value": "8fc434b8ac4609dea38feca810f39764f343e2348ecf99ba287ac3e8b98764bf793e44f0fc602fbff931832a219d82c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880733, "uuid": "a7863cae-69a8-454a-875a-c3c7e4cf264d", "value": "T164A418193C40A897F528CD31769F86714B727F26AF81484F77B8764D187211A6B32B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880733, "uuid": "94897d7a-ae9b-4536-bf62-61ea40f47a6a", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880733, "uuid": "0b25aae2-3988-44ad-bf92-645fd3b4606b", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjg+1N6DjqoWDR4VWnVgcm/s+RDI44meR:+RR5rhZFQGrsUwF7vlPoS3omYCX+Xom8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880733, "uuid": "1ef378ab-374c-49fe-914e-8c5af35d5967", "value": 455054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880733, "uuid": "15b3f7a8-b020-4b3c-bf68-7b442788e679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880733, "uuid": "ceb71bbf-4d7f-45cc-b551-e5b4d1ae2fd2", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.17831.26855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194154e7-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698833521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833521, "uuid": "b2cf71fb-314c-4dee-899c-31bd317fea72", "comment": "Malware payload (GuLoader)", "value": "cc177fa1dc7050154f29bf2d52f1f977", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833521, "uuid": "f8f8d433-dfcf-46cf-9ac4-9fdcfd2e450c", "comment": "Malware payload (GuLoader)", "value": "cb1401470236225bbf0792c896cd3d527022d9dcb104f664a7dfb2ba533391cf", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833521, "uuid": "1be580ce-8152-45a3-ab3a-f9b494a8edb9", "comment": "Malware payload (GuLoader)", "value": "40a4b692d6c3a2abfe35288351cec05178765b6a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833521, "uuid": "a22a2cf5-8eb3-4310-9bd4-ff018d6ae795", "comment": "Malware payload (GuLoader)", "value": "fc42f0b88fe58287c87e45cd17c89b8dbaa7e61145c8ef40a41704256252395a937d56112d33e451e695458e616216e1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833521, "uuid": "b01544e7-2111-440b-b713-17ce3fb79bbf", "value": "T111252367D6055DD0638A313833F45DF253AB8C23494A8696890FEA10FEA76027E5DFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833521, "uuid": "0a2e59ba-be93-4a83-84f6-c293f92eab61", "value": "24576:UTnFIlYVrojZTjW28VU1cjAWF0jnRPRuh+/QaRciQ5mjNc:eIaVo1W28zAY0jnRPRuh+/Nci5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833521, "uuid": "481a3fea-e8bb-4499-8629-3ba241b6af01", "value": 977618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833521, "uuid": "30f06725-95b0-4d9e-a9e5-116c8ff33712", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833521, "uuid": "66866155-8f02-456a-a3f8-436f06c3497b", "value": "ANNUAL APPROVAL LEAVE FORM pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a768cb8-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698833550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833550, "uuid": "835a17df-e871-41da-acdb-2e92ec2db5b3", "comment": "Malware payload (Formbook)", "value": "cf4b52b28fd1d8ddc9003303879838ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833550, "uuid": "6c9c575b-0cfc-4b8d-b0b8-09c57d701fad", "comment": "Malware payload (Formbook)", "value": "cfdf7f05784708c14f13c58f52537748546ebf7f98219a9e7099e2b2b48ac3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833550, "uuid": "1d5b5d43-ab07-436d-9af6-509f8787d82c", "comment": "Malware payload (Formbook)", "value": "0e79032a1969ecf1558f7f5ec8bffa76bb82dc08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833550, "uuid": "e0e4b355-e82f-4040-b372-e256e3181466", "comment": "Malware payload (Formbook)", "value": "ffc6eb8197b6d4788f0b7e9e256f256c4801b5c61cbef04fe3f1d41a689703fdae57b237cbf6ac4c0dd6a2320aa60252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833550, "uuid": "05efa355-4f45-4d6e-b78f-5fa5fdde97cc", "value": "T18615D0823149DC9AE15729F258AFD13061B8BD8F9124C60D3B87BA2B55F7303345BB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833550, "uuid": "daf2c3aa-7544-4310-aa15-20bd62735959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833550, "uuid": "9b9cc843-e582-431a-ad69-ece0495160fa", "value": "12288:jwmpHj5xyCq25VaiwVdTRZybhCyp5j+PMprgvvGtETJ6nxfgSiyyjK:jwCnf5gisRZypzjNrgXGSW6d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833550, "uuid": "a91a2e53-3e83-4b5c-92ab-93fdf52aa7b4", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833550, "uuid": "37158588-2206-40e4-a5cd-f5b43b753f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833550, "uuid": "90d0c49f-9f4a-414d-b1f3-358553a38206", "value": "Order requirement, specifications and company inof+project drawing.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c589aa30-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698821355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821355, "uuid": "92df5885-cd45-4ad1-8c05-a523a70c6a06", "comment": "Malware payload (SnakeKeylogger)", "value": "7704ab6ad00b8b76f7669f49cbb4c61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821355, "uuid": "9d79923c-39e3-4c2e-a2e6-2798508a28a5", "comment": "Malware payload (SnakeKeylogger)", "value": "d00df0899a734a3446d165fdf7f18e43e40b85b3296eb0b00e1d1fa2bd8f9bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821355, "uuid": "67e2f7b3-80d3-4daf-8a3a-1c563fbda011", "comment": "Malware payload (SnakeKeylogger)", "value": "68ddf50320e14400d15786db01c63e2d9f7c57fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821355, "uuid": "5ab9fafb-cdb1-4cf1-955b-98a720ab33a2", "comment": "Malware payload (SnakeKeylogger)", "value": "3dfb9662bc8cbf9e4e498e8738b603d8a6d113514696c69239bb0bd0a3007475ef69d0a5fc109576a7c9acdfad832009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821355, "uuid": "a72f2b6c-37db-4130-bd0a-f8656b14d74f", "value": "T14B83D6077209C1B2C6A84B3AC84741B00764EE92FB53D63B758A7F5E78B33F9981456B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821355, "uuid": "a7d472e7-d15b-4b68-99b9-4149d01afafa", "value": "1536:NTS1f1IEYJ3EoNQoB1qmy5eEw8IufaDRVOP/pa7zgr:NTGNIvJQoBueJuIR8PhaYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821355, "uuid": "fe1688ab-759f-4514-b979-5dfb738412dd", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821355, "uuid": "453746d3-ca02-4dae-af31-598d0e288465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821355, "uuid": "deee6edc-2932-444e-a73f-942f0592fce6", "value": "DEKONT S_659332597pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360287e3-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698833569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833569, "uuid": "d24be435-69fe-48a6-9912-5ad6083898fe", "comment": "Malware payload (Loki)", "value": "162489435d551557a720ef1946dd91da", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833569, "uuid": "71962fe4-9a4e-4f7e-990d-2fb97953e219", "comment": "Malware payload (Loki)", "value": "d0ef948d1aa15abd479538f870af332c07ff2cdd8c25f2a757d3af10e7a466ec", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833569, "uuid": "2538e5a0-1d4e-4a2f-b8bd-28baab440519", "comment": "Malware payload (Loki)", "value": "05904bffbfcf3190e2dd76ed6754c21b21e16415", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833569, "uuid": "9c298357-0a3a-4d82-8631-18bd6cdc8f99", "comment": "Malware payload (Loki)", "value": "e29a0616e8b408dd13d69871890a872176bc6ccc91bbaf654268e9d4c6de3bf64c7da3992a0082ca54b32b73c4b9ce40", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833569, "uuid": "2fa4bd71-8e0c-45ab-917d-79e398a02aae", "value": "T1229423ABABAD1417D1ED43B5C198B816BC5451763F2890FF2A85FB4AC076428F6CCF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833569, "uuid": "e5cea9df-4136-4729-b369-6dd8076add90", "value": "12288:sfOrJJre9grdyB6BGHmSACFXwzh+Q2U12Zls/8+E:sfOrJs9grgBKEgFDx2IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833569, "uuid": "971c2f4a-b005-40ec-8e9d-526791dda215", "value": 443621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833569, "uuid": "1b8b34bd-cd98-4d2b-b901-059df67ea688", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833569, "uuid": "4c9e397f-7c3b-409e-9973-4ad7ef90b4dd", "value": "PO-3785.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71e8f49-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698820069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820069, "uuid": "190596c6-9771-472e-8fce-2654119dfc33", "comment": "Malware payload (zgRAT)", "value": "9d5e58281eb0dbbac985d3318e86cbf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820069, "uuid": "a04b4721-14c8-4267-9eb7-1967b5ef0f3b", "comment": "Malware payload (zgRAT)", "value": "d175ac4ba4ea454d976bc537a22342a835237685b4c9200520f35f4196704713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820069, "uuid": "aa5c5d3e-41fb-4d60-821c-290d2063ec04", "comment": "Malware payload (zgRAT)", "value": "4f61df0eaa17384946372b02d98a341b9e5c8a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820069, "uuid": "ac206774-3cb4-42bf-82b6-39b37b6f3dd0", "comment": "Malware payload (zgRAT)", "value": "47bf65f3492882612729d330e4015e3186e82aea59bdff17512be5aa1c9827827555ceba6e2de4fbdc4902800ec923c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820069, "uuid": "225786ce-7a5d-4b25-9a19-a00c7e25d95a", "value": "T1A424F19677E38D51C54E7A3080C082153275D7CE70B3C71A328E52664A737C6EB9BAEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820069, "uuid": "f0d6d3a3-82c4-443d-8503-0bb5baba9de2", "value": "6144:/gbF94H2ldB5S3Nes/nu4qI7EdcDMb7vj5:obN7B5v0nxNIdc4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820069, "uuid": "da680900-147d-4e76-b7bf-62472f313ba7", "value": 223296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820069, "uuid": "ee05edc5-4f9f-40ea-9b2f-fb583b253746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820069, "uuid": "a44fdddf-c93f-48e7-b0aa-2536a399a315", "value": "INV30-01-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7106ee-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698842435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842435, "uuid": "6f8bdcdb-a212-46e5-8ec8-63dff1429a4b", "comment": "Malware payload (GuLoader)", "value": "a6c7ee6b5fc6b2643cefbacb5ada3ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842435, "uuid": "c1a45fb0-31c9-41f8-9b95-12c809998ab3", "comment": "Malware payload (GuLoader)", "value": "d1fa40e8894c6980970d2f5d0817f6f3c011c5565e6a7ab47ce06d52cf729097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842435, "uuid": "d851c793-1916-46a6-99e8-4088c9652a6a", "comment": "Malware payload (GuLoader)", "value": "4cfaec968f02503e395ee3e644cefcab38950db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842435, "uuid": "a710c64e-249f-4ff6-b2de-6aced7d4e916", "comment": "Malware payload (GuLoader)", "value": "9074b650ba552b45751baacad6c02a56df41ffdecc8d2763a393f072e8a6bc5c6ebbcc7b9bcb2086d458414a877e42dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842435, "uuid": "f709e247-c57c-406f-805b-ee5947c24681", "value": "T103E4F04436A18916DBD467364F6BC6325721ADAC79208A4F37F8BF1B3FFD28309056A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842435, "uuid": "ad367466-8aa9-4f76-bfb0-b968dab9c7fa", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842435, "uuid": "c421047e-23b2-4d85-ae77-2f3566457474", "value": "12288:zRyaQ2nE0tLWC3qAETghY5hrLhUf9QDlPCOqgBrh+ftddOYLQnJf2:7EA93q6seeugBrhorOYqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842435, "uuid": "2212b8e8-2b41-4a5c-bc29-970451ae5e09", "value": 680208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842435, "uuid": "2dd997e9-2239-42e2-9c83-4cf12b99ecdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842435, "uuid": "15b33dda-0bc1-4e7f-8459-79e5d43bbc20", "value": "d1fa40e8894c6980970d2f5d0817f6f3c011c5565e6a7ab47ce06d52cf729097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24da7161-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833540, "uuid": "b261c917-fe74-4532-bca7-802512e24398", "comment": "Malware payload", "value": "359f0a444fd7f3988e50c2e5c4c3a033", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833540, "uuid": "f3c26e95-875c-41db-9dc2-bcf0671ebc39", "comment": "Malware payload", "value": "d20272c3645ef4c5a0f3d65a219f543edc63421ece3dba8ed291f3ac2436bf5a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833540, "uuid": "dac0edc4-eff3-461f-836f-a1152bfb0599", "comment": "Malware payload", "value": "62ca7f5db4586ffb79fbd6917eda97e56465daf8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833540, "uuid": "2db39677-7b31-4d42-bd73-8fe6969fd83f", "comment": "Malware payload", "value": "36925955bebce826cb0cb0787b72e94bb87d11c2ba1cb805e047271f93cccc3c266472f4c69ac4588eaa44bf98d330a9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833540, "uuid": "950736ed-164a-4af3-a0c0-931463c69df4", "value": "T118E433BF7C708ED5A9F1113FEEE066DB6409488FA9181CB1FB364425360DC8D267A9C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833540, "uuid": "2a0bccb1-9509-40a0-8ee5-23eeea7c2e3d", "value": "12288:q8uOnfo/Btti5h6hOLtP/8FqC+PBXqyNNPtgRLlKj7Egk55lL7iQb4:q8u8fL76K/GqC+PBX1zlgRBKnEgk559Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833540, "uuid": "f10f6297-511c-4613-adba-e235f6973ea7", "value": 710493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833540, "uuid": "7c7854cb-3d2e-4ae6-925d-d8ab1b2b0598", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833540, "uuid": "ec5d7e7c-1533-4e86-97d8-d276ac1be383", "value": "Invoice_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea0aa36-78d4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698856266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856266, "uuid": "d5928c8a-9561-4720-b3bd-462816784fb8", "comment": "Malware payload (AgentTesla)", "value": "b88212aa343596ae71744b662e0895c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856266, "uuid": "c65afc49-5069-4392-b4b7-a560f632c5eb", "comment": "Malware payload (AgentTesla)", "value": "d2d1c043548b77e3e0ab6d5f4ac09e7809e11005a73032ad23dbcfa561123dab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856266, "uuid": "3b64768c-23c6-4a3d-bbae-dc8c8c6a5923", "comment": "Malware payload (AgentTesla)", "value": "22d84653ff8ac51cd462c1ecef68d973b38fbc0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856266, "uuid": "a286cf31-b1b5-424e-9325-5e893f6db564", "comment": "Malware payload (AgentTesla)", "value": "56b428ade09abf2a9cb265d3abb9dc767a444238b05f93599feac5cffad7da71b2fa57231cefe8b2016aac8e14eaccae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856266, "uuid": "dddee62b-3332-4b94-9e92-bcbf878ea2f4", "value": "T12834FF03BE48EB15E5A83E3792EF6C2813B2B0C71673C60B6F49AE5524517426C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856266, "uuid": "42c36326-2cdb-47b7-bf03-0f080a7ecd90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856266, "uuid": "2832a317-60a5-48fa-83dc-d3cb17ea88c2", "value": "3072:0rT1cv3nffK+cp1ICXeMh1Muwvyvx5sB2BUdVT8:4T1cv3nff9cp1ICDTxO4wcBUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698856266, "uuid": "e6b9d561-3df8-4fde-aa9a-f06b88dcfb62", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698856266, "uuid": "bf6f4efe-8ffa-4399-8e29-fb9d4f06d01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856266, "uuid": "35a0955d-daf6-49d6-af3c-2d1478234cf4", "value": "1698856265d54efbad1419c6266a9fbc3369c3cc2928bf959ad3a4e2c54278e57ec09d180f680.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4724dca9-78db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859368, "uuid": "d4cb2693-d24f-4e75-ad76-a5a3cc30464a", "comment": "Malware payload", "value": "6cc80f9a88268df3a994cd3387fd6d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859368, "uuid": "282d2cac-31cc-4550-bb4d-bce9fc55689c", "comment": "Malware payload", "value": "d4755173ff4ecb83e6e59ec4bd7822246740a276c67cdc7a611507e5fb7f7609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859368, "uuid": "55181514-7185-4083-a17f-58bd83c954cf", "comment": "Malware payload", "value": "d2868a4ffbf6f9f449e06fb88a2b527a254a0c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859368, "uuid": "ae0d0e26-0dc1-48d0-94e7-ebe810c6c265", "comment": "Malware payload", "value": "0bed8d83d56a08b3d5b0fbf0a65cd592774749e13f14db10494687344a99e9df78aa30e6b7155b14ed1cb722c7935c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859368, "uuid": "5add81bb-da07-4f26-aa8b-a19ee4629b5f", "value": "T159F48E02F7C784C6DED278B1197FE7126F3AE518532A44FBA3B45C334A51481AA2D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859368, "uuid": "76d23ddb-6b86-4c36-835a-46a3274bb310", "value": "12288:GPYU1gi0BQVKBOkTix6Bg4Y3GgZfLtFBV:k3iQMUd6e4YDTBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859368, "uuid": "b2d0cb9f-e6f2-4d51-ad63-4f5abfe0c31c", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859368, "uuid": "b09ad6fc-a181-49c9-ba21-a124256dd606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859368, "uuid": "ec58f526-632c-4229-b776-6badfee47465", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.1884.11011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12b23b7-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698820059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820059, "uuid": "3b579a2d-833e-4110-b6c0-33e424d2b076", "comment": "Malware payload (Formbook)", "value": "cdc21f4854b0ace2a1bbba899caa47cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820059, "uuid": "7cde3357-54e3-47c5-ab18-e4027d1e9556", "comment": "Malware payload (Formbook)", "value": "d4f6a19413c92890f2256ed9ebabdc1cd237d071e6b763b2e12b26ba04db95a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820059, "uuid": "d2a9f35a-f0e2-41b8-b749-39e71bbecedc", "comment": "Malware payload (Formbook)", "value": "15faa55b0d7103869e3843e690bbfa0676bfcebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820059, "uuid": "9da9bd14-df0e-4685-9f56-0c8031816757", "comment": "Malware payload (Formbook)", "value": "e9458470dae9655e382d292ec2fa8985db80e2bc7fe012e3efb3942092d334ac0a99d54a184c14a4eeab06987cb0db38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820059, "uuid": "4a9db4a9-2024-4e1b-8b9f-07bdec8b7806", "value": "T10F64F152B76C6B12C87955B1C2EF093003F26AD37A72E58D3E8C53C95E823E28D4979D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820059, "uuid": "88d40c1a-e3ab-4c20-baf7-8c3eb74964ea", "value": "6144:NkHuKJFPNrp6km8lWM/DFNSais8Gk4hk5wyNnq6dNgCFHHdrn4:nKJFPNENeWsWaisbki4ZdN3Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820059, "uuid": "a3285188-8542-4d4a-9704-f2907f4d6ee2", "value": 335432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820059, "uuid": "f873cad7-556b-403f-a95d-c4dc535a9bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820059, "uuid": "4df132bd-b0c2-4ac4-85c1-20f738704938", "value": "HST21092BY20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89970774-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819965, "uuid": "c30f8b71-5542-4b43-8623-672ce8046859", "comment": "Malware payload (Formbook)", "value": "c78e66324c1dcfd798348acea2dfbc04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819965, "uuid": "903fc448-ef5e-4b8b-be44-b00a5600d760", "comment": "Malware payload (Formbook)", "value": "d509087303bb0f0d4710410f437844928d43b21bf0d868198a7a8e7559018ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819965, "uuid": "d21b997d-c025-422d-ae3d-866aaeb84d44", "comment": "Malware payload (Formbook)", "value": "b666e18f7945a8b13b724dfa93887912ccc6571b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819965, "uuid": "484a3b9d-f047-4a7c-8fdd-65902ded4fca", "comment": "Malware payload (Formbook)", "value": "1656e8d94835d302d0159fa4fec67ba196ab7b74ccb85d9f33f3943e1d18bff49ae87d5e5bbd924940419ca699225293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819965, "uuid": "f618e80d-37db-4727-bb37-b05c577afa27", "value": "T16EC412056A74914BC4D63BF009B41AA7BB696D7A0268C24FBBF9BE057C32117CD8721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819965, "uuid": "218a1b8e-e205-4fd5-89d3-ebe05893fb47", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819965, "uuid": "df568771-6909-4423-8dd4-aa5cb404e0c9", "value": "12288:UnPdLbQL8FB4nObgQokxWzu4y9B0dIwx8x/pMldZppBKGCr7MrZlpNXHY:EPdLb6kEsP0Kw6pOBFCYX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819965, "uuid": "1ad54986-a868-4c67-8932-d5c8fac7c723", "value": 569476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819965, "uuid": "1d5e7862-3e57-451c-bcd2-a0b60816eeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819965, "uuid": "ac19466a-58cb-4212-bc96-da231c4ad508", "value": "DG087678000800W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a30c684-78d3-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698856071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856071, "uuid": "dde0470e-d82e-442e-8a1c-a8c038718add", "comment": "Malware payload (Amadey)", "value": "8da053f9830880089891b615436ae761", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856071, "uuid": "160d9133-81b8-4de3-9d41-3dd4af6b33f8", "comment": "Malware payload (Amadey)", "value": "d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856071, "uuid": "f6492ae4-5a5f-4dcf-a6c9-edeca881c389", "comment": "Malware payload (Amadey)", "value": "47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698856071, "uuid": "c17c8544-fd7a-4838-8398-5882459bf6a6", "comment": "Malware payload (Amadey)", "value": "89082fbdc9725526700b01e30017c2ea146e0c2d952afecfb23992c4966fc46ce5337931f2102239c03ba6ea2091a195", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856071, "uuid": "68bed653-f75e-4b00-9a30-79870041530a", "value": "T1FEA35C057295C071E56E1A3A1874ABB5877EAC14DFB04DEB27400E7AAE343D1BD35C3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856071, "uuid": "77652e69-8edb-4a58-a8ec-1b91ca80bc86", "value": "91452bf3259a3ff5928a3bb7f6be301a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856071, "uuid": "cda7ca9f-7bca-4099-bc9d-503a10344415", "value": "3072:/HEjxEfCk+EeY22JosmvWuQRRIQrT7xUcdYNS60Z:PsqqdLsOWuQRbZeNS60Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698856071, "uuid": "d47253e3-4324-48a5-87f1-132691b64d90", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698856071, "uuid": "d71c3f57-b72e-4edc-a9d2-2f2a2ff67b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698856071, "uuid": "632b112d-339a-4fb8-8569-4c56f8325241", "value": "8da053f9830880089891b615436ae761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228a8464-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698819363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819363, "uuid": "fa5d4c83-02f6-4014-a051-a9cedb652110", "comment": "Malware payload (SnakeKeylogger)", "value": "227bdbb8c34884f8dbff3a7b02a16d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819363, "uuid": "4f9ff9c5-d9a8-40d2-a9e6-8b9aadde15cd", "comment": "Malware payload (SnakeKeylogger)", "value": "d6a06ea85b9e39e2f7ac8dacb3a3d2a410ff82a0bbd0d1d277156834e98a529a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819363, "uuid": "2e67bb5a-9cc8-458c-8309-0d04c562e3ff", "comment": "Malware payload (SnakeKeylogger)", "value": "63b5aa25d682d370061df48c188083fe5de0834d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819363, "uuid": "ec4e03e5-67b6-4313-bfc5-4600b459a801", "comment": "Malware payload (SnakeKeylogger)", "value": "8144fc972e1ec197b5582204a1e10c581b6d4b2a3a3ce782c652fc099ef645427c78aa54de3f4616a0fc5b1703912911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819363, "uuid": "28e2b2b5-362b-49b5-88b9-4928deeded77", "value": "T1A553D607B63A85B1C3884B7AC5A746044361DB82B2F3D63A758F33B519273FB8C8559B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819363, "uuid": "2c84bad4-7868-4ea8-bf01-a3972164b1bd", "value": "1536:hgruVyPHmDMLKTZgVYVjvoHZ+lDpFCB0:huGMjaVToHZ+lDpFa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819363, "uuid": "b9595c13-5ebe-4800-a081-5fd6770cddfb", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819363, "uuid": "6d1ada81-8f6a-4d31-93b2-6af1c2868246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819363, "uuid": "fe43be42-a380-418a-a54e-95603fa4ee9f", "value": "hareketleriniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1a9672-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698819894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819894, "uuid": "617cd04d-dd1f-4a74-aa96-80bd9807af3e", "comment": "Malware payload (Formbook)", "value": "7ddd1c1fd434006b33521e63c5d92cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819894, "uuid": "619350ed-400a-421d-bd3a-625cf920c0f6", "comment": "Malware payload (Formbook)", "value": "d74ba85c5f7fb3f29b078d50a1d03ae822d0fcdfb3f1d6cb0b32dc3aaad1f559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819894, "uuid": "f2d9db69-5e51-4195-8177-e446d4c3a831", "comment": "Malware payload (Formbook)", "value": "9060839ed6134c3fc42d4cf57798855a6b11870e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819894, "uuid": "9e785021-5e8e-46e0-9f23-9f1fdff27268", "comment": "Malware payload (Formbook)", "value": "a4a95ea2da6bd0afd0148edf4d2d63b34419ea26c0bfd85b5b98e1e1cec101164dbfcf149ef03b9a8c8854a9954e9f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819894, "uuid": "65b51971-a3c9-4cc6-8f7a-b1cf8cf989ac", "value": "T15ED41219BCE1A55BCAF57BF41EB0E4877A71AC914024C10B4AB43E0AF871653ECCD5AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819894, "uuid": "3f208f16-7aa7-4fbe-b199-0ada82042a5e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819894, "uuid": "6363fbc5-2ee4-48c2-9d63-1514a6bef23f", "value": "12288:KYrYEfeLUr9yT+1NmJegO/7zxBe5IqxMDwKpsCBSda763UymP:KYrYNj+Hr7F4/xpKps8SdMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819894, "uuid": "22d58120-b885-4344-9247-c31233a0cf14", "value": 632739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819894, "uuid": "51b424a5-cc39-473e-b73b-f9a2247cb6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819894, "uuid": "e33abada-0d81-49d3-9f60-8355610c1105", "value": "Enquires.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7de7e82-78a5-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698836418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698836418, "uuid": "72ad5064-1a19-4a06-b12b-12d58537cf4b", "comment": "Malware payload (Stealc)", "value": "b1b88446a0012c5e91ac0b10fa18bff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698836418, "uuid": "f07f3061-3556-4b68-868e-1daef705d34a", "comment": "Malware payload (Stealc)", "value": "d813aa5ce5f9987eb3599e48932dada6ee9c1e19211c6670105abcdf8863806d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698836418, "uuid": "276b4162-d2bf-47bc-9541-ee6cf2e46c96", "comment": "Malware payload (Stealc)", "value": "78782be6e360f2419fc7c16e0ea54ecdafcf4410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698836418, "uuid": "e05381c6-5b3f-48fb-a87a-6272e6bb45dd", "comment": "Malware payload (Stealc)", "value": "eb038b4cbef19d0f3681e1e83c4464103c6e655748421456cb15e3c2cf16245e00a3bf3044707b8b9fff8b56f5d2d482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698836418, "uuid": "dcab9b0b-18f4-403f-bcae-26b3f62ecfe0", "value": "T1F404DF2133E2C0B5E0B7813055B1CAA16ABBBC3253B285DF3764273E1D707D1AA79796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698836418, "uuid": "0c916cdb-ad14-4c99-bdd1-4e7935b57398", "value": "1a18a9d4050d7d94c088092fc252cc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698836418, "uuid": "4b640f46-20f6-4ab6-b1b5-7f3670be6c24", "value": "3072:ppXPdKOBiR0lP20TX1BgPcnwIpMUU45jj/4w0vajPXH6BIvw:/1KwiRmP20rLPUYj/4w0vajS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698836418, "uuid": "898cafe6-ea7f-4d99-9c34-3298c67a7aad", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698836418, "uuid": "c3ec3d1d-4244-4b6d-a027-5f99f1c9663c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698836418, "uuid": "e24a7879-5e3c-45d9-aef0-72e54db24249", "value": "b1b88446a0012c5e91ac0b10fa18bff8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe54fd2-7894-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698828861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828861, "uuid": "e3f7398e-45c6-4444-b549-c0674217a78c", "comment": "Malware payload", "value": "f0dfb7bf01c0412891da8fa2702f4c7b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828861, "uuid": "daa16b00-2769-42a5-b7d1-baab0cf4fa71", "comment": "Malware payload", "value": "da450c639c9a50377233c0f195c3f6162beb253f320ed57d5c9bb9c7f0e83999", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828861, "uuid": "a2147a1e-7076-47a9-8711-bf4fe78a3121", "comment": "Malware payload", "value": "ec238353f020243758eb7511dddf8ab6ba01b35d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828861, "uuid": "1c6befa1-a472-4e8b-b035-19fffe6481f0", "comment": "Malware payload", "value": "c27c92683873b576fa47281ec446e7fdfd4509817892a5a86b826d24028c622492f8c06a62c2beaa876502736e333501", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828861, "uuid": "e3f16f45-3b0a-4d67-b246-50daf3f432a4", "value": "T13462186236F006B6F7FE5A798E660406D7773D450962CBDE09B0558E092BBB2C83D327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828861, "uuid": "a3602b5d-2ee0-4ab6-9c72-1bdbeca9590e", "value": "384:xfO+ryc1Zi+NJX76Tewr78J0wO346WUjW:5OuycxNJX76TPrwJpS4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828861, "uuid": "f689ad31-e3c5-4422-816d-54029f5698fa", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828861, "uuid": "00274599-ebd6-4429-b27a-ad342666cfc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828861, "uuid": "627863bf-8f10-4cb0-83e6-80370524266e", "value": "wlbsctrl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d32750-78c6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698850396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850396, "uuid": "eb53ea6a-f930-440e-8d54-826254abdb18", "comment": "Malware payload", "value": "3f224adb6164f9a9c9e39e437fd0874c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKeygroup", "colour": "#721C65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850396, "uuid": "e7234909-0b0e-4ce6-bd91-78084310fb82", "comment": "Malware payload", "value": "da5e78ad0e38c951bb4b53adcc5afe693c2e33533a45a9c666a8dc9852766ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKeygroup", "colour": "#721C65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850396, "uuid": "abfb1aa0-5935-45be-803a-4da60414fb4b", "comment": "Malware payload", "value": "e74b5df0d4d93ee9ddf6881f4f1d29fa56971623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKeygroup", "colour": "#721C65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698850396, "uuid": "5f8f4f3f-1fb2-4c36-9853-c82e40cd2164", "comment": "Malware payload", "value": "cea6457f6c51f24db4e299445f087c57222431813d93011006997504cc7c4eaa2b485e9e943d9f6b5d7f5311d49b9724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NotKeygroup", "colour": "#721C65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850396, "uuid": "fdaa3e0e-7613-4427-b240-67ce6156b521", "value": "T13044BF299FCCD413CBB913B6E4A684A0A7F1C6517983E7A6359C7BB12B533D00D2624F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850396, "uuid": "99901f45-c8f3-4c7c-9e99-2547ed9ce7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850396, "uuid": "ac9c8a97-d5fa-49b4-b355-c191d00ba517", "value": "6144:6ri5Ce/ZImRxUpJ0En50VuAjpCWP+12iexdcHm/XPAHq:siEWRxkvkCa+1AdcHKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698850396, "uuid": "e42c11ad-bf80-4491-9878-ecda0a209763", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698850396, "uuid": "6998a75d-a641-4d7a-8a1a-3777cdb93e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698850396, "uuid": "4d503359-54c4-4a8b-ad58-6b1c078cbaf3", "value": "keygroup777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbfc74e-7890-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827408, "uuid": "213fe5b0-ff08-4fb1-b3a7-58e15b3d2e38", "comment": "Malware payload", "value": "c21eefc65cda49f17ddd1d243a7bffb5", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827408, "uuid": "317478bf-3c7b-4aec-9597-d2042f2ec635", "comment": "Malware payload", "value": "daa362f070ba121b9a2fa3567abc345edcde33c54cabefa71dd2faad78c10c33", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827408, "uuid": "7250bb6d-fbf6-44dd-90bb-9a12988c7616", "comment": "Malware payload", "value": "15db197d98b02d715c15955b0d58d8785ebc750f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827408, "uuid": "9e2cbfc7-003e-4789-997f-aff77728e1ed", "comment": "Malware payload", "value": "c9d77215874e1e846d8ac8ac18a17de1d3f16a35f4ac4402b0ae9c01c65eb1ef20693e0384f61478a354e54a493307b6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827408, "uuid": "5e57c71d-f88f-4136-8d52-f2ed1344cdbb", "value": "T1256251969E124557A3B36277DB73D008FB7302A763E4827BF98D42021FB085492B5FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827408, "uuid": "6532f7fd-3927-4151-87bf-f4cdbb778882", "value": "96:x1a8vBHikPZvKF0aTIR+8aNFKtIWKfIJ4tH/Xe6s38bFDbd5bPoWcfG8K+NqEN2W:x1a8TvK10faTiIWKc4M6MTm8w619", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827408, "uuid": "6dcfad21-3b61-4ecb-bb1e-89542acc2257", "value": 15380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827408, "uuid": "b4755704-f12d-4048-8c49-53a06beb9e37", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827408, "uuid": "0ece720e-13bc-42d1-abf7-0cf7d4183a18", "value": "copyrules.aspx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6354ead-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880707, "uuid": "bedfb77b-158d-4c11-b10a-db5bea60037b", "comment": "Malware payload", "value": "a4f3949c7875afb85ddb613b9a17bdaa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880707, "uuid": "e8eb485d-29ac-4a99-8df2-1298a56f0306", "comment": "Malware payload", "value": "daf6a5c007923ac7268912709516fdba81fd04838247d3efc3edb6327a5c5ef0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880707, "uuid": "2ccf4778-332f-47b0-8802-e98c1a50532f", "comment": "Malware payload", "value": "53761cdb97515906b3390bfed222ee6b6bb7a3df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880707, "uuid": "8f3e149f-9188-4cb2-a73b-afd23782eb0e", "comment": "Malware payload", "value": "165e4901da76fba390c7536ea827b0f11b9babb69337eb6b0a84b899e433495fe1857bf1fca38c1a06b1e4e97094b8d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880707, "uuid": "7bfd624f-60b3-4ec0-b3c8-92afd8929397", "value": "T1BFD5D003F7C2C072E03E163014776B7AAA75DE664F16CB47B7E4FEAD2D321A0995211A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880707, "uuid": "5e43712f-c7bf-405c-b4b6-526cb3d36f54", "value": "d53317c7ba5c0f3409468b9eeacccc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880707, "uuid": "fef0e81e-a1a7-4d1d-9ac6-00df0d72ef13", "value": "49152:3hHzLkEGDn00UUg7UzkdoyY01ey5e2NAe/RI/zeGVLcudXojprC2lgM4gOryqTbP:RHzLkEGDn00UUg7UzkdoyY01ey5e2NAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880707, "uuid": "8187aa1b-d725-4d8e-babb-71af66806ec1", "value": 2871244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880707, "uuid": "0ccea96a-41e7-48ec-bedb-2219bae00a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880707, "uuid": "2f208266-7f29-466f-92c1-df6067e3886b", "value": "SecuriteInfo.com.Win32.Trojan.FlyStudio.S.18400.13226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571626f9-789e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833195, "uuid": "86b96fe2-7ad2-4c28-b250-e30f8caeb4f7", "comment": "Malware payload", "value": "6eccf36aa1d848e46b2bd18890f57bbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833195, "uuid": "351b3742-37d4-499f-96a1-c1575633a6be", "comment": "Malware payload", "value": "db0ace1d6c3d9eee1ce3b04f4bf97ad748185a0b4e165166941edc0c8128ebbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833195, "uuid": "056127f7-5db2-4919-a21a-3146e689de18", "comment": "Malware payload", "value": "1292d7e06716cd875714f6afccdf92c793bc4e13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833195, "uuid": "75ffc142-8275-4657-aef9-e91f40ace4fe", "comment": "Malware payload", "value": "f4a35c7f8471fb3ad1b565ae6a07d392999ea2a6490cffb0fc768ea90f19f981e46414f6febc6224f9a35f450baf8bb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833195, "uuid": "172ce8c2-4702-4951-943b-766408a562df", "value": "T141434BC0E583C4F5FD222174447BEB369A77A826907ED987C3AAE237EC03751A64720D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833195, "uuid": "e55c21ec-13ce-4a41-8385-adfc14898e55", "value": "768:W7Wn6LP02wudiIxNOY3EXt/rjzs+M0LCf0wPTIYGvqeb0ln+iJuODLh8+Cs1oM:WnwGiwge+rVMCCHP0Ymhb0ln+ivDum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833195, "uuid": "2ba50c08-fcb2-4dac-9fa4-4643ea20030c", "value": 55368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833195, "uuid": "81d308e7-74bf-445d-b324-0c782b30453f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833195, "uuid": "4fdba279-d98e-4b69-92cc-2cad52c821f1", "value": "6eccf36aa1d848e46b2bd18890f57bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4f59c3-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698821394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821394, "uuid": "e982f3ea-dd62-43a1-916d-71addc2663c9", "comment": "Malware payload (AsyncRAT)", "value": "12d623d0e90a1e0b6afd42d7cdebfb6c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821394, "uuid": "53239706-da1e-4a30-b4e9-2ab50fed3ece", "comment": "Malware payload (AsyncRAT)", "value": "db64aa5128b6af1dbe87f74af54577356285193474d808478d2a6f0343cf2459", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821394, "uuid": "593f7446-681c-4636-b4e2-237e5546cc66", "comment": "Malware payload (AsyncRAT)", "value": "592a152fd64d054c764335fc20b74218e2be74bd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821394, "uuid": "b1396c20-41ad-4722-a917-a508b60173fd", "comment": "Malware payload (AsyncRAT)", "value": "d2fff2568c20932b3368f138e9f25d7fe74369a7df7cb2e567682c4a4984b3b1246bd14c4a78d425cafc91d837206cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821394, "uuid": "813e825a-1bfa-4e7d-9f8f-1cd4bac3fe33", "value": "T1E4C4F102B6D688B2E6321E364936B721A57C7D201F38DF5FB3D44D6DCE35181A225BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821394, "uuid": "c0a49a4b-94b1-468d-8feb-60dedf06cf41", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821394, "uuid": "1629c85d-fb7e-4efe-b14b-f5c67d574b41", "value": "12288:AcrNS33L10QdrX6r1nkacOhpWih0T07965azCmK8gkdeRnW7q:jNA3R5drXq1kehiT0796azG2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821394, "uuid": "04fe3b98-da81-45e1-b298-8882154f3e24", "value": 550109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821394, "uuid": "7b0b1c67-9119-4de6-bb4d-c4f974eee4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821394, "uuid": "c58275c2-0c5e-4856-b242-479255e54464", "value": "Odeme_Belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3446f4-7891-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698827699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827699, "uuid": "b12af5d9-abd9-4c38-adac-fe894449322c", "comment": "Malware payload", "value": "8028d528552d483d474c132250b76dd9", "object_relation": "md5", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827699, "uuid": "bbf3d3fd-5d37-40bc-a876-b00abc96d4f7", "comment": "Malware payload", "value": "dc3fb6dcd87a98da7a664e8b4a5272ae8ec8b0ca125c23f17202fd65135b3649", "object_relation": "sha256", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827699, "uuid": "3c1f7c0a-faae-4d86-82af-12d5dd79d1fe", "comment": "Malware payload", "value": "6aab050739ba2ca4500cd8260971a1bdf26e7e3c", "object_relation": "sha1", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827699, "uuid": "e841aa9c-686b-4670-9ba2-163f20db1f7a", "comment": "Malware payload", "value": "853b644bdfa578945dee97c14b6b5d651fc8cad289f5d23ea2afddba32e0d08d6954a1230bcef46bbdb64564f4cf57b4", "object_relation": "sha3-384", "Tag": [ { "name": "144-172-122-128", "colour": "#AF205D", "exportable": true, "hide_tag": false }, { "name": "BlackRock_Banker", "colour": "#5E383A", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827699, "uuid": "c61c52c0-52a1-4b1a-8c79-ec019e04978f", "value": "T1EC421B103F2EE6F58933BAA2D567D42AA4F9837730AE91583D1DD38C4F70191A2D059F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827699, "uuid": "732a1ceb-4732-49bd-8662-5cf4fd014790", "value": "192:2+CaQPHPYajPTPC+WPetJIJrCf2YQdkG+dZAXpx0OBSzbSoGb2lObUgOl+9ffT:2hfvYUTCV7JmfpQdkG2ioSoPMbUgOlcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827699, "uuid": "e654740b-0b4f-4763-8d87-9162500f6b1f", "value": 12273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827699, "uuid": "87730952-5a79-4d80-ac5e-b1648bc468dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827699, "uuid": "4f663db1-8db5-4c6d-a439-1f42c8a1eb6d", "value": "PDFact086846.6540d4c4ad83c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89736bc-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698820017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820017, "uuid": "eb45829e-71c0-42f8-9c62-0efb8ebd4dcd", "comment": "Malware payload (Formbook)", "value": "68df7db70bbdc9eedc119db2b60b8479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820017, "uuid": "95f6d094-203c-491f-a787-a9de49797d37", "comment": "Malware payload (Formbook)", "value": "dd9d633ad81e1f36b9cdda3118621059f555f80f5a016a8d254ae9c4e8e159c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820017, "uuid": "1979870d-74fe-4230-8f8b-898afda19ce7", "comment": "Malware payload (Formbook)", "value": "dbaa346987ed38f0926f893e087e99a56b497bf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820017, "uuid": "8875ad55-b98d-4224-9167-b478780c6776", "comment": "Malware payload (Formbook)", "value": "2b40089b884d0a701d024a97837c9369f330b223fdbc02b5b3c6e3cdaf0057122b033530454f67866770aa2b33378be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820017, "uuid": "3916979e-ba17-4413-b26b-cbf35680b990", "value": "T15A84225577E4C8A7ECA602701C2ECFAB89F2B51D00E5534E97607F4CBB67950AD2E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820017, "uuid": "0c51631f-d000-4134-a2a4-7215c93c251d", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820017, "uuid": "64f2d231-3161-4b0d-9023-e3c899425754", "value": "12288:LnPdvWwuEH9g45TOzPdTnBG4a/QcUfgqX11:TPdvWdl41OZTnBblpoqX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820017, "uuid": "62fcb7d0-5a6d-4799-99d7-d39f6363138b", "value": 393802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820017, "uuid": "106dd3b2-3668-487a-8c39-e419c4498b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820017, "uuid": "38a4fd7c-42c9-4713-95a4-9eb9774c5bf9", "value": "F09654567890000800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33f0dea-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880702, "uuid": "559c1d1a-5429-46a9-8722-dcd6a87ac6db", "comment": "Malware payload", "value": "0dec9ebb664a686753d3bc61cd6a3922", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880702, "uuid": "322933f3-1eaf-40d4-9402-719abb51a8c6", "comment": "Malware payload", "value": "de8356691146e563365871bfae0d9fbe85f30a0843ff74206996f5c797af2f41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880702, "uuid": "65759ba2-d480-4319-b6ef-b40e54b4c40c", "comment": "Malware payload", "value": "0c86cf20b8b39c6d6ee7bb19fc3dd2aa2d9da178", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880702, "uuid": "b7f73ee6-8ab6-474b-8ca7-19d86f6bcaad", "comment": "Malware payload", "value": "e44a7f53f2695fa0fd4fb2c05458499b4f3eb7be35bd7eeca7b95af5318122c48aa1ab16f42642bf13bea5ff612b7578", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880702, "uuid": "ad51fcbf-b316-43e1-8887-496f65b22730", "value": "T1DED43A1575C3C93BC0389B706B96CAD49561BDDD0CBA825F3EE8778E7D3B2C09A22461", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880702, "uuid": "4b2c1e9f-2485-45c3-bcdc-6f468686ca0a", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880702, "uuid": "a6e07e2f-a4e8-4d91-99f6-fb34fe00c698", "value": "6144:+RR5rhZFQGrsUwF7vlPoSCnaYRDEJfHg:+R5nWFpPoSsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880702, "uuid": "ca1344f5-95ec-420f-a599-4def23f2b56c", "value": 639659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880702, "uuid": "2b65a6d9-4670-41b1-a2e3-260a9042c62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880702, "uuid": "17996a5a-cae8-449b-b086-dece9a3aad06", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.20196.26679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2830b942-7909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698879073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879073, "uuid": "5b77d99e-c2ce-4db8-8b43-36e1c2a61e76", "comment": "Malware payload (Mirai)", "value": "50c6f608275a5e97a8010a8f8e0538f9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879073, "uuid": "6b5cf670-b3e0-4231-afc5-9910206c6b79", "comment": "Malware payload (Mirai)", "value": "ded860b8f44eeeaec17061ceb89bac505706f835fc71a31285e1b617311ca150", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879073, "uuid": "3ffd5b81-aa17-45d0-a0de-6fc3285c2697", "comment": "Malware payload (Mirai)", "value": "1b01d8dcacdf5f772f7661b982519210645a7f75", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879073, "uuid": "6ad1a7a1-d4e9-4686-bdd4-257d02a06ff0", "comment": "Malware payload (Mirai)", "value": "fb2303c86e6c9bdba699070cec532469eb62c8ae4c241697d3d8f56a95d73febe4cdfa669633f92df121adf5718f980e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879073, "uuid": "d21ce824-c857-46c4-b203-8dd3469e0dc1", "value": "T16C332A03B942C0FDC55CC274566FBE36C872787E033AB9AA37D4FA266D46D611E2E904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879073, "uuid": "b2ed9ed4-fef0-47c5-bcb2-dcc8446a2e00", "value": "1536:VJCqjbwNRaPq5FllaxwOzvTNToao9Mkv:FjEraP4llaxwITNT3mMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698879073, "uuid": "09ce3e29-9313-4112-825e-de7d26f8d2fc", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698879073, "uuid": "ee75c7be-3e42-4d2d-8fa8-e5fe6e1c164b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879073, "uuid": "ef259748-a533-4fc3-97b0-4c4510a3655d", "value": "50c6f608275a5e97a8010a8f8e0538f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2902d6-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833553, "uuid": "4ae339f8-8846-4262-83c4-927924020d3a", "comment": "Malware payload (AgentTesla)", "value": "f681cf0a6b25398458748c8394f68796", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833553, "uuid": "276cfa7b-8923-4da2-bcd3-76d56213669a", "comment": "Malware payload (AgentTesla)", "value": "e00affd69cb4cdcb8e545e03b63fd304f5e5f08bd89a709e1f090ab0f33952e8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833553, "uuid": "fbdaf23a-9f6c-403e-aeec-466521e5139a", "comment": "Malware payload (AgentTesla)", "value": "2cdae9249786675e68eaf8580ca537eb262319e6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833553, "uuid": "438eb83b-31d9-4672-a442-db11c9d51f73", "comment": "Malware payload (AgentTesla)", "value": "bfea97902d1c8ca34fd0e2f7ca37a4b474f97f5297e44f6665ea5790937f9761c46bf10deb01a6318976a0351f53ce90", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833553, "uuid": "a9a61214-62af-4208-9abf-e2e5751d46bd", "value": "T1E8E4231746FE2BC09D909A6BA09278A5F7774DAE8CDF37E4B2505F66284F814CC0F285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833553, "uuid": "814ae46c-d5ac-4609-aab2-ebcf58ace014", "value": "12288:MtpkR0EThjE/RUiuaf4XWCDs1Sh+Ci/VGSz/0G:GydtjEI+CikVi9zQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833553, "uuid": "bc6d2a6b-bbcb-4f36-beaf-fa7c439010e5", "value": 657491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833553, "uuid": "56e19b7e-bb2d-4c3c-b939-79f1e8f0ef8c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833553, "uuid": "c2bc103c-5fd4-4b64-a88c-5701e55b06a1", "value": "Payment Advice-BG_EDG9502023090801020018_4483_950.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61251516-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698855546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "3629a0b9-8cd4-45ef-a824-55365da3a2ee", "comment": "Malware payload (RemcosRAT)", "value": "7d27d12925be5a5aab8f895f210103ae", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "f6df760e-99ad-460e-b2d5-e09bb2b9ca47", "comment": "Malware payload (RemcosRAT)", "value": "e0b6cd5d1fde1430ff0a72e7e5a3716ab954ce2a2817547f69b472b3ee6ae9c3", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "88fc4c04-9e10-45b4-9b01-cff98508f06d", "comment": "Malware payload (RemcosRAT)", "value": "bb92470ec4291b04c21c8ea5d990c2883c2460c5", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855546, "uuid": "69d5f42f-9787-48c5-8849-4e9ba9635eff", "comment": "Malware payload (RemcosRAT)", "value": "3ade32e04e01389c33504fa15cc0c4049e92ab17aa8f9bbf69a333e7dd0da89117d9695e2f90634ed44ae6251c92ee30", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "fecdec1c-2866-4db3-ba5d-949820e5269d", "value": "T1092412E9665BCC0DD19522B6C800E2F6A3E01CE215B576BB8BD17E0B7C85A50FB5B334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "0d2a4e0d-16f7-4ce1-96a1-16e7d198280e", "value": "1eca5643b089b9e9112d847d0e45f8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "b4f51ef8-14be-4b6a-a020-0b7937635f1c", "value": "6144:3Igos8QO7cDeD7S1SiXC3pb4CY9MBFRj:3Igos8QGcarX99Y9Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855546, "uuid": "80f48ad8-2d6b-4fe6-b1d2-7f3e95f94161", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855546, "uuid": "f985ea2f-ac74-4976-bbed-bab1d9de1380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855546, "uuid": "1072ac50-9bff-4df2-a98e-28dc9102337e", "value": "16988555449b02165c60a782c1058e686fa7cbb3680271bbd19b411e4bc160dd6bb180e272370.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8730e1c-790c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698880710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880710, "uuid": "3ddf2467-a841-4541-933e-a8d1e65037de", "comment": "Malware payload", "value": "5ae482dc02ec781f75d0e438210e1ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880710, "uuid": "41efedcf-840c-43a5-8b7e-8365347ff76d", "comment": "Malware payload", "value": "e0fdcb005a4488f603672b88e35af0485e7840fea7f0a1d635500fe553d0b980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880710, "uuid": "6cc83d35-aeec-44af-b30d-ddddd067f048", "comment": "Malware payload", "value": "ae49c459d5f42aee8d46e49cb8ccc3d96758ed41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698880710, "uuid": "54603d26-cd8d-43e5-af8c-0f058f1fdebe", "comment": "Malware payload", "value": "8a0c4e95f06e816e2c92b102679761273488d52d93099f290be58e9304f6b58ff36055420956b5329f660f47e40a82f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880710, "uuid": "496ae559-975c-44db-ac5f-321d328b0192", "value": "T19EF58C02F66040A3D50456F1FCA16BFE1A34DD15BF28C6E3BA8CF865CB316D27639299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880710, "uuid": "e2ce55a8-bc59-4ed3-bf48-57ba088372df", "value": "49152:1OtrReMgCoxIsfHG3bizVgtng6Pdcs0HTx0YXddJwi7Qrj:QpReMgCoxIsPuizVgtng6b0H+kvJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698880710, "uuid": "4ba8dbb9-4e1f-408a-8e9e-ed583acbc6b8", "value": 3424256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698880710, "uuid": "2ca13cf0-9348-488f-affe-bc8b354e60e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698880710, "uuid": "4ba1e054-0e39-4eab-ae25-aeecb331e9fa", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1SMBV9B.12722.27687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98643d68-7892-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698828151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828151, "uuid": "daeee86c-d027-4137-bb7d-4712eef6bc8c", "comment": "Malware payload", "value": "31f2369d2e38c78f5b3f2035dba07c08", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828151, "uuid": "765d55bf-5958-4053-a72f-6989cd59afbc", "comment": "Malware payload", "value": "e1ad173e49eee1194f2a55afa681cef7c3b8f6c26572f474dec7a42e9f0cdc9d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828151, "uuid": "e56be667-dee1-48bf-93eb-1de8d02cb012", "comment": "Malware payload", "value": "c0afb5797e6873bbee69f9bf0aa7a9dd3a1c6fff", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698828151, "uuid": "d90243e9-e8b8-4b04-8799-b1410c7fa6b8", "comment": "Malware payload", "value": "1cafad865c72046a59b3888126d8389f7a1d2dd0c2e32e625b195693223f8a5d6c33e51a049a09de190c26e1d8f37d4b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828151, "uuid": "d159a98c-ba14-448d-a7a3-1cb626a006af", "value": "T1F3221B025FFC99E6F3B217B57E2342068560B9F19BE186EF4F651E470C714908639F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828151, "uuid": "aec93710-b2b7-4df7-bc20-d764e7453222", "value": "b552436fca61b3d053aae8e1e0ee5d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828151, "uuid": "8e9daadd-aa64-4ef9-a84c-d62fed74ddf4", "value": "192:sfJInJ+dzOeDeBkYVos1zKutzAbitpGH6Wkjp6tnw21:sflM3os5z4wjpa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698828151, "uuid": "3e5db394-2180-41b9-b81f-7b88f90b06cc", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698828151, "uuid": "30ef38a3-aca2-4d9e-9090-27071c6d099f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698828151, "uuid": "45c21d43-60c7-44a7-bef8-bd1b86fa49a3", "value": "CyveraConsole.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd02b200-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698821340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821340, "uuid": "9e20a82d-bba0-4cba-982c-a2e2cda71704", "comment": "Malware payload (Loki)", "value": "d029d3ca36642fb8ccca49134a40bf59", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821340, "uuid": "7a232d75-6604-4048-8a0b-ef9820e55fe1", "comment": "Malware payload (Loki)", "value": "e2809bd060e2f3c578879f0131092baf39f09b30ee734903fd6e3840628653cf", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821340, "uuid": "613bdec5-4fac-423d-8df1-c3badc288d88", "comment": "Malware payload (Loki)", "value": "ab21ee6b0055505248dbcd4e4875e49180da4ce9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821340, "uuid": "bef68435-acbf-409f-ad76-9abe202f4c69", "comment": "Malware payload (Loki)", "value": "1e0dce22fb76a27174e29d935e5eefa4f21b72a02204216e274016ad7518e8ae3a96438804f4f9f78a23764ddddd011b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821340, "uuid": "fc551815-ed58-478a-9af6-fc24f58debba", "value": "T1B7E4016C767C6F67DA7A93FAB114554007F9A27E2231E3559DC2B1CB5238F900A42F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821340, "uuid": "27026534-52c7-4bd4-90ec-a4409bab2506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821340, "uuid": "5e857a8d-063b-4057-a79e-e0f85e5edb3a", "value": "12288:AoS2oapsaTC+/kO+Nccsia2BtA+/uyN8YyXFJSl/t8HYvP8ToT34:v60bNOsutJoY4FJSn8G8To74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821340, "uuid": "77252f4e-2f09-444b-9487-135f1385af71", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821340, "uuid": "6f87b414-3bd4-4275-a1a8-3afa030f1b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821340, "uuid": "7ad37fd2-163b-4547-9a4b-78e2d2021189", "value": "DHL Express_AWB#20909328982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f019266f-78a0-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698834311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698834311, "uuid": "0569fee0-cdf4-44ea-9eca-a9372a41f798", "comment": "Malware payload (RemcosRAT)", "value": "b814de9698b975719606407c487adc5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698834311, "uuid": "995326f0-bc36-4256-ab82-34c2609529bb", "comment": "Malware payload (RemcosRAT)", "value": "e2a16920cae1012c2a42bdf2dc03f6bed9ced3ec5c480b5467ee6d74b41442c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698834311, "uuid": "e14b4c39-e5bb-4375-b087-96e2e7223100", "comment": "Malware payload (RemcosRAT)", "value": "98cd5d6b5078b6f12d2f114092b1b5a42d6b521b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698834311, "uuid": "faf1c2bb-e946-4cac-8d1c-0d8c3c46228f", "comment": "Malware payload (RemcosRAT)", "value": "8d81263735e645a19fbaf4034b1ca294b0376be09d1cc189ae2a8981f2b8ec8998b291646631f60df28317a183fa0447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698834311, "uuid": "72e31bf4-17dc-4eb0-b5b8-968c5ef649d4", "value": "T1A4D4237B16D47EEEF93B4A3157B2D873B0CAC528415811970F907E1F6AAC447386EA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698834311, "uuid": "7f4e0d47-1c2b-48c7-a4a2-d30f21794eab", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698834311, "uuid": "04fa4383-daab-4395-88a9-dd09cf8641f1", "value": "12288:Xd4wXbmIIlMpoCLm8KdIX6FDZbkAwVRNvqGBRw2wRBLvSuAr6b:Xd4wXbmVlMoKmtgS9O5vyRBLaufb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698834311, "uuid": "f36ff539-af45-42fa-9fab-123b160d4ef1", "value": 654447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698834311, "uuid": "800be921-0e81-4dbf-b990-6fef374b8ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698834311, "uuid": "6049632f-ce93-4b5e-b449-5182389eb7e4", "value": "TR-8765456789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc26bcc-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819811, "uuid": "183c98c2-327d-46de-b936-9ccfbbc64a78", "comment": "Malware payload", "value": "b451df99f53c669dd34a5e2a0d950b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819811, "uuid": "83f01a3c-9cd4-414c-aca4-043fe5b37d2d", "comment": "Malware payload", "value": "e379760db114d6c944ebdcda329fd84aa3a507081f9341b7fa9bed41845caf98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819811, "uuid": "70be5fad-6268-48ce-a9b6-2cd4d154bfd8", "comment": "Malware payload", "value": "bc3bc737e68cbdde6887614e4121739d9ea75be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819811, "uuid": "7db57279-75b0-4189-90ed-46be3452f5bd", "comment": "Malware payload", "value": "03184e7dd3d84e35ec3a2273eb04ac526cb1bc9d5cb7a9e33681f4511b505fba6b19d61b01660c252308bf5125cec6f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819811, "uuid": "aab75678-7f51-46f8-a85a-0034b841bd15", "value": "T120534C566C915809CAD4BBF829F091562A31BDE10520C1CBA8FDFF299E73313EDC51AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819811, "uuid": "a5a15c41-de95-47e4-bca4-1166f10e9731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819811, "uuid": "5ebeae31-f5c8-4bcf-b63d-3ff12eb8dee7", "value": "1536:m55eVPYEh+M2630VDcM7TPxdF8o75F943hh:m5gVgEh+iEVDcMfxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819811, "uuid": "a5f78169-7aac-4499-8637-6cad9af30ef1", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819811, "uuid": "297c91ae-7cc3-4ab5-8526-e77a8f80a349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819811, "uuid": "9f72462d-6f70-4240-8baa-25fe503183c1", "value": "PO 20039847_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca88a3bc-78c3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698849280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849280, "uuid": "ca0e87d9-ac22-4c1d-a9a4-f686d94811aa", "comment": "Malware payload (LummaStealer)", "value": "710785459d065a7e822861764ec36480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849280, "uuid": "a94f3792-d499-4222-a66b-a9ca0f5e9ca3", "comment": "Malware payload (LummaStealer)", "value": "e396aa398fb1fa0f6c9db780211f758649e9a1f26bb5a2e7026b1cfec6ea9c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849280, "uuid": "f497789f-b5c2-4fbe-bff1-b84ad88a3c01", "comment": "Malware payload (LummaStealer)", "value": "d7d641f65e380e71f13dd04a6a37c903b532fb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698849280, "uuid": "d448804c-f63b-4198-87cb-161882d5151f", "comment": "Malware payload (LummaStealer)", "value": "40ccf99a6188e65b649c06143f70d8ef793dd9ccd1c757ede4658760ffb3d64b1b383dd27f209b4bde4a6a1c6e0668cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849280, "uuid": "44227dc4-f90d-4189-8178-b4a0294d9bcc", "value": "T1BD85F121B3904737E02316785C0FA7ABAC29FF123E28AD8AABF55D1D4F397817425257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849280, "uuid": "84205606-47e3-4d2a-aba1-7325081106e4", "value": "02ee4d97128ded731f4f59ac97a7dc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849280, "uuid": "56f09798-bc22-4261-9a29-df7bf05b07f6", "value": "24576:TV+UOwZmL/nvlkykFlTrAEdghT0WUQ2YUhOxiq2p7j4jNyXpcHLYiSHdX3Ra/KhV:TXZnl3AEyRV2YUIxPsDnI/wM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698849280, "uuid": "e12a4164-59fd-4e95-84ca-47b76e090b25", "value": 1794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698849280, "uuid": "ea7fc0ea-652d-4bd4-a207-c46f577990b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698849280, "uuid": "3e64a973-e8de-45a1-9374-1000660cb43f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adcacc3-78b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698842275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842275, "uuid": "c245b005-7b64-4a01-87a2-265a1027ab00", "comment": "Malware payload", "value": "c1a5ba03f0ba9832cc87180a4c4622a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842275, "uuid": "cf84e813-a61f-457f-adb4-c0b83e2d7f1f", "comment": "Malware payload", "value": "e41e19b9ee8889b3887b8cacf264468c661bdf382706bbd9052c1f95c4eea504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842275, "uuid": "2a0b647c-ace2-4dc7-999c-3c2a09b496ae", "comment": "Malware payload", "value": "b6c0f0588c8efffc48f308dfddecbf6170204dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698842275, "uuid": "5165948d-b485-48d6-8598-1c02a75f801d", "comment": "Malware payload", "value": "3b3a9da764f184f9ff95f35b9992fdc1065b9576ba71e9e4f2057a988fbfb5a546e5be4a3cf39dfe80c1c13a63765cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842275, "uuid": "b428fbc3-c961-4cb4-b7e4-0cd50d1f8bd4", "value": "T1D584B0677084C8B2E072ADF8ED56E3D43429FE31AD158C0F32D63E4E6D34A5668493D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842275, "uuid": "73daa2e2-d4b0-498a-8adb-db82b280fa57", "value": "2b78a66b535d879e49826ca8e2f222ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842275, "uuid": "50f946a0-b3d5-4782-ba30-f18394ace2e3", "value": "6144:FPOLO+3Jgdh0uf6/jvPP25CCnqS2OZoApWWeKcLqApsBhyFb:ULOauh0uf6/j29nqw2ATUc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698842275, "uuid": "9cf2e105-c55b-4021-a931-46878ee5daa5", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698842275, "uuid": "bbaf81b9-2e32-47b5-8e7c-5f6827defb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698842275, "uuid": "edaafd22-cd91-4197-b1ce-07517f0df9bd", "value": "e41e19b9ee8889b3887b8cacf264468c661bdf382706bbd9052c1f95c4eea504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3282c3f1-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833563, "uuid": "15a9336b-e6a0-43fe-9c53-9081c28c5f07", "comment": "Malware payload (AgentTesla)", "value": "f80852fdfb9aed5ee3599af8af430d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833563, "uuid": "228ace36-75f6-46ac-b1ff-e08875eeb585", "comment": "Malware payload (AgentTesla)", "value": "e440d655409d87441f77dbd53b984167edc84424b04722d8f1086bef238e086f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833563, "uuid": "ea90506a-1228-4e82-a73e-961141983a21", "comment": "Malware payload (AgentTesla)", "value": "cbc1f29ec1da0b2c20921bf075bf58816b4c47b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833563, "uuid": "16eabc6d-e413-4bfe-abd1-52343b847bd9", "comment": "Malware payload (AgentTesla)", "value": "34d27dcfdef3d3f54b6c4541e7e25ed7f09536aba97de9ea656efe3180ef340531145d7a7985cc0910bb50afc0fff172", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833563, "uuid": "6f618422-5cdd-450d-9acb-73223ae6b2a4", "value": "T1F8541214B3BCCB06E8FF2E785632893C6E7792122321DA4E9D88D1CE2915742D7E5786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833563, "uuid": "d8f4654d-7d64-46f3-a907-84c7097f0bbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833563, "uuid": "9200f206-1cf0-4b89-ae8c-e57038beb806", "value": "6144:j2tXl/CkOrTbBFr/jBe+lI5bOz4RWy2EKR+Hf9We81jaW:jIXl/WrXBFr/FHlIRzIUKR48H1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833563, "uuid": "7361b002-5c03-4070-a10d-1b8ff867d766", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833563, "uuid": "4316e483-d592-461c-a913-4db6df2bc50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833563, "uuid": "020c741f-b2f1-4af0-9a64-a16a0495a0b3", "value": "PO23100022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2292e9-78da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859052, "uuid": "b311e240-b958-4d35-a707-af6c33e42a06", "comment": "Malware payload", "value": "77e2b6a251b3ed0440f515824c1d67fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859052, "uuid": "53a164b4-bccc-476e-96dd-365dee908768", "comment": "Malware payload", "value": "e486e7139d822916d3608207854109d49cc1dda5f894d314c2ae1c6aa9ed8249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859052, "uuid": "721a4a2a-c4af-401e-97ff-1120f0e0b829", "comment": "Malware payload", "value": "17c07d5b66b17ef50890b09effafa109b34a5a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859052, "uuid": "33a9f62c-fe01-4a3d-9e44-c85e6a220782", "comment": "Malware payload", "value": "33d4a2d49f18d687ed202bfae11a3d76c65782dcb6318af3073c280a6a324ee1f22f655401266a24b9ef361a0632309d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859052, "uuid": "1cfb8b8e-a267-4961-9ee3-2d0a899fce69", "value": "T156F41240B6BA5B3BFD7593F5166062481BF2706BA2B9F3088CDBB0C75199F404392B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859052, "uuid": "64d36ce8-af41-49dc-adab-c7b4b949ad6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859052, "uuid": "71adafb0-3ade-471d-aabf-b0f078514c60", "value": "12288:IjbyGBWKkv4KnIbow0Qa5oAMJ7Ec0rdebYvgwLHqZ0aTHWsYoa:IjOGwJwKnaSoXqr4/sGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859052, "uuid": "500f446a-da94-4a00-bb05-05199baa3492", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859052, "uuid": "1083a2d4-4914-40cd-be10-4318062d2304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859052, "uuid": "7ccb3d22-f68f-44ec-9976-468f54dc2747", "value": "77e2b6a251b3ed0440f515824c1d67fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67218ea-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698855367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855367, "uuid": "b212ad00-171a-4786-b0e2-04911afa7d49", "comment": "Malware payload (AveMariaRAT)", "value": "d2372b8e015b480c9b2ec161ef7a6100", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855367, "uuid": "6022672d-4a5b-4783-96e6-d80b583d7d31", "comment": "Malware payload (AveMariaRAT)", "value": "e5eb5942b64543e52c9ccded87c111d81488cfca455f4d810c167f337b9cdc06", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855367, "uuid": "8e4eae74-a341-49b1-8e7a-aef9e92a2d7d", "comment": "Malware payload (AveMariaRAT)", "value": "2922cacbefcc88e27cc068a91dd08c159dcacdef", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855367, "uuid": "cbbf7d9b-8469-45a3-938b-313d42b9cb31", "comment": "Malware payload (AveMariaRAT)", "value": "8cdb4a6bed8fcd22dc5e7420cbc617acbead158c25bb51239f0ce81af17da3c3fc173dbd6a92b9ee8a906516640a6890", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855367, "uuid": "8911337e-6a4e-4c42-aef4-5c89fe992d95", "value": "T11DE37D227BF54439F7B705301AF93E25D2ACBE310E35CE4B5BD4488658B1589E93A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855367, "uuid": "fc5bc99c-180c-4491-a037-b4486ec7c57e", "value": "570db8ef63a92b7fa4b4955d1d36a178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855367, "uuid": "a6c9d6ee-df8e-4a61-b8ad-1b3a978fea17", "value": "3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iwn:RkxbQktMo4BRiyjYz6GTrwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855367, "uuid": "b54b847b-2ad3-4344-86a8-774ac8757981", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855367, "uuid": "b8d5cc7c-5802-4daa-b535-cea0eb58fbbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855367, "uuid": "b84b4547-2ebe-4067-84cb-5e94b21c2d9d", "value": "1698855365a738fe5bf028798f4c898a5c26a6beaec785f238cb730d8b1e4cc1f70c0e5974436.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb876c-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698819884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819884, "uuid": "524a05a8-0269-4558-a669-fcb28ddd39e6", "comment": "Malware payload (AgentTesla)", "value": "ad1ef12c860a83f9d6f0e5c2c4db7ae5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819884, "uuid": "608cbd2c-0edc-4d11-8a11-3e772720c167", "comment": "Malware payload (AgentTesla)", "value": "e68c34d8efc54a96c36672acd36a99f636326449500c263f2851d772c69c3f82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819884, "uuid": "502ff8aa-653d-4fae-859d-40e09e660227", "comment": "Malware payload (AgentTesla)", "value": "a10ad12e36cfd3e353bfbfaaa0fcaf3d0c6500de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819884, "uuid": "eb2d5984-112a-4a3c-8344-1750fe4c26f7", "comment": "Malware payload (AgentTesla)", "value": "c221aeb723eed9782e3d29afc75c8c5856b6a854b1eface92d980809d107ecffdfebcbdf53a8e7ec1795ccc4c3f2e29a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819884, "uuid": "f1127aa0-be4e-444d-8f85-e2ef02c50c82", "value": "T11BA328063A824605C5D9BAF491F2853616B2AEC71133C28A3DB87759CE733A3DDC979C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819884, "uuid": "f70f9955-e5cd-4367-89d2-b652de383a1e", "value": "1536:xEq0MBjQGQBP2DDbqH60uH3L630VDR27TPxdFP75Fbnd3hT5:xtcN2DDbqaJuEVDR2fxvPXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819884, "uuid": "eeddc69d-6bfb-4694-ac33-5ac4e7ebd1e7", "value": 102976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819884, "uuid": "89eaf01a-41cc-4d21-8402-123c95ca8085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819884, "uuid": "3262fb77-6a86-4ef8-bca8-e868a00d5a17", "value": "PR # JPPL-4-009231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9568a0-78cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698854144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854144, "uuid": "95410a74-c048-4e67-b3b2-6463f7414e70", "comment": "Malware payload", "value": "be3bb39519af8507873d0a0abc67167d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854144, "uuid": "c30c9873-1fb7-4c5c-817c-4836b29a6a7f", "comment": "Malware payload", "value": "e6f7f34aa24e87ea8150dd31225dcbea32d9d90a411a623969ce8b587b5b583a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854144, "uuid": "df886df0-9ecf-448d-a376-6fc206037857", "comment": "Malware payload", "value": "db2ca02b33c2d1f88c67d46e1a88b9c2aea9ca80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854144, "uuid": "49f0ffce-cabd-43d9-9b26-80596efb9897", "comment": "Malware payload", "value": "4746bc2a834cef42ddfacc6ad99aafb625737182d0a327842cd8d8a66fa983b55d4bfae67811157ca37092978e27f0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854144, "uuid": "015feceb-0a58-4591-8403-9e5b0448ee4d", "value": "T18FA4592379F8C4B1C0621A3215BDE62FF5386A1B3A658E8AA340DD7CADB15C0D6717F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854144, "uuid": "a2d7d1ac-0740-45b2-b65d-607aac35c467", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854144, "uuid": "7e60a234-b2d5-4b53-8a70-447c29ba6fd0", "value": "6144:5TouKrWBEu3/Z2lpGDHU3ykJYL9D/S5YnZ0OZCKApVhq40L:5ToPWBv/cpGrU3yhpzS5seOtAXhl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854144, "uuid": "ae9f580e-4bb1-4653-af2c-6269fab5e8e0", "value": 477894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854144, "uuid": "6f4e5b54-16d3-4796-9367-31a5f5d1639e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854144, "uuid": "2975e4ba-258a-4562-b9b2-7694600047cf", "value": "be3bb39519af8507873d0a0abc67167d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e9dd89-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819939, "uuid": "58b6df3b-1a00-49b9-bd0c-0656cf35e9bd", "comment": "Malware payload (DarkCloud)", "value": "ac6d7af97404b1a62bae4c3f5ca54b56", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819939, "uuid": "441d522e-53c9-4749-8d0a-739cafaed80d", "comment": "Malware payload (DarkCloud)", "value": "e724f805db3ce1e85925362e880fda71c45994b2bb3abfaaf862ddf623b97325", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819939, "uuid": "3adcea5b-3393-4f68-bf3a-5edbfda0b976", "comment": "Malware payload (DarkCloud)", "value": "a563f7c01a520a424bce8167d66b9c8bcff1c747", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819939, "uuid": "0948fa4f-910b-4692-8163-d33d3bbe4aaf", "comment": "Malware payload (DarkCloud)", "value": "30be50e952ef1431ff7c226ee2a8e621e31151088cb95b313164b51ed15dc39b377fe3b016d80a11cf21e2207a41200d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819939, "uuid": "5d82046e-e80a-4226-b256-65ff0aeecdf6", "value": "T1A3B4129A3891D45BC490B6F81AB1965B6A767D540220C18F9BF47F24BE33203ED8DB3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819939, "uuid": "053c928b-a3f2-4393-9bfa-97e52833deab", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819939, "uuid": "25db269a-fde6-4932-9565-7f1dd352604d", "value": "12288:gY/52enlLb4XJouPMNHzGqx4C3EGRWqSNaX3+DWA+:gY/5blLb4ZoVTx53EGRukX0j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819939, "uuid": "6eefd4c7-7ef4-4bb1-bd3f-d0cf2749d29b", "value": 498032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819939, "uuid": "ef380c77-eef1-43de-8a1d-d11b9b450e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819939, "uuid": "38a6cdc2-8c9c-428f-a48c-a0b96b50c2c1", "value": "TGH0976545700090012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d7655b-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698820015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820015, "uuid": "e5c540da-1524-4219-b231-6cd329323239", "comment": "Malware payload (Formbook)", "value": "226b0b73bc466f8009bd8de136e77365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820015, "uuid": "74baf76a-96c1-4bd2-86f5-493ce7d98dc7", "comment": "Malware payload (Formbook)", "value": "e7f72087074a74f048f9ec991e2d77f7f5b4125dd1e954776539c9440513fc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820015, "uuid": "f243cc27-278c-4c04-a362-92d802a3eaf8", "comment": "Malware payload (Formbook)", "value": "fa59904ec37a61c02f0fa6b2f50cc214805d94cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820015, "uuid": "c349b44d-34f5-41a6-bf3a-f303a1ee8783", "comment": "Malware payload (Formbook)", "value": "6b15b1c95741971ab4d678357328c23c9a3388c37fce76c1a108b28a5f3384477c0d32c9a2038d5c0f5bd95469021e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820015, "uuid": "61496008-e55c-455e-9116-4134f492152e", "value": "T10D84239022B99CE7E95397305A3F46539BD13D396158930F0BC47E9B9C322A1C7AF392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820015, "uuid": "bea08816-d653-49c4-a724-3d2144c7ab9c", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820015, "uuid": "e80e35ba-7c8e-4be7-9d84-787570818936", "value": "6144:LnPdudwDzjGOCID8e6NyWi6t877MkVMvQVZwEiJzRRB2Vk7D9fc0pNTbxzxx/jsl:LnPdvjdpD8eLmK7MNsiJdRnRfBpff/jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820015, "uuid": "25dea1e7-112b-4f5f-9aa4-8c1893e2543a", "value": 393981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820015, "uuid": "8da418c5-ec60-4fbb-bdb4-d75e77014373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820015, "uuid": "4d99eaf1-90a4-477e-a6c1-bd1fe4a3b1ba", "value": "876543456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d684af-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820073, "uuid": "55329a41-1cc3-4561-aa33-4faba702361e", "comment": "Malware payload (AgentTesla)", "value": "dfbcac3fa35616268c53a5048841bb3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820073, "uuid": "13d24e43-8ee7-43e9-9ccd-9d8e9100181e", "comment": "Malware payload (AgentTesla)", "value": "e815b94a9f59bb81875837e65e468ac37460bca3130d2bcd57e0123bb9fca6c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820073, "uuid": "829da863-c1c2-4d72-98e7-01d3592e86cf", "comment": "Malware payload (AgentTesla)", "value": "73f36ea62a89b5353ef127a80e23e8636005ed4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820073, "uuid": "03f239c5-b08e-4921-8f60-aef67bf4ca7f", "comment": "Malware payload (AgentTesla)", "value": "f428d7faffeb3877ab9b6d8685a10405698b75667b1d258b79c0932625bd46f784759c060e6ad49da791de889adcae9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820073, "uuid": "be051067-8b60-4ce3-b69b-86c8c2adfdcf", "value": "T12024BEAB7516B4CECC4BC572C9CA8C24AB70ABA65753C107604B635D8E4E3A78F190F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820073, "uuid": "299b389b-3cfb-44c0-8f47-0a52fa664684", "value": "3072:CFepvLr8aTY6ialir6q8JiLUQVxQMxUwXXaf3xioMVi6+5V+yOayosfxvPXjCfx1:Kepn8/Ret8ZVxQMxUS6x0UPavjyvj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820073, "uuid": "044fe561-4369-4a27-9baa-c2b84a8bc8b5", "value": 225408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820073, "uuid": "22b72775-9c7d-40b3-839a-05917694cf07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820073, "uuid": "50b9918c-e728-45e8-9685-ba5e0b646009", "value": "Vessels Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6fb3dd-7883-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821527, "uuid": "d027cf58-dbc2-4081-a316-428160395970", "comment": "Malware payload (AgentTesla)", "value": "fd42d51b86f19c0536339338d6df02d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821527, "uuid": "1a0ef2d3-07b0-47ca-a408-b13708560a49", "comment": "Malware payload (AgentTesla)", "value": "e89b8860e1c21daa8580eaeecda15c3d6bcc560536cf0e9438c1acc7b6f3986a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821527, "uuid": "e5ac6dd6-f61a-4855-b454-2967612f7d86", "comment": "Malware payload (AgentTesla)", "value": "46021cbb2d35e7fef8e521e5bb9dc54e4815f8ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821527, "uuid": "c1129a9b-ebc2-4856-b374-e4352e8911d6", "comment": "Malware payload (AgentTesla)", "value": "abe81c1d130c7eb7fae1a87075360731e4bb2dc070d30b07877f1f23f6574108122edc27207e31bf449b9f744f6b49c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821527, "uuid": "5bb32c42-7c8b-4bbd-893e-1c71f3efde1c", "value": "T1C8D4229473A64A05CBFD5BF60972A14513FB506E25F2DB4C1CC072CD0EB3B882AA5797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821527, "uuid": "f6b0cf60-be66-41fa-bf0e-6aa990fe2a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821527, "uuid": "58aca300-c028-4039-9de3-6428fec46ea0", "value": "12288:O8x69yqLuS+C7he+3kFYib+GzF3vTVaZPkfRVUaa+V624Wrm5oor:N6XCQhe+UFYib9BvJa2fzUHw62Ry5Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821527, "uuid": "1bbed4d5-7b8c-4a67-8f1e-c4585273e89b", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821527, "uuid": "37a924b4-0c1b-4ebf-8923-395470b9a3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821527, "uuid": "235edfe6-4e86-499a-bc37-75c38d71eeac", "value": "Petronas196885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04813f8-78d1-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698855276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855276, "uuid": "5f1c49e4-300c-42a5-a3b4-0d6543aae453", "comment": "Malware payload (GuLoader)", "value": "a769a579518ccfcfd45fb3a676f29012", "object_relation": "md5", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855276, "uuid": "9a689084-9f7a-42b0-b7ed-2ab9110451ee", "comment": "Malware payload (GuLoader)", "value": "e9d7de95d4a18d6582994f4e79a7678da14f4c19476b20d12f8cb9844e10a080", "object_relation": "sha256", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855276, "uuid": "205f235b-160b-4035-9b94-edd35267bed1", "comment": "Malware payload (GuLoader)", "value": "41d8d20b49d5a25a247d582e3b48bbcdb504115c", "object_relation": "sha1", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855276, "uuid": "91935cdd-14e5-4fb5-bb2b-8548eeccf53f", "comment": "Malware payload (GuLoader)", "value": "805926c254066f3938d7d13e30fbf94786d5fd809b4c46fdcb6270a5d4f90b7405657be087b59ac5962485ccd755c82b", "object_relation": "sha3-384", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855276, "uuid": "e2faf72b-362d-4986-a348-4a27277f0ff1", "value": "T121337DA9EAA5060A0C8B37E9DD830951C1FC845915369566FEDD03CE930B69CC3BDF2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855276, "uuid": "13f468b0-23ee-45c5-b9e3-8c2f257f41ba", "value": "768:hVIvAuwHiyseD1F6WDH7RNsNLOdUOfjRym40TtXzUOEmol3t6AiFj0:DjQXe360H77sNLObNySdIOJowFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855276, "uuid": "f13a03fa-737e-4803-ab80-cf010c582b18", "value": 53368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855276, "uuid": "1044b288-42be-4e1d-8305-ba0efea1bd62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855276, "uuid": "d5034d70-82f8-4f85-9f70-da95dfcbbe4b", "value": "Akbank Hesap \u00d6zetiniz.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72468b13-78d8-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698858152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858152, "uuid": "124bfe90-0b17-40cf-9d47-42cae06aaa8e", "comment": "Malware payload (Stealc)", "value": "53de52681666c9f76258224aac7e94e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858152, "uuid": "7a363c75-3ae4-47f6-b54c-3dfbc82bc375", "comment": "Malware payload (Stealc)", "value": "eb54dab9a40c3f156794c2c4294e04a44e25232e32602d38882ff59057d223ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858152, "uuid": "eb89e6d4-ffe3-4e58-9100-e6d97328bc3d", "comment": "Malware payload (Stealc)", "value": "1f27f8e818e14008f400b795fa70a9793d82bfcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858152, "uuid": "87be6de4-5108-41c0-a8d8-9668e4d3b800", "comment": "Malware payload (Stealc)", "value": "318beda74cd0482c6cb657b8968901553f0218e3df5fa899ab70fe87a077b3b147abb5aabbdc57cab68aaea6c4b17013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858152, "uuid": "5d49caf7-d2b9-4688-a14b-d8cd75f196b9", "value": "T12E246C1352E56CA1F6274733AE2EC1F4769EB5608F552B9B12599E2F0C713F2C672302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858152, "uuid": "b8b64983-0076-4402-84d8-fa6ca967e495", "value": "c8a352bf73a61d8e36f530e1798f43a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858152, "uuid": "c253114a-59e7-4045-a5e9-26a528da1e3f", "value": "3072:9Gfxo/K9iTrBKshNLRO1TRPx9fKqEw9/DQdH2sFip1NLg67ACLYOLjguk:98oVrBKV1tPz9NJp1N868BOLEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698858152, "uuid": "50b1c032-ac12-4929-891b-22dbf6e6c1bc", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698858152, "uuid": "6c65e657-128b-4879-80a9-580cb2198b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858152, "uuid": "955e2151-0945-4f5d-b185-0e2b25e0c258", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f553802f-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820146, "uuid": "a629738c-9de8-4f69-8f07-59cebb4963ea", "comment": "Malware payload (AgentTesla)", "value": "a758941fabbfa5556cd45234a7aa9a28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820146, "uuid": "2010670f-427e-4f06-8e6d-e5eb0ab33fe8", "comment": "Malware payload (AgentTesla)", "value": "eb9363fd602eeff93b77d4e18adb5cf6724316051a2a94e5beec66c8d0a6aff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820146, "uuid": "996f3df3-df45-4c9a-ac84-896cb4224e1d", "comment": "Malware payload (AgentTesla)", "value": "d2d7ef4123dfedfb710291605ff923b79447ae68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820146, "uuid": "310a1141-b685-48ce-af2e-4e3d0ec191ab", "comment": "Malware payload (AgentTesla)", "value": "281499088290d1f840669d6fbd049b4918b215908178715a0180555c93f4448dcc3a98fe43cfa110bf49c750412e6628", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820146, "uuid": "bb6a743a-1a7c-4935-aab5-a262d035253b", "value": "T19C55C003E940CB83D41C83F46EA34EE90B16BF54E9965ACF205ABF4F3E706621D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820146, "uuid": "629f6632-f200-44b3-9ed3-dfc20220edae", "value": "24576:zBBMw6/wZyu3bVqw6/MZy63bVEkn0YTox4z5EJ3OyxIyn0RLJ5dqkb7G:X6/C/3bVN6/+x3bVprT1l+3OyH0Rlegy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820146, "uuid": "0bdc5c9b-5571-4421-98a1-010f78df5a79", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820146, "uuid": "5113bd6c-d82a-49fe-976b-2643cb48589d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820146, "uuid": "2d06fea6-3b1a-4db4-9669-fbb00cee033e", "value": "DHL Shipment Doc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3140310-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821324, "uuid": "381dee79-a623-4834-a918-a91dac1f43d6", "comment": "Malware payload (AgentTesla)", "value": "1dfb1cd4ab956eb61aa1757dca439f82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821324, "uuid": "3db38102-a0a5-49e6-8178-10ca8fe47c0e", "comment": "Malware payload (AgentTesla)", "value": "ec1933e85a80f3ceb98706e2944081d30789149060b370287ea8b9e39f10594d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821324, "uuid": "3729309d-ce23-4c45-8c9a-a14a7c197b6e", "comment": "Malware payload (AgentTesla)", "value": "85c2c2315ac622acb7cea204e067478515b6d047", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821324, "uuid": "c073cb6d-f7f4-4737-ade8-be606916042e", "comment": "Malware payload (AgentTesla)", "value": "110074e1a4bbaecdc2640ba44e650a1223ae83082b6157e1055c43cba6161c449cd18823237dbf9d51c1b9704cfef690", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821324, "uuid": "02d1512a-9770-454f-9259-af6a40a52f50", "value": "T111D4231A887805A4CF5BF1BFBA346489D505013E4397823FB6C551DC4DEA8CA38BEB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821324, "uuid": "148711ca-3d3d-4f61-af95-33e178063b63", "value": "12288:1GnWbvhxYTYBThsiPm6tYU1qaalQClfxRflEaLSKKGRO3gXVIxvPlA:oihxlFsiu7damlZ0aLSyRO3oVAPlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821324, "uuid": "8e4eea4e-d7a5-47f4-8350-9babba86ebe3", "value": 617837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821324, "uuid": "1c9c56a7-42fc-4b52-beab-c71101747f97", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821324, "uuid": "bc91814e-704b-4422-a5e6-c57a1607f101", "value": "31102023-8766-0987.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e96ec91-789f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698833584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833584, "uuid": "b1ea570d-c190-4a0d-b68c-72a73e6a4411", "comment": "Malware payload", "value": "fe57e147d0f8a0e51f84846894624d65", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833584, "uuid": "b2a5d3a9-2aba-48ed-a6be-2ddbb7327381", "comment": "Malware payload", "value": "ec72c71b61436bc7e70e4daa5656e7d621aa1929666ef6ba77ecf132d3f43453", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833584, "uuid": "ad457aaa-3c24-43c3-8e67-64682c91b455", "comment": "Malware payload", "value": "213e61d6dd6a08ccbeb19f036007877513114acc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833584, "uuid": "246aeb61-8283-4c39-aac3-ec011bc9e642", "comment": "Malware payload", "value": "14fe089859f87e0b8de96cd598a16f4e6a6f5b5672f1d0af081651f1e08182cb389467831648eae2689618dba345f72a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833584, "uuid": "c2702790-0944-4e6f-b979-1ae90686ddcf", "value": "T1B1C3128E96C4B215932A84A9DF070B6E4919529BF89A4D74F8103C94C01FE75FB523EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833584, "uuid": "7cee2aff-b2f0-42cd-990e-9a404531c122", "value": "3072:SYIjq39/3KryGVdtC1SS6mbX7AgHj4mVjfFnjXpaAmM61bOd:YjqN/3XGztC/brAgHlZFnj5aAmMGbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833584, "uuid": "3498170f-f291-4a00-9b67-58e98ac9ef9b", "value": 124993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833584, "uuid": "b62dbeb2-290e-423f-8f34-313011adab8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833584, "uuid": "2c664c7b-3abd-47fb-b502-4f1f6cc524e1", "value": "Repellat8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d07f74d-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698833527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833527, "uuid": "2fd84408-5bb6-4e27-9eed-017beca9f21f", "comment": "Malware payload (RemcosRAT)", "value": "287e6945870220b7ae90ce01497a6023", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833527, "uuid": "8b090841-716f-45d5-94c7-deb07bb897dc", "comment": "Malware payload (RemcosRAT)", "value": "ec89cffb121da537dc5258492100381eba2016afa83360c7eec226a7e1b30e34", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833527, "uuid": "1bdfc0b3-4308-4c9e-b458-baa4ceee3aca", "comment": "Malware payload (RemcosRAT)", "value": "106eb926f8f111b3283771ef2aa353eda8e9827e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833527, "uuid": "476c9dbb-d4f3-43d4-9ca4-bcf2906ecacb", "comment": "Malware payload (RemcosRAT)", "value": "c68a6618f46004adda3210880ed811d46aabc8f96bbab32e15af3a1f5ecae1c91908e71c4387d4330a213ed9783e5c40", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833527, "uuid": "56e844b6-a36b-4e97-a84e-e1d161048b61", "value": "T1D8E423A8C16B1C8D5DE725953406F8B1B21F2AC37BB9EA9063B563331B19E1F5227438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833527, "uuid": "18672c4a-38bd-4a5c-8882-3c63e3c669f1", "value": "12288:CWxoWpG8h7pjpMGCAgrbTQJy4YwFhJorvRVDRDXS42l9v1T8bmy6spu7Ua:CWxoW3h7pFv6Pey4nbor7Dg5gGFUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833527, "uuid": "d850221c-3d3a-4a5a-a117-3e566479887c", "value": 706894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833527, "uuid": "3e3f85b9-8597-40d0-aa8f-6beb83e45679", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833527, "uuid": "3be838b5-5880-48e1-a882-820ec3d3d7dc", "value": "ARKBCN0000134245 BBL.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14194e7e-78da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698858853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858853, "uuid": "2f51f481-dbfd-416e-8a66-a9428028f053", "comment": "Malware payload", "value": "6b9c5e69ee2b5a36d3331186ab8174e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858853, "uuid": "2b247be5-7495-4bdf-b475-8ded089395e5", "comment": "Malware payload", "value": "ecc3599d20e407b380261f62ba7e48c615042a2436e6ff806814d73fcd74569a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858853, "uuid": "6a6fa11e-c67a-4bfa-a654-03a7f2d18bab", "comment": "Malware payload", "value": "55e43ffe527c337a6fd0dca06bf300be02b1801e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698858853, "uuid": "37b52663-e636-4104-bb20-51f1adfb5a01", "comment": "Malware payload", "value": "15dcee26a8acbf5bd0c13f016e4efb0d1e010f4d772e0dfb054c0babe3d4fca148bad265e74d280c715b32858ea7297e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858853, "uuid": "ade8643b-4707-4b6f-a9c1-f0858aed2259", "value": "T13CE5277979455C22FE4E21F39CDA0508BA83C0D6270B93963AD643FEA20D3DF9549F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858853, "uuid": "2799272b-66f2-4868-a098-28a1cb5b375a", "value": "49152:1qD79d1+1XkBNLVkSb8DzqMTwT3kMMA7NQzW6vLsTC8fdhRWh4d8UecUo406y+yf:61JKnOL0fMngio6aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698858853, "uuid": "0afab912-2a2a-46e5-8e90-cff3d93171f6", "value": 3130368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698858853, "uuid": "fe97b4e6-288a-40f4-8f52-7f62f136d38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698858853, "uuid": "c9a93c1a-80de-4ecf-87e1-694a7e2cfd3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83015f3a-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821243, "uuid": "4ae218b9-fb2d-41a4-aec8-492f7df2ca36", "comment": "Malware payload (GuLoader)", "value": "545dffb9421159af54230136ff53ca28", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821243, "uuid": "efcab668-742f-4e90-b9fb-42d3b3349ecb", "comment": "Malware payload (GuLoader)", "value": "ed8e3e461476a13c660df6c08c70eac84c4c57608b230c9dc6a91097f2d87255", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821243, "uuid": "c90e8eaa-cc11-427e-aa99-fa71f1062cbc", "comment": "Malware payload (GuLoader)", "value": "1c4e7457854fa03c2e24757a0b9973f67ba7de0b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821243, "uuid": "4acd4d5d-b517-4277-aeb7-08b5c23b301b", "comment": "Malware payload (GuLoader)", "value": "080aa06337ccd38e5349ee90a8c717d3c2a7bb9d5a5d18eea64fa289ec3c7f296f2c3959a007298ee45c96e8040ba83b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821243, "uuid": "d93dbf85-7a8a-4c24-a9da-d3bd20c22870", "value": "T11E936CF2DB95161D494B27AEDC4249728DBC812D3627063AFFED078DA20785C93BE709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821243, "uuid": "4d6a5495-1d40-40dc-b251-1b7e8bbbcd2c", "value": "1536:ZtWVQKD+xDWcPljwRzzdbrZMII5+YWuw9Q6iuud8BxSXJM2HwA1/LdiwEtURkOFE:TOR+xSc9jwRzRra5+ZzK9uudQxKJM2Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821243, "uuid": "bf5152f4-c9b4-47e9-a4d6-6fca62fcd6cb", "value": 90826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821243, "uuid": "95be9b7a-38b3-4cef-aa45-92a8aac84992", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821243, "uuid": "c9633aa3-bfe8-4608-a0d2-98b9ad18b65b", "value": "202310_31432NYCUEC\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e146ce4-7909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698879082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879082, "uuid": "ae40b160-2f86-4562-af3b-9d67be6c5cac", "comment": "Malware payload (Mirai)", "value": "21fc3f751fc3c484ccd09fe0509d9624", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879082, "uuid": "8df876f3-dde1-443e-9990-928731fbe9ab", "comment": "Malware payload (Mirai)", "value": "ee9a9789516c51a87bcd8b46d132ae89082db83ad4c3c22851d95706c13c8cab", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879082, "uuid": "b4de88b1-55a0-4a42-a5f1-8cb9bd5aff43", "comment": "Malware payload (Mirai)", "value": "1d378c74d369fe4c6e36fd9543226f9916b02ce8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698879082, "uuid": "5f113dcc-cb47-43db-a396-68682e046e2e", "comment": "Malware payload (Mirai)", "value": "5d3bf61671cbc8beac6ab826e05df3df379143a01c66e30c60ff47b42cf2b73f3bf7e9eb0ab81d7483c465446c16835a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879082, "uuid": "1fee835d-05ee-44fd-8471-221bc130e707", "value": "T1A7D2E1B3D3BBD735C8F5C4F11C126600F9B9201197A756AB18CDE67EDE421C81C60EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879082, "uuid": "7ffad75e-3cd0-42aa-99be-8b89caf693fa", "value": "768:8YSoXdJZWvSPZsftIkQJ7dUcrzrsEsDTvyvkrSx0sK:8YJdJZgSGRQJ7dUcLs9/vCtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698879082, "uuid": "2e1dc299-a22d-40d5-8189-81bff2b0daa7", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698879082, "uuid": "df9e42aa-2e7f-440c-b506-89df50afaa9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698879082, "uuid": "cadc834e-61c8-4af4-b6fd-0a9cebcc5d5c", "value": "21fc3f751fc3c484ccd09fe0509d9624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4dca04-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698833551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833551, "uuid": "94a0b005-8c71-425e-be0d-2b269f1c1097", "comment": "Malware payload (Formbook)", "value": "e96dfc51b8afa59e571e6b94a2531516", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833551, "uuid": "3a1810d8-f57f-458b-9f86-035ffdddcaa6", "comment": "Malware payload (Formbook)", "value": "ef91e73b9aacfd7d3270f6b34dfa4ed95b6895c229e4cfb743174c2dc6c1c404", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833551, "uuid": "bf1a613a-39f5-4880-aa8b-ee64103a3b10", "comment": "Malware payload (Formbook)", "value": "5d5fabf79812d89363e457a87316ffc143f3dbe6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833551, "uuid": "2280904e-eb24-4572-898f-b57246146e22", "comment": "Malware payload (Formbook)", "value": "404875147575d0286355f7a8b5e599e28738d10e20daebb27054fb5c9f73b40a0fa2ed96585e3bb1b65b82121509c134", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833551, "uuid": "85c8b09f-03e0-4e11-afb3-b81894364c51", "value": "T1D6E4334E64A50E1BA1470B97AA3F1727C9C670C63EA5C5137DED268FB231C90AF6C06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833551, "uuid": "b0d57789-144f-4130-a3e9-96bb8ec85537", "value": "12288:CrvC5xy0qs/VuawvJNVZybRCSk81MpNgfZGnETL69SMMan60ZuF:C2x3/kaGVZybyNghmSUSMK0ZuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833551, "uuid": "ca84c97d-d85a-4d08-90a8-03e068de9b0f", "value": 715958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833551, "uuid": "2f78ae4b-e2a6-4d63-8ecc-ba5d8731a9c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833551, "uuid": "001944bd-a0d4-410a-ae82-1af4c342c7d3", "value": "Order requirement, specifications and company inof+project drawing.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6265ba3-789e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833328, "uuid": "ec646594-df9d-435d-96a9-7ea26f6d3fd3", "comment": "Malware payload (AgentTesla)", "value": "df8092756d55fb925b3106413c46a068", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833328, "uuid": "3e7f7480-52d6-4a5d-93c7-6b5da051299e", "comment": "Malware payload (AgentTesla)", "value": "f0d15ca2204276e1ecc9825187821c26913b228544dd9e53ae73b9b9fb7ce333", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833328, "uuid": "fb32addb-45d6-48df-bcdc-3fc0ace74ec8", "comment": "Malware payload (AgentTesla)", "value": "7812cb6f8db437bd7b3caeac8040f18e467b8812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833328, "uuid": "a85fc4a2-a49e-434c-a9d4-b00edac5b00f", "comment": "Malware payload (AgentTesla)", "value": "61cda22786d1564be6ec8cb576423ac170ced8abffe5c5aea9ad3e509c7d2a6244609037ec4f5f4f7abac228655863ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833328, "uuid": "dcd74e51-704e-463c-a8ad-2b7d2a4a7293", "value": "T160E4239C7BE992EFDDD174EFA8E11F0678E07A021ADA8B9E937F0211446C50194CFC65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833328, "uuid": "8cce2a8b-145b-48ca-b79e-e2c3f268889c", "value": "12288:187uMe8GDLFaUVKzzGCmbjHamgxxNf1L2K2/tPAD1lFRpYKzN+CleUG4hCxCjdrb:198GD5qzGZbjwRR2/tPaXRBLe2gxC1ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833328, "uuid": "593f195d-3fba-440e-a47d-110e37542863", "value": 718067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833328, "uuid": "0e6c3eeb-5e1f-4fdb-8765-23419f423447", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833328, "uuid": "bbae744e-bd71-48a7-b961-4d5d2ffbaac6", "value": "REMITTANCE COPY 0020200244442023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e086e81-7907-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698878331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878331, "uuid": "d40922d9-2899-4d31-add7-2c3e53734300", "comment": "Malware payload", "value": "a76ffdf933d89b9e79ce8646ace0eee1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878331, "uuid": "8a2c578c-60c1-4718-bceb-f1c45ecf4a95", "comment": "Malware payload", "value": "f0e0f65fa0bb474a626664c745ee65441ec9839be6a53dbf44261d975fa5f569", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878331, "uuid": "1be0f4c5-de9e-41e3-9cd4-8f959fb8f973", "comment": "Malware payload", "value": "2579464ce73fb12df0a5b0b45110b0c4f7d4888f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698878331, "uuid": "6aaabf9e-6dd1-4f88-b0d3-c7e069dc4f23", "comment": "Malware payload", "value": "ace29c4f79f4531c25abbf64254a5146c382b50018b506584f1f63b791c254eef4ad9db38a6e78d99e506b9de6ef4559", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878331, "uuid": "c981e2ed-4580-4cec-ab02-a304e735b27c", "value": "T11A373386F3E2AD1FCCBB95320BAA422A53615F53C853D7474865321D6C732D80FAABD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878331, "uuid": "e6f5228f-a61a-4a18-aca0-bd4083034372", "value": "393216:5vI8XVBpFe0Yk4xZ5xAGPsIreR6Nhr8XH4ZuUj0t7bpIf7LuhJvCBeF5QSpINAFj:5IiBpU/ZMGP3LNh4X4uUC7bpS7aHsAFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698878331, "uuid": "1cda2174-fb64-47c1-9feb-67c93235c449", "value": 24205421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698878331, "uuid": "2b4ab2bb-b674-462b-a157-bf720c98fd20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698878331, "uuid": "bdbef4ec-33e7-4c8b-98dd-f5b4641786e6", "value": "\u0412\u0422\u0411 \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35288dab-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819824, "uuid": "06f551ab-d1b7-4872-a757-f4b9e0e2413d", "comment": "Malware payload", "value": "929029d64ee736519448e58d52073d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819824, "uuid": "8ff270f8-e16a-4df2-8532-be503325e824", "comment": "Malware payload", "value": "f1bf796df709cd758ec1eea56748f53c707aac20a9131906c7357534c86000b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819824, "uuid": "c4cb3c6c-3704-493f-976a-7cad95fb80da", "comment": "Malware payload", "value": "905027716fb0558533113a0f183c620995243188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819824, "uuid": "6f77bdea-1230-4b50-a15b-a6826e3bfbdf", "comment": "Malware payload", "value": "70b364bfa566f64cda948b4cf3406a68fec1791ae9e0ea31b6e8f60f8bb5dcadfe0c5aa06d2708271a980d93b9e8c6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819824, "uuid": "8bcb521a-9de7-41d1-81f5-95ad8123c7b8", "value": "T15B63392668435419C9D47BF829F091566A357FD10123C18BA8FDBE2ADFB2303DEC52AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819824, "uuid": "2ad44b68-fccb-42b9-8f34-7a8226411c1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819824, "uuid": "43a8d02d-8f71-48fa-acdd-21d766c177c3", "value": "768:nTrbOKAk2GyqxlmMwCK/3deVDFxEpYiTPxdF8oYi5F943hh:nTrbGq630VDF67TPxdF8o75F943hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819824, "uuid": "fba5efed-7f40-45ac-9c46-717ddc6ff894", "value": 68168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819824, "uuid": "742a4b98-442b-453d-a4af-dc755981be22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819824, "uuid": "d97b7fb2-cb20-4b83-ad3c-19ec4f67ba9b", "value": "Quotation COB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce547389-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698821369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821369, "uuid": "375a9f07-28f4-478d-8079-a4b12dadb825", "comment": "Malware payload (AgentTesla)", "value": "e982da30c945c3d337fbc179a8dc4b50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821369, "uuid": "f46698e9-3268-4e27-a3f1-0831250e23b8", "comment": "Malware payload (AgentTesla)", "value": "f1ff3671c84b073f77c786da2c09f4ad2de52cb37dc60806ce52254b3d6929c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821369, "uuid": "8473789b-639d-4d6c-995a-b273b73777d7", "comment": "Malware payload (AgentTesla)", "value": "694161b819d8b78eba1cc58b90398a11ff9ca940", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821369, "uuid": "090ae383-bdcc-4c21-80c7-7e291ccd97b6", "comment": "Malware payload (AgentTesla)", "value": "116bd1669c25a227f5fa4fad8fc6bf3e008076f09820bfb651b73b3998f35116ec3f483cdcae542fbec015559341ff0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821369, "uuid": "55561ee0-8deb-48e0-8d84-4f8fa4a8416e", "value": "T18CD4231461ACFB76FE2C83FC76781980437248AAB147E59C5CE771C6A967FE84121B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821369, "uuid": "d8d43758-4449-4c06-89a9-6c60d92afb59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821369, "uuid": "6c95c110-0d11-4ffa-b3cb-580675ccbc88", "value": "12288:dLptoasPbcezDtsbsFnedIxoBILkT5EgPF9gCaURBt/T5fw:xpgPbcePibsleUV2igPFTRf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821369, "uuid": "b78cd344-1bb0-4f54-8cc7-edbf351ebd9e", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821369, "uuid": "0da8e15f-8876-4778-9370-f4b904764cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821369, "uuid": "18c5c771-82d5-418c-936d-6053b28e3d5d", "value": "Dekont,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2258fd64-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698833536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833536, "uuid": "339195f3-fa53-433e-94fb-ef5a1f3dedb8", "comment": "Malware payload (Formbook)", "value": "c17272c9f831d37a766c304fe2911f39", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833536, "uuid": "c21cf58d-edbf-446c-b963-8a66c7c52ae0", "comment": "Malware payload (Formbook)", "value": "f2db0a0e86c87c77a681c022267cfa3231db6be9ecb6e74bac99f52ab5ecd89d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833536, "uuid": "656eb6a9-4aad-4511-ba22-99705b4d92f8", "comment": "Malware payload (Formbook)", "value": "306327a107d719821e097177fd6b57f9b105e4d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833536, "uuid": "805673f5-3c1c-43ba-add0-2c25ea8013da", "comment": "Malware payload (Formbook)", "value": "586886a52909aaba258d633d599656e0c6f152842a94c2bbb40799dd2210c8848effcb34da1c28531460bb84287a62df", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833536, "uuid": "1b23ad20-6844-45ac-b238-e9bb87736656", "value": "T114D423D33B1D1A32BE268715A050BA6610C94CF4655F8EFACC81B18B3D7F19B856F187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833536, "uuid": "b2937f23-4897-4984-922b-e8e5a3bba899", "value": "12288:uDO+BNcDai8KW4Er5ezx9ugC9uog46hO2q0WvYoHmo82vVHB2Gya5:uDO+zZfKW4YwpC9uog469qBvRHf/VHwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833536, "uuid": "cd8abe30-99d3-4857-916f-587c442f2b88", "value": 604103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833536, "uuid": "765a588a-9ddd-4435-9288-e6f9ae7d7102", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833536, "uuid": "a68b4311-5928-4fc9-a2f9-c055f5376782", "value": "FedEx_817434848264_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caac54f2-78b7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698844126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844126, "uuid": "c868e19b-0c44-46f6-b514-ee1fa95296a1", "comment": "Malware payload (AgentTesla)", "value": "118090ee776424c6ff08ec26a98cb134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844126, "uuid": "eae46a65-c391-45d7-8997-2ea6d92b3955", "comment": "Malware payload (AgentTesla)", "value": "f2ef4aecdf3304be6f7f7b729eea019ae8af63befc4c0736e71c722c169e3eab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844126, "uuid": "64736b29-781b-485e-923e-a1e8d9136a57", "comment": "Malware payload (AgentTesla)", "value": "c76d5ace2a5c080c20dc43122f636088af8eaba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698844126, "uuid": "a5e9926c-9547-4c3f-a6fa-0c64b553c771", "comment": "Malware payload (AgentTesla)", "value": "f4341b9a66078d5a0e8807581c59e3afc694f65760145c22f63c5673b34a4b5d18aa17a52e4a6cf2b761da928d766d9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844126, "uuid": "814f23e9-ca39-41f1-a4f4-13c32fe4c3e1", "value": "T14A25F190F2F1F60EE5DA86BADE5057D46372A4237223C751CC40F6863C6E6D7DAC06A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844126, "uuid": "e5eed081-ef30-4008-be8e-1eb359a3d914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844126, "uuid": "31ed9dd0-b669-491c-8f83-1329cea3dfb8", "value": "24576:T5EACio/gqFU/OOq7r0iMGXwkvW8/ZozW+Q:g/4/tqD1gIWOZoa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698844126, "uuid": "258c11dd-04ef-4325-86aa-d4b4bb013f21", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698844126, "uuid": "4576d270-c855-4f65-8236-63c50d2ccc22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698844126, "uuid": "74c26691-773c-453a-a3c9-7ba5af03fd84", "value": "Shipping Documents 80053164992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701dc821-78d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698855571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855571, "uuid": "37f5c4ea-0365-461c-b1f0-98437def3d5b", "comment": "Malware payload (AgentTesla)", "value": "99d9512fc703dfd5ad80e4b4a693b185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855571, "uuid": "6d9f62ee-1f38-4931-8e1f-fc817a67f653", "comment": "Malware payload (AgentTesla)", "value": "f2ffd04416729f9c0ed76386b6548e3103e852a902af006310cf50fefb3bbfab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855571, "uuid": "3a2edefe-b7a6-4fd5-8ca4-c51054da1b85", "comment": "Malware payload (AgentTesla)", "value": "9b462edc2fd2578147569ac222cb15ab36e39602", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698855571, "uuid": "8073d525-51e4-43b5-9749-63cb3b91b5bd", "comment": "Malware payload (AgentTesla)", "value": "c179196b09beb085b7699e9a8a681ed8f5d61add61af1d055dd8d9a435a963eb48ba4b43c4646f758f0eab426a22555c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855571, "uuid": "c5f5dfda-9345-48f2-a09c-e54b5aa3e9dd", "value": "T17B25F12575E989E3D25908F3C9B07A0603BA9C160890D3DD6D8FB5F358BBBCA1609737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855571, "uuid": "18b507e5-f7f0-4b29-bf61-7b6a62566fbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855571, "uuid": "5e6987dc-924d-4889-acac-6e55799c5ef6", "value": "12288:y7Vvfqm2CDbk20lJnvtm0bvrKKpcubKu1Y85pSw2LXxwkz752ooahx70jEZKZbR:gqmFQL1m8GFS1/pSw2bKkAy70jEZKZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698855571, "uuid": "83ec4cde-e258-482c-8f15-7ea050c85c7f", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698855571, "uuid": "30f3066c-55d3-42c2-bc87-1fc5d8dc753d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698855571, "uuid": "ab5260d4-bdd5-42a7-a064-89113c5ab699", "value": "DHL_CBJ520818836689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab90f856-789e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833337, "uuid": "17f98114-3fd9-4338-8bf0-813c86881de8", "comment": "Malware payload (AgentTesla)", "value": "62307ee86b3aa47e9f7b845fb5d56902", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833337, "uuid": "c5c2c432-c99b-4730-8975-68beb29a9cbc", "comment": "Malware payload (AgentTesla)", "value": "f31bb7435b6f8828e77f9abcf151a84db7d2bf965443682f79e0e223be7c86ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833337, "uuid": "88fdaefb-69ed-4f9f-8cac-8933ce18f764", "comment": "Malware payload (AgentTesla)", "value": "a36eed15e18e8a1566ac48de03e24c0642b34cc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833337, "uuid": "f6287fee-a458-49c6-ad17-9df2669b712f", "comment": "Malware payload (AgentTesla)", "value": "cd389e0a78c7d6d15461eef7c87b13be93c07c9bf3aa1bc26507e32b2e5c178f2369b58d9a0c983e2fdcfdafb83825a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833337, "uuid": "da6f9252-3b6b-45fd-a555-8bc9a6fa69bb", "value": "T172F41200BAFE4B7AED75A3FA14A02A020FF1756B7166E7988ED770D35064F400A96F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833337, "uuid": "0fb76e83-d983-4453-9e1e-015fd6ca5cba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833337, "uuid": "725ede48-4365-453b-830b-2d6ba0b038bb", "value": "12288:eMuce8G9LFaUrKRHG9XjHkmgxxN57L20Y/tRmpBrfRfYKXN8GGyxrVDOrg4d/4WB:e58G95UHG9XjGhhY/tRebXd53Os4uW9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833337, "uuid": "6944feaf-9415-4a82-be71-1d62f8ccb4b1", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833337, "uuid": "8ea3359f-3407-4170-acea-859914fbd87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833337, "uuid": "e4cd6caf-1f7c-4269-90e7-b80421bb7b03", "value": "REMITTANCE COPY 0020200244442023.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd59a26-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698820080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820080, "uuid": "fdf18d49-ce32-4122-b9de-c32eac8e5466", "comment": "Malware payload (AgentTesla)", "value": "de556cae8d6a19e7418967a13890e79c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820080, "uuid": "b40849a1-4559-49c1-9576-e7c431f4cc89", "comment": "Malware payload (AgentTesla)", "value": "f3d9ef78a265814767c8834e41e6b47ca9f101e64eb2e279b245215c73ea6942", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820080, "uuid": "a8a004d3-4732-4e97-afb1-37ab2ada8cfc", "comment": "Malware payload (AgentTesla)", "value": "ba54be2d6d5bd99a11b25ef8a5946631a6792f58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698820080, "uuid": "bc06656f-7197-483a-9fff-6f759dd3b2fb", "comment": "Malware payload (AgentTesla)", "value": "fbaffacb0b3b447a055a54c3c92f905968e1fbd6b193261b9fb895d49303af100a14912bc152d82c74d2813d9f8c75e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820080, "uuid": "92969506-26ab-431b-985b-b929af7e6455", "value": "T139837D1677434711CAAE0AB0C0D7852407F1AB9F79B3CA8E368A17864F523C69B9D78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820080, "uuid": "d2ceab12-e912-47b8-9841-c09dea651840", "value": "1536:Up8kbXSn5/CJ4imyIzlVSCLzTvQdqCs/5c7yjLL7TPxdFP75Fbnd3hT5:9kbXsReqlvzEqn5CyXLfxvPXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698820080, "uuid": "cbb434be-b396-49de-9223-d9adbd391410", "value": 84032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698820080, "uuid": "f8d2f642-e966-4f75-a0b7-19dbac43c9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698820080, "uuid": "83604b93-e929-449e-86bd-854c587e018a", "value": "\u0391\u03c0\u03cc\u03b4\u03b5\u03b9\u03be\u03b7 \u03bc\u03b5\u03c4\u03b1\u03c6\u03bf\u03c1\u03ac\u03c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aff0a7d-78db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698859374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859374, "uuid": "c593e977-7f72-4888-956f-16198489ac55", "comment": "Malware payload", "value": "e39395fa7a94953e1951172dd508f652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859374, "uuid": "2721454f-2505-4fe3-9e1e-962daddeb1ad", "comment": "Malware payload", "value": "f3f6b4853f9cf04c2f9845f005f89a9e523b88a2595aae233cf6f51de7625d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859374, "uuid": "99e4b1d7-0677-4bef-885f-14b010591fd2", "comment": "Malware payload", "value": "bd0fa3180582e5c3eb1a690cfd19d646182c9283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698859374, "uuid": "b628e411-a885-40b4-94d1-e6a064c9cc7f", "comment": "Malware payload", "value": "906074091be76a68afa8b2d9e55426b371509366970e834dcfda56c48d39dd8560cee0f3f49ea626713d56edca1fda23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859374, "uuid": "b74bc49a-e0c8-4197-a43f-f814f1ce09d6", "value": "T160F48E02F7C784C6DED278B1197FE7126F2AE518532A44FBA3B45C334A51481AA2D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859374, "uuid": "826bfd8c-a8ae-4fbb-b44e-131c0da74215", "value": "12288:hPYU1gi0BQVKBOkTix6Bg4Y3GgZfLtFBV:d3iQMUd6e4YDTBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698859374, "uuid": "06777433-b1b5-4317-ad2a-818cd680edb2", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698859374, "uuid": "7100b5b8-b6f1-441c-a58d-636572b557c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698859374, "uuid": "54792d79-5378-4b68-9c41-ef3fcb96d1c6", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.10118.30349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4d7c93-78ce-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698854040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854040, "uuid": "b197889f-78cf-413f-a34d-ea9693f1dca0", "comment": "Malware payload (RemcosRAT)", "value": "dff58f37b27c0673bbd872958a5dc70c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854040, "uuid": "3bf02ef7-50e3-43ce-baeb-4c8d30d29ed7", "comment": "Malware payload (RemcosRAT)", "value": "f7a9768d3a5a59e38316dc5f4f7c1fa32454630fbf11322af88592970be4be6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854040, "uuid": "011b6006-4a74-4238-ab98-da70565bdf00", "comment": "Malware payload (RemcosRAT)", "value": "5a019f06c80d564d5693a9a5167d1031a277c626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698854040, "uuid": "0a8eb2eb-dc3f-4ca2-bedb-7973c272a977", "comment": "Malware payload (RemcosRAT)", "value": "844ec23760c821d1e33ba715f29c319bcb3e74ed3b72eab3cc7334d2bd30e7d22d37cc30a51dd3cb582b9e83a9941ae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854040, "uuid": "09916f3d-78c6-4a0c-a28e-9f01a3d0827c", "value": "T1F1C422D29A41D205EC9703338A7BC801525BFD45DC76630A62E9B90F6FB7289061BE7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854040, "uuid": "3a564132-b1b6-4b5d-bbfd-f0143badb479", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854040, "uuid": "81734214-69d9-4ce0-9805-04b6151050e4", "value": "12288:PtBUBo3prvTRP76tLPkpLpJzYHwqgWh4eWBrDqV5:ls6p3RO9kpHYQqd43W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698854040, "uuid": "645316cd-b45f-4b7c-a40f-ad2863fba02b", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698854040, "uuid": "cb43c4cb-b195-4d6b-a9ca-659d372eab8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698854040, "uuid": "1030ccfa-e8e5-4ab1-bab3-939d9decc818", "value": "Proof of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8de44f2-7889-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698824420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824420, "uuid": "8c57efbd-a2ef-4f80-bbd6-a3cd29fba4aa", "comment": "Malware payload (MarsStealer)", "value": "3dcbe51e08511a080c7e683afe877a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824420, "uuid": "20aca511-b891-4dc0-97b0-8d74af171bfa", "comment": "Malware payload (MarsStealer)", "value": "f84d3179e6b58dec9a4e2e862ef03a531330540e80e099f5c0d9ae54492f5e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824420, "uuid": "062497b8-b264-483c-b5e9-4a43a1822c1d", "comment": "Malware payload (MarsStealer)", "value": "2d3bcf63075632394806813fa3f6782677e362b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698824420, "uuid": "603bc03b-2144-4b4e-9d60-84958a990498", "comment": "Malware payload (MarsStealer)", "value": "bcd522f61feb06ceee3a8a31c9fece06e50dbe713bf7479464199fd49bcf5d2b46c6d5398594e9d37f20bc6e79e1cc4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824420, "uuid": "f98712f7-59cb-4de1-a2a0-fa8341576c4d", "value": "T1F0048E4363E17D54F9264B329E2ED1F4365EF5508EEA77EA32188A2F04B11F2C6A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824420, "uuid": "cd7e25ed-5bf4-429b-bc96-c86f7bf92482", "value": "a5438f0ec6476c16076f332fb0ef6961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824420, "uuid": "e41150da-e31b-4875-9acf-01b9f46ce399", "value": "1536:LcqEQMmoKSoeOWXCmiA9E3JdKVFylyC4EqqvsAkZOFID+Jr54cmeDn+W2SoGdpr3:LYQLYywE3/ZzaV1CIi5pD+cng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698824420, "uuid": "c267a50a-3104-4a3b-b695-956cca931a2a", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698824420, "uuid": "ce67400d-ae59-4e3b-958f-66b87eaa620e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698824420, "uuid": "5f9917e6-fc0e-4db0-a155-09fbeb4fba29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba2152b-787f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819915, "uuid": "b4fc0b25-b6d3-4689-8a8a-625e55fb2f0d", "comment": "Malware payload", "value": "776e0301c717068af0c56a3c63c2787a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819915, "uuid": "dfff9017-edf0-4abc-84f6-68eb84aae6f4", "comment": "Malware payload", "value": "f9139014a1a2421f9d1bc2dcc0f82d8e657709a94a21685c0460235876ed5370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819915, "uuid": "efc2bfed-cdf8-4e90-b7c7-570c5b44f922", "comment": "Malware payload", "value": "e517222052b239e6fd3d0e44aa65a66c4281eff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819915, "uuid": "3ca27941-ffb6-43c6-81ea-26f2ed25b296", "comment": "Malware payload", "value": "8381b7b8e89c101e86cf7208ae5c0a8341233b453de12a28739b058fd326840751ace4ca5080ab547d8e79ac375a07c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819915, "uuid": "44b04c76-f2b1-4464-aeb5-7c94c23bf23e", "value": "T17BD4EFCD6F00CE26C98172FD53A0680B0A696C613164C9099CF4F55667F2623EECEE9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819915, "uuid": "2019dc9c-573f-4273-bcd0-74cf6d6c96bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819915, "uuid": "f622c6dd-00b0-4f99-b552-093e0c90bedd", "value": "12288:1AiQygJlZz+uAvwdPCl6ZrBUPE4myW+ExqptMRs3uYFkgamgq7B:eJ7zUvsKl6MPJ0xgG4HtJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819915, "uuid": "e3a36198-8427-461d-8041-be3b6b17ba8c", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819915, "uuid": "2e4c784b-e664-48c1-b86d-fcd5e019dcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819915, "uuid": "fd86cb0d-02a7-43d7-b715-e40b20a9e03d", "value": "RTM00987890000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f085b9cc-788e-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698826581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826581, "uuid": "cabb6fbc-1527-448c-9e3d-58fe46d2081f", "comment": "Malware payload (Stealc)", "value": "339baa92ffd0862f293b195f550a16d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826581, "uuid": "5e489ecf-75ad-4ce3-8f5c-7ce58c8b6dbf", "comment": "Malware payload (Stealc)", "value": "f919263c6b7b515b8977d80260b204a581038a86e830203a95b671c0ab6db481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826581, "uuid": "e6f38a50-5325-4940-9a4d-0c40490a649d", "comment": "Malware payload (Stealc)", "value": "b92c736fe0affab827e4662ff78b78f013674c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698826581, "uuid": "31953dbf-35e7-4524-9cc1-be878f19d0f9", "comment": "Malware payload (Stealc)", "value": "79fade6484ff12d47a9de9194e96c91390cdda51871f1fe8870b7b8967073012ab03441db71d5f765530606ee322a16e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826581, "uuid": "534afca2-5a29-4319-b0d0-564254f50f23", "value": "T1E2047D0357E13D55FA224B325F2ED1E4361EF5608EEA7BEA32189A2F04B11F2D1A3751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826581, "uuid": "1c5d592e-cd06-49ee-aa17-08f4676b0626", "value": "a5438f0ec6476c16076f332fb0ef6961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826581, "uuid": "445db504-c86d-40e2-913b-687d16ce59cd", "value": "3072:+VQfoVQqgLMuVfB0dVCSICYIj7URcoK6gbd79A:LfoV8FHSxUB4bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698826581, "uuid": "9dfe3a49-61cd-4446-a303-d94f1bad5ad0", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698826581, "uuid": "1ed6c60f-9668-4778-9dc5-88a5b294dacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698826581, "uuid": "bfc47cd7-a216-4776-88f4-160ccb330f72", "value": "SecuriteInfo.com.Win32.RansomX-gen.7384.20031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22045009-7892-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698827952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827952, "uuid": "8631292f-44cc-4f8a-bb66-589b75ad7c35", "comment": "Malware payload (AgentTesla)", "value": "aa2b82b26d53bb6f4bfe0c0c2fce747d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827952, "uuid": "566506d7-40bb-46ac-8a32-21f9ab8146f5", "comment": "Malware payload (AgentTesla)", "value": "f9260f78d997498caf754ea330b45c98bb1f0b647c0d2d55d70966ba5e90a9b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827952, "uuid": "83deaa5c-b0b4-4f64-a49a-ed3eee55b0c4", "comment": "Malware payload (AgentTesla)", "value": "0fd26510e8e16c988ffa45986d407545d0255dc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698827952, "uuid": "5f69bd03-84f4-45e2-816a-75eaef12f4bc", "comment": "Malware payload (AgentTesla)", "value": "cace4fe7746cca2816df125d5c881597007bb7d93432b9147e208901dd9a7174813c9e993d7819a54ecb30456653ac97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827952, "uuid": "edf8d8f4-6d34-4bfe-8854-c5b2c9e1f359", "value": "T18F35BFFC76047DE6666F536BDA96ACDD03B626638ACBA4CC806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827952, "uuid": "27e309eb-e398-4fb8-a4f8-4b42e94bde96", "value": "24576:r4s9fubd+yTQCkiPs816fuHS5E7WWFrzRd7JD0S7iohJyIXo/nBokICmA5:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698827952, "uuid": "7d1578fc-2f48-4258-a85c-3297bb99c214", "value": 1117821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698827952, "uuid": "e96ee7f2-50a5-45ce-9a2e-17c8a8063fdb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698827952, "uuid": "127ac107-3799-440d-bd8e-d0cedba0134a", "value": "Inquiry-IND23072113.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ace4dc-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698833587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833587, "uuid": "7fb5adfe-ef0b-413d-903e-2d5cf930f39f", "comment": "Malware payload (AgentTesla)", "value": "18d136d65a9ba1d8819f9dd525b507b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833587, "uuid": "c87e199d-c09c-4f51-bef5-4318584ed289", "comment": "Malware payload (AgentTesla)", "value": "f965fd659332137f24a3d7d759470200d973e9f1e17bcbe4b54ac1a84904fab9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833587, "uuid": "fc5f644d-36b9-4a9d-9efa-6e7d843e531d", "comment": "Malware payload (AgentTesla)", "value": "095315780b4608aa3c2c998431be510a65bc8df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833587, "uuid": "6514b6a4-66d1-44a5-9a6d-13234fe1001e", "comment": "Malware payload (AgentTesla)", "value": "0da892156900869401a47d55af19a06cc8d3790171d5ad62e850bd8ce379f9d23d277a3368d08ff366c0aa200f70fd76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833587, "uuid": "ebd62a11-e57b-485d-8d7e-a9672873e811", "value": "T1AF55C003E940CB83D41C83F46EA34EE90B16BF04E9965ACF215ABF4F3E716621D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833587, "uuid": "0ab56163-5f69-4f33-b4fb-ef5b24407f84", "value": "24576:0uBSw6/uZyD3bV0w6/WZy43bVtEo84TA5YLp0JHOm9kyv0fLhedKwmx:v6/4K3bVH6/AP3bV7jTp9OHOmP8f97V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833587, "uuid": "11cb1d08-8abb-4f88-b4b3-03a27386b307", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833587, "uuid": "461e4dc1-43a5-43f3-8b9e-2ce1ccc078e6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833587, "uuid": "0b9b29d0-1b7d-44ef-b086-2168ce696fc7", "value": "SOA_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1026cb-787e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698819438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819438, "uuid": "96b2943d-40af-43bd-a4df-5c61265e1aa4", "comment": "Malware payload (PureCrypter)", "value": "38bdc4ca305647e6995230acc17e491a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819438, "uuid": "d162463c-b9fb-49cc-9fc2-0a40d0c021dc", "comment": "Malware payload (PureCrypter)", "value": "fa4b9d8fa484178ef2c8403160ba9afe1950abbf01b6aee0ed105cb2f7569063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819438, "uuid": "84a298b4-52f9-411b-bf3b-0d28ebdb244c", "comment": "Malware payload (PureCrypter)", "value": "a94f6b09b553926046109cb2ba184b34d9729716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819438, "uuid": "02739849-7da0-4696-a1d2-a6cd9f191505", "comment": "Malware payload (PureCrypter)", "value": "8c6816c5e85511fbe89b2b6e3df3734290c983c3c29d4d467c0f17e6ab71d17e44f23ab2e082b9ca0890eefeeed9f8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819438, "uuid": "c0d7a7a2-1ee0-4765-b4db-3de73b5738ca", "value": "T13B22391173AC1232DD624B7998F3571103B5FF45A8AB874E98C7B30A2F362828E11B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819438, "uuid": "ea0e7b27-d792-4373-a305-4b164899bb64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819438, "uuid": "ef25bc28-3a3e-4587-869b-e58a45073cad", "value": "96:CMkugg3d4zq3JBzu7d9rXV/bbfRZex8Gy2kO5UtrR0FXqN5dj7PqkhpV7VX9Y35m:VZNAq3rm9rF/bLTm89O5URQaKEOXLBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819438, "uuid": "77c8197c-16a1-4977-84db-6061f45c6561", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819438, "uuid": "1ae20085-78de-485d-aeb2-f5a734fd20d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819438, "uuid": "6cda6152-befd-4426-86f5-b080e1ab9d73", "value": "38bdc4ca305647e6995230acc17e491a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933350da-7882-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698821270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821270, "uuid": "173d395b-1568-44a1-82cd-383bd1437c2c", "comment": "Malware payload (GuLoader)", "value": "9885fc872331773b6748ed3886bc7957", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821270, "uuid": "3ba1714c-90b5-4c25-a388-f8dd0bc4298c", "comment": "Malware payload (GuLoader)", "value": "faa259f6938502626581cd6d770aa9a1f13c837c19e2d433b2eff805c1e100d4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821270, "uuid": "66c03764-ca2c-45a5-a59d-b28f7b533a03", "comment": "Malware payload (GuLoader)", "value": "71bc53359b1fed0f04c81324fce95aa1b7e000d8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698821270, "uuid": "7cdeac78-134e-4863-8c26-dd8c2ee29c8d", "comment": "Malware payload (GuLoader)", "value": "41c6d48b980728d110bf25ff2cea5b9fb5fcb14df84d1e597b2850dbfefee80eb2df3d8301f87375a4aad06b78f58ab4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821270, "uuid": "b43e2e81-4975-4f89-b849-63e7e7ceca47", "value": "T1C8337CA1EE950A1B0C4B3BCDDC424991C5BE801D09365165FFEB13EE920B59CE3BEB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821270, "uuid": "8a7de1e3-234d-4120-8c44-51c3ea985021", "value": "768:CV+v7O4wiyszD1F1Wa26Hsn3Fk8AUcgW5kZD9407ptajEEONE7kJC3t6AiFj0:Ay3Xz31J26H4Fk8w3mDL7mQNwkJBFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698821270, "uuid": "402818a4-8879-4b2c-ba29-3a85c69cd949", "value": 53238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698821270, "uuid": "3eac455b-cde9-4179-b34e-7e40b65f5a61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698821270, "uuid": "a03809f6-8333-4609-9f55-1e4b5764f1b0", "value": "RFQ20231031_Commercial list.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af9eac7-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698833524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833524, "uuid": "9a2f9f10-3204-4355-bed1-f1ca50d53598", "comment": "Malware payload (RemcosRAT)", "value": "3acf8beac0c0ec7eeed2e876cba735e2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833524, "uuid": "c4969571-19cb-42ed-9d52-442dfbdc89d0", "comment": "Malware payload (RemcosRAT)", "value": "fb3841c943c2a1202032e3282dc81283fbefec7911108515b76ab86c78cade4e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833524, "uuid": "94f70430-f1d1-4bf2-905f-cfbe79450669", "comment": "Malware payload (RemcosRAT)", "value": "65a1928b94cd0e5c647a1542888ae7f115878c51", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833524, "uuid": "1ba24417-51a8-4546-8185-70caf59b0404", "comment": "Malware payload (RemcosRAT)", "value": "1722a051a94c62036423767c0601481b755cdab35c175b50ce908d1e8d105e054f4358a1ea5960588a3d1efbd3b3ecab", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833524, "uuid": "bb3d302a-52d4-49f3-99d9-c81bf2267db5", "value": "T1B1453320776D40A54D978154B261B14EFD05AFB30BBFBB8CAC00156BFED2EAD248725B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833524, "uuid": "ce704830-94a8-495a-82f1-608d00012273", "value": "24576:hx8X7vC975n9f5WKUSV+Ci3wMlHAG53wRmLyVRnhCukR/e9LoD:hxH97/4N1twcWXkJ5ucD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833524, "uuid": "e2cf9e8d-22e6-477d-aa50-697d4d3906bb", "value": 1168326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833524, "uuid": "81fe5e0d-317c-4cf0-816b-e637d81175f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833524, "uuid": "16a466a4-7258-4d94-953c-3d93004b4f75", "value": "Annual Leave Application Approval-pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20819c18-789f-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698833533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833533, "uuid": "4e46bdd3-50ac-42b4-bf6d-5c2f17de6c07", "comment": "Malware payload (zgRAT)", "value": "964f380214c360157e592d1df460a9ae", "object_relation": "md5", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833533, "uuid": "93739a90-8db2-4091-a095-4b57aceea160", "comment": "Malware payload (zgRAT)", "value": "fca871cb8f6c11f34b4c1dad596f343413224710b1a7df4a435ed2f2cc5aa45b", "object_relation": "sha256", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833533, "uuid": "61dc4f4a-fcbc-4bc6-b6f9-9847cf35438f", "comment": "Malware payload (zgRAT)", "value": "88950f9e2d48012eaf85a8d0ebe1d04b0c627b12", "object_relation": "sha1", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698833533, "uuid": "9ac6fc2c-f2ef-45bd-b545-0653157907f9", "comment": "Malware payload (zgRAT)", "value": "a4a78b607647c566f0f749df1e3b74d49f78724866441ca7b0a1cba89c99dcb61d0cf854456e65aef44f721dd5db7833", "object_relation": "sha3-384", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833533, "uuid": "2666a8d9-7d07-48e5-b227-a7a6666a9be6", "value": "T10CD18F441AF395D7DE81E03789E4C0CCD6904BE5A887EE88E167826AB507BD7285231F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833533, "uuid": "dcfdc25a-3f47-43c0-b127-f2dadf149c35", "value": "192:u7UTP8823AxrobzWrk4HnjiS8KjawBOKvs9xtRF:3P8823G0b6r1HnjiSlaxcs9zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698833533, "uuid": "c5053a35-62d2-4e58-84c1-6ce1efada0a2", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698833533, "uuid": "d0c46819-76f4-42ca-a5be-a0c8154f6706", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698833533, "uuid": "6ed699ba-bbfb-48f4-a983-db93968a7771", "value": "documentosdhl080869.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b919c1c-787f-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698819942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819942, "uuid": "895cf797-c055-48bf-a9a6-e43c570f6a48", "comment": "Malware payload (DarkCloud)", "value": "f0dde554f33469b62af8ef8d9d55cbd6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819942, "uuid": "78b8d08f-d065-4d18-bfd2-a4f13867b558", "comment": "Malware payload (DarkCloud)", "value": "fd8fff6a5f07a9d3be875b4b4ca47c6682eb439343f53ce5fa357a81ba708056", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819942, "uuid": "7d4fc46a-a13a-480d-97a5-9d3b4d1135f6", "comment": "Malware payload (DarkCloud)", "value": "b25b7d6ece12c21f0eb8f4d56ce807253c73951d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819942, "uuid": "4e1b5b3b-202b-44f2-81ec-1a4ecac19098", "comment": "Malware payload (DarkCloud)", "value": "325d18ff4a5a7b911cdba9beb3d4d5f4383ab578ab8fa13fcfcdc14e8974e1929c9a4e505b48563891deb7d1e4ba13c7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819942, "uuid": "5fba427a-97dd-44eb-8f31-e2aac801195b", "value": "T128C4CEA0955D1D3FC8DB37F758A854A313367E7999A0830AA9F3F81536B1243DC83A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819942, "uuid": "6d2d4ca0-6bd2-4728-9cd4-4922bcab3fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819942, "uuid": "30683098-0a5b-45e8-9d72-1dacf2773c55", "value": "12288:wAiQy2fAq3jXO5UTE+T0bFZYpOGKlRMRbYCaYqSGQgqxk:fYqz1E+YxZ/RCR87rQbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819942, "uuid": "cd7215ea-d3fd-4248-b5e0-ffc197ca3799", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819942, "uuid": "3b8ab3cb-7691-4950-9930-aa5aa921c40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819942, "uuid": "646c3a17-704e-4787-ba71-f21ee726abb0", "value": "Qpo09345678909876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f296b55-788c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698825478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825478, "uuid": "7e13d3eb-49b7-4d31-92e7-3a4bc97c70cf", "comment": "Malware payload (AgentTesla)", "value": "dee08f52f06d7e90eeee214ae5c17dbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825478, "uuid": "b24dadf0-fded-4b00-897e-ee1036872e16", "comment": "Malware payload (AgentTesla)", "value": "fdc8016424063c4ad128cdf8b52b099774e2809b42d7700180bc77d0f8f9a424", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825478, "uuid": "6f42b49a-0020-4b4c-b40f-53fa76da68fe", "comment": "Malware payload (AgentTesla)", "value": "7ad503c828ce9c72c3e08b3c1e31ccc1350a3c5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698825478, "uuid": "39c95a5e-8886-42e3-aa2d-f713bffbc1f6", "comment": "Malware payload (AgentTesla)", "value": "730d319acd9db8913ee3fc467136aa625c3f86a28be0d9442137d4a7b445f509cd53621cce5592f350ef19b781f527df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825478, "uuid": "a7201429-623d-48f6-81f2-a718f4c7bfef", "value": "T1B1F423CF19CDAD1E7A715B14956718D1C0CFA4A936E2C8BCA3F725080F4981C6EB369E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825478, "uuid": "cbb90a82-f572-4350-917a-19f509a71a2e", "value": "12288:5s5uDNkySax7VgzhLXAgQ9dkfw8nZpXtj3s/sj28mO4mxfff37MREC2Ur/uAVaSs:mwmyRgztI0fftj3s/sqHO/xXfrMREC23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698825478, "uuid": "63dab73c-63b4-4421-8475-0b592a0d669a", "value": 780951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698825478, "uuid": "d2f38264-b87c-481a-bf91-04d5201f2367", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698825478, "uuid": "747975c1-82e6-41b3-8114-419a00ca4ddb", "value": "SHIPPING DOCUMENTS OCT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4daad2a7-787e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698819435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819435, "uuid": "346b9abc-29c4-4634-82ab-f29351d121d3", "comment": "Malware payload", "value": "b7ea7b46fcbcd8f7a24332b9579be46b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819435, "uuid": "c04e08c5-2ffc-48e5-9829-c75e99a1cd36", "comment": "Malware payload", "value": "fee6d649def7af0b2910b6220bcaa8181be8494201c81b1225d1eb66d7e1ca29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819435, "uuid": "71dc76f5-5f8b-4713-ab6d-0e64561c6bc8", "comment": "Malware payload", "value": "e59fb8a3a8169d3dc11c56806233b527dbb3cbc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698819435, "uuid": "6086529d-a5c7-40ed-b87b-f288b2d47828", "comment": "Malware payload", "value": "a6420de84f701a75673ac50560a1a321f1d7d30508ce1b72590043b66f3665c6a4d835f351df4ccc666dce1543e42f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819435, "uuid": "3a3b2a22-039a-4c3d-a287-203aaf844ed8", "value": "T153C4BF10DB41813AD8E240B785B3537EAB78AB31271521CBB3DD5E986B356E46F3128F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819435, "uuid": "91cfc8f5-230a-4522-89b3-44c1d50266f9", "value": "2dfa749f5b859c20a25d6a8a3fd9afcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819435, "uuid": "396f10f2-6796-4c48-949d-dcae550bc5c9", "value": "12288:Bzf1BiKDnXI7XOO9A3U7KchdIewtJnY1AhLNAkcWzeGea:BLep7XOOS3UjvIBYKhLNAkcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698819435, "uuid": "f3750a7d-3c79-4c70-81a9-355e9b7cadfb", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698819435, "uuid": "b610dcce-0fc4-4974-af94-fcdf64a4b6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698819435, "uuid": "24701e1e-1b8c-45b9-ac22-615d2868a73e", "value": "b7ea7b46fcbcd8f7a24332b9579be46b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }