{ "Event": { "published": true, "date": "2021-04-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-13", "timestamp": 1618358582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "726c6de7-a793-4474-be18-fbbab7469a71", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b44e82-9c07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618284145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618284145, "uuid": "c52ad6c1-2b1d-47f0-9106-ad2c926eecad", "comment": "Malware payload", "value": "ecf3673c54560da39aae929367d15b54", "object_relation": "md5", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618284145, "uuid": "32d53407-c176-4b75-83f7-5b752c33aa21", "comment": "Malware payload", "value": "00073f2eced586a25efba21226de1da97257160e178f4d996df3e89a8b741cce", "object_relation": "sha256", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618284145, "uuid": "9d652660-c9e1-417e-939f-0f7212886195", "comment": "Malware payload", "value": "7071a8246a9181497777a613064bbeff887782c9", "object_relation": "sha1", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618284145, "uuid": "04412296-6f4b-479c-8d91-0b25b637ad9e", "comment": "Malware payload", "value": "4eb0aa9e7cc89524416a8de8b2f1658dfdd54ef0f140ee0a255d6d364efebaad8f0280bdb6ddf16d710fb3ac8afdabe9", "object_relation": "sha3-384", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618284145, "uuid": "aca439d1-4887-4c9d-8e5d-bc3003b7e002", "value": "E9917DB197DD4CCDE8BA383FAA4E3F0D6AE0BDBF735484195107042B5484266684FE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618284145, "uuid": "9411fee9-8b11-41c3-9b5f-84cd4eaf3eaa", "value": "96:6bu1OeH6ZVo2+xP8/3zAxe2Gec9eSZDn3f4e6GHxItE10VjCGD:f1haZeZyjAcNYSZT4e6WatK0jCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618284145, "uuid": "4a09305c-077b-46e1-b544-a2f9544011f7", "value": 4589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618284145, "uuid": "05d2e45d-0e3f-4ae9-9761-ef3bc6822ba8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618284145, "uuid": "682adb4e-8c91-4f81-9dba-27d3ccfab852", "value": "10d2c.ps1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d62e15-9c6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1618328682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328682, "uuid": "f54b1b72-ca39-4f70-9d89-393e93881794", "comment": "Malware payload (Hancitor)", "value": "fb13d7a08e78af6060ca8cfcd436879f", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328682, "uuid": "2b3865ea-282d-4b69-8021-88a8b4904ed9", "comment": "Malware payload (Hancitor)", "value": "0029be753622f61dd9df4f42b41350d54b130f6dc50f8e73a2547aa461dcdbf6", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328682, "uuid": "b1d99b8b-bb2a-480e-806e-0b6aa398e674", "comment": "Malware payload (Hancitor)", "value": "97d2346b21edb3302aca4ff22473cb25bd7daf44", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328682, "uuid": "b58e0ac9-ce88-41db-9a3b-5883e479cf3f", "comment": "Malware payload (Hancitor)", "value": "970e71be55c37e4116398c3706c008feddf5b9e4c20bbda4ee8911936da05cf7d9e47bdc806c542796e195fbb79976a9", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328682, "uuid": "45a2c273-2bf2-4050-a87b-1674c376cd6d", "value": "2B45CE017881C03AD4B315354E7ED6E616AEBC204B3296EB73DC372E6E355F06E32666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328682, "uuid": "e41a3d40-e382-4aae-87e5-0080aba0f4ce", "value": "24576:RKEiZxl3A4yJJG2dPQQCthHmnllrPf6NdmwPf6rCQKkB:RKEGByvGOQQC/GnlcNdmwPfoCQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618328682, "uuid": "b217537a-185d-4315-ae24-0545b598c5b2", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618328682, "uuid": "a342ddd0-0e5f-4587-86b2-5a038aac3289", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328682, "uuid": "4987bd5a-e62b-461e-9bed-f737da5b2094", "value": "0413_7089427210993.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a8eb0c-9c48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618312142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312142, "uuid": "f1927d94-67c0-4a39-9a9a-4b5845f085b7", "comment": "Malware payload (Formbook)", "value": "2256ef146373ee3d4a7ba1f45ec6ab55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312142, "uuid": "c53a0e7d-745b-4f38-b198-af7b6af218e7", "comment": "Malware payload (Formbook)", "value": "02cb927832e2e509e2d7a576837e4721bbfb713dacbaa8f860c8a0b1421ae8a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312142, "uuid": "17f80fda-e711-48ee-95da-f92b90079122", "comment": "Malware payload (Formbook)", "value": "c42eea671dbfe020fcf585896d7d8b1a1aa869e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312142, "uuid": "0468615f-4f72-4102-904b-ca585aa1b147", "comment": "Malware payload (Formbook)", "value": "fd4981e9aa2a49d728633fa7312914f5e0553d58ea83b578b27e38037a80404048b9dcbcc9888b3f4cc401b9ebf666ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312142, "uuid": "bdb76c09-4cb5-4bdd-9418-1670af42f030", "value": "15A423D3F619F351AAD3DF942C637AB50D82FF905842D48981C11FAD42F0B8ABA52ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312142, "uuid": "51a2970f-679d-4a00-ad80-aa4baff83c32", "value": "12288:am2ObV23/czBSsqJ4rpxc/fBUzw8Rc+JE3uUPxkV9:am2EV23/8BqJ4rpxg4dRcyE+U+V9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618312142, "uuid": "1c8e5327-8ec2-45d5-92a1-0d4a78129f4f", "value": 487107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618312142, "uuid": "a87191cf-d25c-4b57-ab99-469b1a2044f7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312142, "uuid": "862144c6-9d6f-42a9-8fe9-2349424f701e", "value": "Statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad32aea-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618300337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300337, "uuid": "a7ce811e-b84c-4035-9152-86cc15abf22b", "comment": "Malware payload (Loki)", "value": "7166ec978025327fdb93b5b0d030da8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300337, "uuid": "86a92d12-61a9-4fbc-bcc8-ca44a5405dbc", "comment": "Malware payload (Loki)", "value": "0653b4192a31e1fa0a47a6cccc612fde7a7255aabdceaa9c6a0ac495c6a8c6ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300337, "uuid": "d40f26de-f25c-4350-907c-e89c67d1735c", "comment": "Malware payload (Loki)", "value": "699634e7a4829edf576d9333d495c74b8b37d009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300337, "uuid": "b12ae30f-031c-4593-89d1-a89ae97c2eaa", "comment": "Malware payload (Loki)", "value": "115f5e29eb914dd08a17cb5bfd2575094fe4fe7da441e327bc82f78622c14e53c1b82c8984370a125a79cdd2b6a96cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300337, "uuid": "9f026d68-7461-418b-a154-377e7441dae9", "value": "E545042C71049AD7C5AB03F6A32C4C0096F19D4EA6FBFA4DE8933CA6B6BD741B525443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300337, "uuid": "550e937d-813f-4cc2-a264-31d379a86893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300337, "uuid": "36d7be8a-cc06-4f55-964b-854035bcbe93", "value": "12288:Unbo4ONzzzwKhdh6QdSYUHxBTzNRaDdICLWEpk8x8bRKFV7omgSKmgw:Ubo4O15UHjzNRwfukeRUlnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300337, "uuid": "9a8ea0de-b039-4c27-960b-747c9bc475fd", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300337, "uuid": "455838b7-1b4e-4666-bacb-b97174f314f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300337, "uuid": "e057b835-dbb9-4bbd-bd4e-db534ff1e881", "value": "7166ec978025327fdb93b5b0d030da8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9bd3a1-9c20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618294813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294813, "uuid": "00e17c5b-779e-40a0-b10d-1de646fdf14a", "comment": "Malware payload (Formbook)", "value": "536460f36b2f586d54bce865ea14c564", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294813, "uuid": "2b58cbed-a514-44ea-8710-a4ff0cec283e", "comment": "Malware payload (Formbook)", "value": "067891a085c756cb42a25b5f44f4c70aada0387d45dd770f3fbd04eeb452e1c3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294813, "uuid": "c3d49b38-f5d7-4245-b629-35849ee6756c", "comment": "Malware payload (Formbook)", "value": "db10ddf659ebdb8a11bb44db50225160f710fa2d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294813, "uuid": "e7c23e64-bc74-4db4-98cb-35e39dc33cf0", "comment": "Malware payload (Formbook)", "value": "9641fc8960b5e4d9a3f92c628f21f936667d370d9910630ec7afcbfce0fbc627f58a273a53dae7f4491484147bf4b547", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294813, "uuid": "0e887ef7-a6a5-4c0a-94aa-da474eee9b33", "value": "31B423357DA7D7C81DDF16BCD9F032A8664F4708F9B225C122F58787C81AE43590A2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294813, "uuid": "77217435-4aca-481f-a4c3-c5ec4aafd181", "value": "12288:up6uysFVnNjb9kN3LbdsBmNJXzHIE/yi2SUh9DhDUEm:uFyqVnNjb9k8Bm7LIE/sSC9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618294813, "uuid": "3f3be5b0-bebc-49f3-8edf-4090abbf3d85", "value": 495656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618294813, "uuid": "c06c80af-4643-4529-91da-a440bed6c824", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294813, "uuid": "55017f74-741c-4d28-82d0-6175c9223521", "value": "Shipping documents doc 7z.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7512252-9c1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618292492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292492, "uuid": "86bec983-bad8-4364-844c-729647be276f", "comment": "Malware payload (Smoke Loader)", "value": "40f9df41effa8762858974452db083d9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292492, "uuid": "d075cd22-859c-40b8-8d9e-f21ab3a2c4ab", "comment": "Malware payload (Smoke Loader)", "value": "06b686985f4246819d7fed52a2b9fc1dbed7406d80f902d655866aed61392cbd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292492, "uuid": "a7eb7edb-2de5-40e3-9850-4f9fe3c7ec0c", "comment": "Malware payload (Smoke Loader)", "value": "fd382c2ae4ad3545b5d198d8c51735045584f8ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292492, "uuid": "8b452402-4fd7-499a-88f8-30b86b0ae023", "comment": "Malware payload (Smoke Loader)", "value": "7b5c532555778b5fa192bbf40eefcc732ebf9bf35966de840e82924da4d364cc448b0863b48aa03dba67979eb558ccd6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292492, "uuid": "e8198fe1-fe58-44cf-a278-6d4250922ef4", "value": "D4B5F1E873046CD6D919DFA25A5A79996023F43B78CD25C9F24BFFB1227F301DA1A840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292492, "uuid": "3c156367-84ca-4602-a4dd-976109cb1843", "value": "49152:EEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBWEBP:VBLBLBLBLBLBLBLBLBLBLBLBLBLBLBLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292492, "uuid": "074b321d-bbac-4a5c-bbdf-6e933c11160a", "value": 2314423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292492, "uuid": "cddac89f-e74b-4500-a4b5-a57c6d8222a7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292492, "uuid": "80203e48-f80d-4e12-a10c-462a8e04d765", "value": "2021lk049459.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7db52a-9c1d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618293627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293627, "uuid": "7f08da3e-fe69-4862-847e-604bd9441b3e", "comment": "Malware payload (Loki)", "value": "3e4e388e8f427c75b2e8657b15ce3867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293627, "uuid": "3f0c2a36-324e-4ca8-a43a-de2655b32d94", "comment": "Malware payload (Loki)", "value": "08a6cddadae4360e9315e163eb66ebacc6c7619a5b6cc20044e867b2a9638d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293627, "uuid": "cf5aef26-e81e-4f77-b7c4-0d07338af8d5", "comment": "Malware payload (Loki)", "value": "501be042a19eac737a86e448debe80a23bbdf78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293627, "uuid": "d2068cb0-56c2-479b-a355-3fef4d609c34", "comment": "Malware payload (Loki)", "value": "0c7a479e7980610ec1e5988587aa3128bbc953d39149a42dd1a36664373c16c4dcc3f78ddd5d42590fd4efa27b1dde40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293627, "uuid": "6e90b832-ee21-4753-b180-e366ebcb5737", "value": "84F4021C6398062BE43D64B18196B8401335123D3C52EBA8BC51F3DA67B5FC196A76FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293627, "uuid": "3d7a7b9b-78c1-43bf-a14d-91fe0626a273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293627, "uuid": "47df6837-b8fe-4b00-b38c-65af550c3591", "value": "12288:4a8Cym56W1i2iNZFhvqqLmJAngiOGJmjrgDI1o5cIAsj9uABmHvD7mKedjw1XAwt:8V1XFhv9nxOGJD8q5cIACmOd0m6gOzRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618293627, "uuid": "30ce3595-844e-48c4-b0c1-83d5c7ce8ca6", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618293627, "uuid": "352c6a33-f992-4275-aba8-db24b8abd5c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293627, "uuid": "98825aa2-5ace-4163-97f0-01238a88f977", "value": "DHL ReceiptAWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca92454f-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618292874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292874, "uuid": "0ff8011e-2ee0-4fa0-88bb-0d6154e53d92", "comment": "Malware payload (GuLoader)", "value": "f3dd3b4e92b3ad2319680b3a47b3cd7f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292874, "uuid": "4afa4f37-52a1-4909-9826-a91d14aaabe9", "comment": "Malware payload (GuLoader)", "value": "0a482ba55509a726553b330a4c2fd71e6142542ddff387c0c34700ea0835ef9b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292874, "uuid": "c11e46c3-b4ea-481f-824d-ee32111cbbe6", "comment": "Malware payload (GuLoader)", "value": "6bcfdfe7efb9c21b3898557daca099c4c95e1953", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292874, "uuid": "f80ff50a-fcd7-43f6-bf09-6183a6b24735", "comment": "Malware payload (GuLoader)", "value": "66041ef75040e51eb0113c85de6b7ecf4d132dd60cf7c68114bb63f36e9b298f5a2993e87676df651de6985e0bd9e606", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292874, "uuid": "99a5a25f-ecc7-4ca1-b880-5ab0daf48876", "value": "B613027E0542FB94158D594B2F66DF55AC2C00F58BA83AE77316B03F50CE0AE45B8F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292874, "uuid": "cc293abf-1bec-4f53-ae30-6b3d65f6aa8c", "value": "768:nz6FCcRHgPMh+snAEBkbqenAKxwh/xtAoA355S:nmFRHN+BgenTwpxWp5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292874, "uuid": "6cd729c2-cdaa-485f-a908-9c04cc923d8a", "value": 43502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292874, "uuid": "149e72d5-ed69-495b-80b1-328dbf99048f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292874, "uuid": "d254ac95-0f22-4a32-a3e9-5cbefdb94ccf", "value": "Factura 78689.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419e1f2f-9c40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618308535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308535, "uuid": "85d8bc36-a273-4ed0-bcac-9ac6c7f983d9", "comment": "Malware payload (Formbook)", "value": "8e1b6a25ae0d4a828f75eee61652ef80", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308535, "uuid": "b39fe8e7-5347-4699-9189-a56b8b9924e9", "comment": "Malware payload (Formbook)", "value": "0ac8d001eb184b01625a2c5aeece53a9b64b91782c4ed8862b20a6803204c229", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308535, "uuid": "2281cd38-dac6-4f31-a280-7ef9306738b2", "comment": "Malware payload (Formbook)", "value": "7c554de5a80b80dec376054a88adbe27749872cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308535, "uuid": "781d1c52-062d-42a9-b699-5d7b1fdfc89f", "comment": "Malware payload (Formbook)", "value": "1ff6c8b4b645edfa46a0be0c03ad98768b236c8c3932613f8aff65719c42320ff62f5fe6c93daae4e166834d3969d23b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308535, "uuid": "97177136-c79f-43cb-b793-beea8fda34c0", "value": "2E242205F3E6632963512A3C31BAFB43649C3477C3291AB4671B7537EA9F3259601D32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308535, "uuid": "0f685583-e770-47a0-9eb5-2755adeb06ff", "value": "6144:kfD2ZeP91dlzrXGm77tJS6vrSCuXPFHw4IG:mD4eP7Pz13SKrSdhBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618308535, "uuid": "6418b3d5-d2f1-4cc1-aa6c-c5690ee5ba1e", "value": 215458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618308535, "uuid": "4b75ec13-5f8d-4791-8e04-507ed1aa41a3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308535, "uuid": "313e4c21-4b9c-4e24-89a9-abe9df771375", "value": "PAYMENT CONFIRMATION.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f145126c-9c2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618301099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301099, "uuid": "14315c30-c6d3-46cd-aab5-d4bfec461e26", "comment": "Malware payload (Formbook)", "value": "dc8a2259a6b2075629f2f0d6a07cce78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301099, "uuid": "71e24e8a-74a6-455b-9059-74b51a6e292b", "comment": "Malware payload (Formbook)", "value": "0b29230d55e89c425c2d9d707a09a6de31ccf4b093f51f6ba1027f0edd313584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301099, "uuid": "ed4e3f53-f5c0-4c10-a816-1f161b4a903e", "comment": "Malware payload (Formbook)", "value": "3fadfe6cf18f9e65cd3d98d785abf7221ae4f77c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301099, "uuid": "18173559-f1e1-466e-80f8-c49c37cdbfaf", "comment": "Malware payload (Formbook)", "value": "8f6c75387d30839c1ca7eab9a18bb2923639d46db2d4c96d32b7ceb94e6a62399b0169ea96673715fd5e3459c67b9f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301099, "uuid": "dc8547de-b01e-4223-b4c7-e269b258f0b3", "value": "6E14122677E58D6BE6D31A3402DFDB1AC1B3B160142230970F309B7FEBA03929A9C557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301099, "uuid": "da037466-ecec-413f-877b-f1ac10a7cf98", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301099, "uuid": "e9a3f11d-ddef-4674-882c-9eaa87d02dd8", "value": "3072:HyewmN4skJ6rLPRC2xo+XOFWgIhK1bMcHLDkihoAf+sWyN0cubju3hHTKLG1kf:Hd1qit3hKucHvkihTNUbi3tKLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301099, "uuid": "a7bbd45a-6352-4002-b554-f9cb914b0aa2", "value": 206303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301099, "uuid": "fd313a36-5af4-406a-bf3e-bb7d186b23be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301099, "uuid": "e91dbcea-6baf-4a28-b4c5-fe1906b3b41e", "value": "dc8a2259a6b2075629f2f0d6a07cce78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beeeb2d-9c2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618298996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298996, "uuid": "2dce2d10-5cbf-46e4-a1fd-588cb2074515", "comment": "Malware payload (SnakeKeylogger)", "value": "0fea6d08b6066379e0ac6d4179102e73", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298996, "uuid": "f509437a-50ee-4908-9669-e767808799af", "comment": "Malware payload (SnakeKeylogger)", "value": "0c892077fca20f66ce0cafb7c4d0652ee5946cfc939ce83f10ce53ce9bd44a96", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298996, "uuid": "a80c7330-b135-455e-9d6a-9c4ff13cdefd", "comment": "Malware payload (SnakeKeylogger)", "value": "d2caee720818a5a469d26feb1e72512069cbf060", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298996, "uuid": "fac775c1-3685-4e19-851a-f7ad0d92ceaf", "comment": "Malware payload (SnakeKeylogger)", "value": "8b6981df7d95db3876d033794eedf135639216645796cd56ddf2040dcbfe353881d7dbd10c0a1c5c7ca25d88cb70b765", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298996, "uuid": "dc43a665-f832-4a1b-ba42-c9a6d573c1dd", "value": "38E423BCE1F239A2319847AF0B557A5F18640AD1BE19B19450DF831D36E80B4EFC897B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298996, "uuid": "d17ef0d1-fc90-46bd-8d41-a0960f8f702c", "value": "12288:DVH19Dus5/rXbZ1sUgRM3YhwETVmQeNC/blct9cSCeASBLZ7CqGwZPtn1VSYPd:DVrDuKDrLiRM3bETYVC/blfA/zCqDZPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618298996, "uuid": "5228ba08-e826-4d30-ad3d-26ad56ccc2a7", "value": 676831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618298996, "uuid": "f2339478-24db-4fd1-8301-44940419f7ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298996, "uuid": "7de19159-5b12-4ec2-b5c0-2c52e62afdd0", "value": "Consignment Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdd1cca-9c22-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618295965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295965, "uuid": "fa7222a4-16ce-4e97-8002-ac85c2ecd63e", "comment": "Malware payload (AgentTesla)", "value": "b1052f0803e90343a1e29329e29a8b73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295965, "uuid": "fbfb428a-3c8b-4f88-8720-2c60ba269a84", "comment": "Malware payload (AgentTesla)", "value": "0fe6a3e28a0358eb920d863b1d8b8875782ace887d8ae8ba8b3f1f72218ce47e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295965, "uuid": "c90f0868-ac91-4e32-8af3-4055bcb88ad3", "comment": "Malware payload (AgentTesla)", "value": "07f4c7cc77ec39583ee93d65a12ba17321a0e13f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295965, "uuid": "b803a40e-9e17-48e0-a252-32557fb2d319", "comment": "Malware payload (AgentTesla)", "value": "a9f44cdffe6c3a7c33671a677a7e3b4719eef194cf3ff63e8fca3938a8017bc39fa2eff2304b67c6b4f9294af145c9fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295965, "uuid": "e4f2f0ee-2972-41d6-9c31-f9970323c4c4", "value": "5DA4239274817ABBA63CB032DF6013DC73D1E090BC5689D1E53736071ABFA1A6D95E23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295965, "uuid": "7adfb4a0-3f1f-43e6-8f7c-6c3c3e6f55b8", "value": "12288:mL3PSxh7DMynOdTCQ0vLHhCE6mhnEDhkrmk/5re6kEoC+gM:mDkJYnEQ0vNn6Rhkrm05reDEV+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618295965, "uuid": "1678da5d-6851-4d78-9487-4086a284d6d9", "value": 462975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618295965, "uuid": "8ebb5f78-53b4-41c6-a0b8-48dd94f09386", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295965, "uuid": "98c99f91-e3b3-4c10-9e75-984428ddbd6e", "value": "PURCHASE-ORDER-2070121.PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a328ca-9c64-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618323902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323902, "uuid": "2fe7c95a-2b30-4ce5-bc19-0d91e1525b4f", "comment": "Malware payload", "value": "fe0da23536e8b520e123ee1d6e2187f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323902, "uuid": "264961a5-01a8-4726-9672-274f95fdf3b3", "comment": "Malware payload", "value": "105ec63230ab7f4eb3490c26500263d87acdcfa6b156a17609c463ce988a3c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323902, "uuid": "1e7402a5-7a72-4e1b-94bb-ccceb3ff01a2", "comment": "Malware payload", "value": "0033bb79ce490e215235d9253dc575215a09d8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323902, "uuid": "3507c1d0-9503-49c5-852c-cb1f566d84a7", "comment": "Malware payload", "value": "805e2d7f4ae78fa7afdaee84c4610f15f486b88500220a5d1dc98054b866006eef575f3eb3467c80b5a81c97a09cce51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323902, "uuid": "634975da-1582-4d0d-965e-ac89466389c9", "value": "99A3274AF8815B11D4D925BAFE0E128D335357BCE3EE7202DE249B2437CA96B0F7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323902, "uuid": "200fa5f9-f547-4a5a-9074-5d1dfe562788", "value": "3072:e0KoKfK57KpSKXKwXzqBdvMaYAe5c3PIbsrtP4JkVnWTvR:8ny5+H6ezqBNMare5c3Pus5/lW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618323902, "uuid": "4f601fb4-cb1d-454f-be7c-2782afa7b77f", "value": 104104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618323902, "uuid": "7cd45982-87dd-4556-9fa5-aa252b6765b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323902, "uuid": "988da123-9885-408b-b9e9-2b639aec65f1", "value": "fbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab17d843-9c46-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618311289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311289, "uuid": "b0d17181-a064-448e-a823-d25619a8d940", "comment": "Malware payload (AgentTesla)", "value": "d66654e085d1d20d1a87ba270b008f74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311289, "uuid": "9cf1cd1e-b143-4232-ba15-32476b1858ab", "comment": "Malware payload (AgentTesla)", "value": "11d9688a540d8ed80b9dbcd30a1067f98f2254e1c85911a459b757b7660053b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311289, "uuid": "7ce18922-87e3-497c-9ae2-6a824d37bc79", "comment": "Malware payload (AgentTesla)", "value": "d671f1fde6ed472117b5593958e09fb5715b3c7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311289, "uuid": "18c37a53-909b-4120-9f37-77f1d7799413", "comment": "Malware payload (AgentTesla)", "value": "71a4d9380ccd7df4fa159631267b4c478325d3c41e05e6668760bbced7e33a5afb2df871ae0a5a4fc50ceb788bc9130a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311289, "uuid": "50c9307c-bac1-48f8-9f6d-76d0ab628424", "value": "36F423AC815C295CC2C8C0B2B17A3FB797E497047B11AC4786F3666A627914DC0B7FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311289, "uuid": "11b15a92-e5f2-46ec-aca5-aaab27b40a7f", "value": "12288:bexI1BQML8c7EtNFBo2yWNlD9v1wu5z66YKFtRyZGYHWBiphai1g27ddI:UoBQSfYJjyslAu5z66HFezHjp4SjdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311289, "uuid": "58cb0265-0ca0-4d4a-bc52-cea2700b5be1", "value": 752722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311289, "uuid": "75b747c9-5633-466c-9bea-de23cdf4d179", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311289, "uuid": "9a785fb5-8e6a-493d-a7ba-15219eb160e3", "value": "DHL Delivery Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4707234e-9c48-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618311980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311980, "uuid": "631a66e5-2ee2-4bef-9bd6-85b9ba459af5", "comment": "Malware payload (AgentTesla)", "value": "65ba22e8c20d96fd3b3019102c93d898", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311980, "uuid": "ba23d8e1-c53f-4eb7-ac39-936712b8ba63", "comment": "Malware payload (AgentTesla)", "value": "1374869c60aed3ac4e36b96fc525bc5b1a02f1c51a1eba44cfb46ede8c9b676c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311980, "uuid": "31f471fe-e9a9-4e2b-a209-6f5873eb9912", "comment": "Malware payload (AgentTesla)", "value": "70da6a7e4cce9152821fb767f4ab5bc1a734bf72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311980, "uuid": "839792d3-6329-4b77-8bc5-d43233e52d85", "comment": "Malware payload (AgentTesla)", "value": "4e7f291cfc44ff80ab42a2db1131a4c3502a6df9f110d53ffe72d1f0fe0dedef950b473ca0b8c1a0bac062f6b7b1c14c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311980, "uuid": "6d39ccf7-0bfe-4e72-94e2-7fda7d7fc4bb", "value": "CB15CFAD365075DFC96BC972CAA81C64EA6074B7530BD203A04716ED9E0EA9BDF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311980, "uuid": "090d977c-1ce4-4899-99d3-946ece5cc3c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311980, "uuid": "55ce858a-08aa-4af3-81e1-91e083e1baa1", "value": "12288:fom0f25GetxCp4tVLLvJSzskgGv7g+TGsv5Df5Dh+5ks5saY+FmmsSLbcDZFdcre:04GeJbP1GTys1u5xLAZNcrjTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311980, "uuid": "feab461f-e048-497c-97f5-0a238b10b4a1", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311980, "uuid": "d9958e11-2f9a-4fba-9f47-cc34bf859436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311980, "uuid": "6dcc2def-7365-4636-81fc-72a33c47fbec", "value": "MT Stolt Perseverance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc043dc6-9c49-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618312606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312606, "uuid": "2024dafb-e11a-478c-8f81-fc9287b7f904", "comment": "Malware payload (RemcosRAT)", "value": "18f94106296f1ef173a670b2c833ec3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312606, "uuid": "0832d083-3935-4c67-b6f0-34266d100222", "comment": "Malware payload (RemcosRAT)", "value": "13d2043597d9277e97a4996c4f04266e462b4332a0df325417bf7ac578376c7c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312606, "uuid": "7c7e5262-5ca9-46ab-94f1-b333cb328045", "comment": "Malware payload (RemcosRAT)", "value": "d8f16cc20f6ccdee49271ac1640de89d0e795843", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312606, "uuid": "0833aa0a-df14-445c-8040-edaa2de2d65a", "comment": "Malware payload (RemcosRAT)", "value": "b69b9a36317299295a9927c0179e9dcca6c0c05d487f1ace7c302879c4047fd26cf90a6cd6749e7b6982498b662db112", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312606, "uuid": "1f7314ad-ac49-4aea-ae3f-55f012b24ebf", "value": "725423250A014BB3D1CD9FF2930BE37A4AE1E71148CC58B4B0998EE69C3DED9825DF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312606, "uuid": "868f97d1-2689-4f35-b185-caa8756ca866", "value": "6144:pmSgtinsL5VSvo0ZsyQqu1nCjHeV6KScBAvYKQJmSSyUdTE1wzLEnhB:pmSSin4ONZszxy+VQgKEpSyUZzLQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618312606, "uuid": "7019f859-5523-4b69-bcc8-4aef59d43b76", "value": 303945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618312606, "uuid": "12c6660c-0c85-4bbf-a803-45b93424ec85", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312606, "uuid": "4a5903f9-a98a-491e-96fa-3023ccc14e66", "value": "IMG-20210406-WA0004-55YH701.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bb08d3-9c3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618308086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308086, "uuid": "371bcf40-9423-42bb-9031-f56b38bfcf5c", "comment": "Malware payload (AgentTesla)", "value": "6707d619cee351401c61eddc03fe2c61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308086, "uuid": "3107d72e-0efc-450e-b6e0-3c788caac11f", "comment": "Malware payload (AgentTesla)", "value": "14de52bb38d53f186e241de9156d51feb9e2d032f48fedc777693463513d5199", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308086, "uuid": "0810f1b9-fa76-491e-ad88-d4846e0906a0", "comment": "Malware payload (AgentTesla)", "value": "4fc15487138bdef8a9baea10eed3e6efdaec2cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308086, "uuid": "ea2b647b-cb28-4d0c-99a4-882e2bdb357b", "comment": "Malware payload (AgentTesla)", "value": "7a42b54c53594f6f24e3f19db138ae251f1c993f953e86373cc691ae621c821808d903ec565bac89ac34279afff8a4ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308086, "uuid": "ddefb0ee-21c3-4f02-9f59-ed14c4e95dd6", "value": "F7E4E0E52A06E72CD96887754C8580F133E77C015ACACAD97CE03DADB57B352C2EE11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308086, "uuid": "0349edc5-dccf-435b-9803-acdf09a528cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308086, "uuid": "e0af71af-3c09-45c9-844e-d6b20bba39ac", "value": "12288:JA1z5YXa0MhgpnL19F2fTfz/HrqA/Qe4gNGXq8HYdqK2:MYhjvT2DbG6vAq8Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618308086, "uuid": "9b89a516-52a5-40a8-be87-5244a5bdadc6", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618308086, "uuid": "a82050fa-5689-446b-a8e9-45439beb4062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308086, "uuid": "ae516a29-60c3-4ab0-b878-fe89f0ca7a81", "value": "Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8505c8-9c87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618338994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338994, "uuid": "c955fc46-cb74-411c-955f-2dadc5f075dd", "comment": "Malware payload", "value": "d138effb5d830510eaf493eaba3ba912", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338994, "uuid": "37c41321-e768-4751-82e5-bbf9e7279e68", "comment": "Malware payload", "value": "151807491899be3374cd280331f4d7200f8a951c99b9c9c6d0641b919638f4a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338994, "uuid": "f1cb2f24-1d6c-42e3-90b4-a31a8357eb24", "comment": "Malware payload", "value": "91acc37cac952cf17f7e78959a334c84af05a60a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338994, "uuid": "27859481-4634-4fa7-9896-d9a264e355d3", "comment": "Malware payload", "value": "6713b5a5e2f3aa6f8875fa4a60f649d4940f000679fa3ef184d94bccdf6ad0849b34744de8fb302cea5d39852379a0b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338994, "uuid": "af3c86c1-e7e7-44f5-95ef-e384b87b1129", "value": "50634E1536E8E116D1251F328ECAD6F93738BD406F8A533B3264333F2E7B6A18A25754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338994, "uuid": "f7e50317-2841-4fdf-adf8-a8a041b6bc7e", "value": "384:lmM77FcYFEF+DzemBsCiECOWH0IT1Vq5nMF0ksk4WCclFo39D:tcYFxDyaiE4H0+AnMFH2cjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618338994, "uuid": "fb098a64-e063-4509-ad6e-0b8edf10cce2", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618338994, "uuid": "67963510-7c92-4897-8f21-932466e63c45", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338994, "uuid": "c59b2f35-cb8a-46e9-9be4-69e7f435ea72", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4194.14134.20968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d1cde1-9bf2-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618275100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618275100, "uuid": "fc6be333-fdf6-455e-b461-e8d06724eb3e", "comment": "Malware payload (RemcosRAT)", "value": "4a232c36d75cbaf2bd475a8bdb43487e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618275100, "uuid": "4698b823-f118-41bd-9955-9f0f9d750aff", "comment": "Malware payload (RemcosRAT)", "value": "16ef3e2b2df29116a45eb84d1910c372e2316c44ceb4c49931d9987465a5ed1a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618275100, "uuid": "162cbdc4-b498-4414-9e8e-f84e4165789f", "comment": "Malware payload (RemcosRAT)", "value": "6ae3800b2ed63e867785ab6149532c22128f7f4e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618275100, "uuid": "f20a8736-3b46-48dc-b228-8ebe28afc50d", "comment": "Malware payload (RemcosRAT)", "value": "13acb76f1200f2a2292048694fdc51d90f839623ce08782a973683d27db5ac4c9ae64168761a60c07951b0135caec7fc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618275100, "uuid": "155606dc-aab7-4775-b70f-eeb80cf2b4d6", "value": "30F4D02173E89B58F4BE9B751830918403F1FD4AEA31C60E7C95768D1D727828673BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618275100, "uuid": "f6477178-c3ad-492e-b4dd-b8f9532a99a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618275100, "uuid": "3f61844c-5877-4cd2-b3f3-ff50f900556a", "value": "12288:ajoCKbYt/bw4qyBs/mYNGj2Ff2RwOM3YaFoWoyVEQby1:PbAM4QHuaeoDo+EQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618275100, "uuid": "693ea6bc-2b83-42ed-9baf-74a125689e8a", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618275100, "uuid": "ca216eec-a748-40bb-9a6d-ed6fc6fd3acd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618275100, "uuid": "d9cf12fe-2e4e-4f2e-a2d3-bde5df39b50c", "value": "Presupuesto de orden urgente KTX88467638,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ffcfa1-9c48-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618311977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311977, "uuid": "f52832cf-0722-49c6-a4de-2c3411e0fed0", "comment": "Malware payload (AgentTesla)", "value": "3081c419553c00d0e987b5b51c68b9a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311977, "uuid": "8f734a00-3c10-4436-abb5-6b03f7a6ce71", "comment": "Malware payload (AgentTesla)", "value": "16f5e4fef1fc1a5e98117413cbe7bcc5400f6713e28167656fd9e0f5927340cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311977, "uuid": "27d8fc0c-d694-42b4-8893-9ff7e9d61ed3", "comment": "Malware payload (AgentTesla)", "value": "726842465d8317f99c4a7c77d9572565296362a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311977, "uuid": "93033374-4a39-433c-9314-163ca5766c50", "comment": "Malware payload (AgentTesla)", "value": "3a1668b60fa24f9df7ffae73b8559ca2d36888829734019fde8fb375a14a55bb8b52b3e16366614908a77b012af31cf6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311977, "uuid": "1612ca73-1a0d-42c0-95b6-15e6f7ed8f96", "value": "A5052322371180D23FF476F111ABEFD86FFCE6E2B059D86629C86AD59843227387452D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311977, "uuid": "ad1aae25-3952-4841-8cbd-d579b10ee996", "value": "12288:lhbo09Q5q8tfCpEtdPB5JSzS0wGH76+xGsv5FXJDhOXSe5sayIFm2sGRl7cD586Y:lhJGq8pHJzG9Usv45x5yL6WvkL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311977, "uuid": "286a972c-c0f1-4804-bed9-82f596171f92", "value": 797875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311977, "uuid": "96121606-f596-46f1-b59f-5c08632ed7f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311977, "uuid": "afcf57b0-efbf-437a-9382-fdafea0b3c01", "value": "MT Stolt Perseverance.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f785d4ec-9c63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618323873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323873, "uuid": "feddbea4-d61d-4807-8925-27d9bb1d7efe", "comment": "Malware payload", "value": "c0adbe650a376a66b39c1a1a3121f7f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323873, "uuid": "2fe4b690-5902-4487-94ea-27aedd937f73", "comment": "Malware payload", "value": "17f46a0f1c158305a3f674e0d9ade483cea22039a87ae4309ac4cfd2c74aa58f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323873, "uuid": "afa720cf-5fa7-4889-9781-98215821cc1b", "comment": "Malware payload", "value": "8776d977315638e72e65c8b58c39a8a1320ff7a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323873, "uuid": "317b6066-efa8-4e31-84d1-faef47fd6164", "comment": "Malware payload", "value": "c79841165110167f36472ef7b01e49d90dbd56a1ad08cadfd688f647d2a0d45ca22905fc049ea0d60fb1f241ae33d69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323873, "uuid": "10fd65de-91cc-435f-97ad-2c17faff7bb3", "value": "03537DC5E643C872FC5741F1087BE3766B33B077606AD597E3962A35EC22A80C6467AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323873, "uuid": "2a2c5403-c9aa-444c-953b-84b55616356b", "value": "1536:WdGbxeGllke0DPwi1cWKBzSlnTUcNS5N9wEoBWZ7QfII6puZkmBs0:5ewWcMlntNqN9wLMZ7QgXp+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618323873, "uuid": "998dbdba-5f2c-4e4d-a5bd-0ef68055d560", "value": 64304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618323873, "uuid": "e7694cf4-1762-4ef8-a68c-8e1f8f804f82", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323873, "uuid": "5531e629-64a9-470f-9b67-90834eaedccf", "value": "fbot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113aedbb-9c57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618318333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318333, "uuid": "65be3dd5-e829-4e24-8b1b-e5fc59a38457", "comment": "Malware payload (Gozi)", "value": "e65acd24dc678d8ecfb562232775ff88", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318333, "uuid": "cbfadf53-ca82-4745-90d2-cfe0b6835448", "comment": "Malware payload (Gozi)", "value": "18c06df2e7fdd0b8b415ca26118c846ba81a195add7eb23835d83fb8a65902eb", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318333, "uuid": "1d6f7023-6ca4-48f0-b753-cfd253f06a0a", "comment": "Malware payload (Gozi)", "value": "987343be0cf13aee3ac85269efee22649a00d7db", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318333, "uuid": "d32d7b65-6dcc-4e6e-b57c-07b0078cc165", "comment": "Malware payload (Gozi)", "value": "01a7a6776e34ea2709b93d26729318a216282593b3ec40e2096313bfc041887bae70e1e07eb299d14ca2ee3e16173a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318333, "uuid": "69dcec43-51b2-4ad5-94a4-926c30780fc4", "value": "ED245B6AA2E40195EDBBDAB5C992C61BE7F334051B28D70F13B0CAA56F57331F218352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318333, "uuid": "0fedf54b-25bd-4586-818c-24f734ee8685", "value": "3072:Lf0iSwbhJlRNAw4YboaEzitrOd9TRMm4hp1P1Pc3vrtzwrcGvjyKg5ksTSVl7:hSwbhZNzizeOd1VMp1NPAjtzGjsX0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618318333, "uuid": "100582bc-81bb-41eb-ae5e-f32a594aa2c9", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618318333, "uuid": "4c0e5605-6c32-4a10-aac0-3d4b7f550906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318333, "uuid": "c260d634-f882-41c8-9ae9-a25a40ffaaee", "value": "283700f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5281f05a-9c86-11eb-abe1-42010a9c0039", "comment": "Malware payload (Babuk)", "timestamp": 1618338628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338628, "uuid": "7df1ea33-bee4-4c20-affb-608377db9b18", "comment": "Malware payload (Babuk)", "value": "16c7212928b23a170cebb12935a933fa", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338628, "uuid": "af8153ec-ea81-4b8e-998b-9565c2e53796", "comment": "Malware payload (Babuk)", "value": "18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338628, "uuid": "1c862213-9940-4395-8e10-6b8219a0fd5e", "comment": "Malware payload (Babuk)", "value": "5d316698dfe20b8fcdc881dbf68632b13af11d0f", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338628, "uuid": "b29c4cba-d890-48b5-a2a0-dfa1c615408c", "comment": "Malware payload (Babuk)", "value": "56bb9be63e3586339ae6e83b8666a086b39ab82cdd4459b06bb754768b0de2fe18e11f5b0077425d3e3b527b86d901fd", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338628, "uuid": "807aad5c-c45b-468f-a552-b9f651544312", "value": "F483E8115D45D2B6C5D1723151A7F1AAC13A197003B5A38B63C027AEFB10AE8F6BCF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338628, "uuid": "3fb9d6d9-3727-4f98-a659-20959176715c", "value": "202fa14f574c71c2f95878e40a79322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338628, "uuid": "ab765686-aec5-416c-b79a-34267a37b6b2", "value": "1536:jpfS6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:jpfMhZ5YesrQLOJgY8Zp8LHD4XWaNH7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618338628, "uuid": "78741b6a-0a49-4066-9574-3d24dcc5ebcd", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618338628, "uuid": "5f25fe40-dd25-4450-9dec-fab8043a8214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338628, "uuid": "0efe63e5-0f1a-4b83-a691-acd62c257035", "value": "18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabfa660-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618300605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "cef35ffa-fe60-41fe-b128-0043f95faf2c", "comment": "Malware payload (Formbook)", "value": "ef334de5f1c39ddce8268ce33d9af5b0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "7daf34a3-9836-44af-ac6b-bf4b6fb52905", "comment": "Malware payload (Formbook)", "value": "18fd4f0598b5aa6605f07c17bcb9960a5543d0e321d78da70532ce67d7d0cd08", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "0d7f3faf-0118-4c31-81b9-771f6e53be80", "comment": "Malware payload (Formbook)", "value": "77d59a8b7a216e9cedfffc2ed94653a36f963e59", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "cc9a4c30-e434-4738-8a37-9565f50e012c", "comment": "Malware payload (Formbook)", "value": "d996b8e668d9630ac37b47f8c10c250f6dc8222bba16ed710a1fdd6bbae4a9cffd7669342260f63ca61f021e2ca79541", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300605, "uuid": "ae72e32b-a152-48a1-adb8-17d987450542", "value": "55E4231ED161370EC52E0EFBE2E79288857EFEE6755EAD42E04D92B0CD82102507C6F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300605, "uuid": "ea9afcbd-5035-437f-a317-99cd6406b2ed", "value": "12288:QDWwBpuSweu5LK6mWhTnLbputP7C+644fp3jtVr21RElkIjaydwbn1Z/AdvFTAFy:QDLMSwpR2cUK44fpztVrsRElJe9b/OFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300605, "uuid": "60c5f68a-88b5-47fe-aaa5-c42c55a90786", "value": 692360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300605, "uuid": "4e7ded65-530e-45a8-a638-74acdea0d5b0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300605, "uuid": "2249d8d6-7ff8-4b38-b559-feb37efe97b7", "value": "po.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd396f06-9cb0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618356846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356846, "uuid": "5d0e9dfa-498e-4146-abf3-a516d12ba91f", "comment": "Malware payload", "value": "fa5469956112b66b10a577038b7ab4be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356846, "uuid": "200c5ad4-9d92-4529-a371-57b900fa0f60", "comment": "Malware payload", "value": "19b52cda5fdb1671d604936ac1e01e326c6984210ec737cc91ea45c6ad3cbb47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356846, "uuid": "a38e1d88-432a-42b9-8de6-63c99c9c34c8", "comment": "Malware payload", "value": "31f852ce2647cf93283cc4b4e0c6bdaddf98898c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356846, "uuid": "7537aa25-20a4-40f7-82c5-a557760f3e10", "comment": "Malware payload", "value": "eb7a11f10a17a4ac07fc1e085e73adbfd239dc679311bc3ea2ad081e0b81b04583c5fb29929fdb479c06ff1fa952fb0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356846, "uuid": "bf0c3abe-d0aa-4b5f-b78f-9a9d7fb110a5", "value": "468423FD95CF21D59EDD2CB610833ACC325D4DDEB865A2DB3CC99B50AA2466306C9C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356846, "uuid": "b0ad37a8-1b1a-4af2-b5f2-b3948f34838f", "value": "12288:raSvEHW0X8PBTfDSTCunNESiSyiJbdgsGKtlRgpWB0fd:WHWQ8PpuTC6OMgsGKpovF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618356846, "uuid": "56326562-6480-43a9-bf64-dd07d15a0b3c", "value": 407438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618356846, "uuid": "2283dc19-abea-4e56-9ddb-eed7d7bd2b4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356846, "uuid": "9d425d9b-7023-4f2b-82ca-085ed1520609", "value": "Quotation AE2101137.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65270ee5-9c1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618294421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294421, "uuid": "adc7f9d3-6714-45fb-8b39-bafa5a660b07", "comment": "Malware payload", "value": "ee455e3bf008174dedac604b93bd6827", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294421, "uuid": "60d350ab-df9b-4c29-8b73-12dd539d4e73", "comment": "Malware payload", "value": "1ac067cb5bae3fe0c28915ba6a879636e6f75152111b20cfd0470b855cec047e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294421, "uuid": "be7689a1-e050-471c-811b-eb3b359caf0d", "comment": "Malware payload", "value": "12347a194adeca668cdcaeb9b707fd845ae3d3b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294421, "uuid": "a723d8f0-824c-47c3-978b-696746aa859c", "comment": "Malware payload", "value": "ed5a5e3f768da8d391cff32c9fa2d99ce10c4e337ba68974335870d1775ae5f9f0be9b5dc167875a69543b15c85dccc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294421, "uuid": "507230b7-764e-489b-860b-27d6b09b2843", "value": "8675315F30B7EA68CEF16A3463B642F10F2F5655EE650833F6F908BE8EA901211871D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294421, "uuid": "33cd96b5-f887-4f02-838c-c0c11e07776f", "value": "49152:aaAi0BA5wuLW3nB9gHKjErroPQxTjOkrc:/Ai0BA5wuLW3nBOHKjAroPQxTjOkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618294421, "uuid": "5687299d-3593-4051-b976-b12a3a083085", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618294421, "uuid": "30fd2ad9-192f-4189-8ba4-d9d8a99442e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294421, "uuid": "7f16f205-11bd-47e2-bec9-a2dcc7c0d2bb", "value": "OfficeReleaseFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4b9728-9c30-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618301624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301624, "uuid": "cc8b0e87-2a2d-4b55-9164-ac971ac13e84", "comment": "Malware payload (AgentTesla)", "value": "c204a3a88e5275de8f815921e287851f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301624, "uuid": "016398f4-1459-463a-9caa-2ca13e14cede", "comment": "Malware payload (AgentTesla)", "value": "1afd03b60a1b8ef6bc7a15e7ebab6c20a57004432b9d165c3b6bdabd2332a890", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301624, "uuid": "ceaa9e42-0c9e-489e-b136-5dda6de0bd52", "comment": "Malware payload (AgentTesla)", "value": "2ef049b549bfd1ad442e74982751ccf89360b026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301624, "uuid": "9d7ab04f-da4a-4d13-a2de-1b5a8138034b", "comment": "Malware payload (AgentTesla)", "value": "db2317c5aede3ae86840327c86b6aa308340ae121148c6ca03bb92f0aa3885b55fe39788d6ef1d1c9a2f73a0af007258", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301624, "uuid": "80c7669f-9c3c-4fa5-b2ae-eab54b1f41f1", "value": "D515CFAD765076DFC92BCC76CAA85C64EA20707B930BD203A05316AD9D0DA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301624, "uuid": "3659519a-ebe0-4a43-8af9-8f1ee9f4dbdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301624, "uuid": "a80c96ad-ea7b-47c3-8b9e-65e53f1ae0c3", "value": "12288:CxOalKA1qQttQCnz3W3cZ+fs3i/azeZifD65BkmNBPetV2esQH9ETAgf0sQ6ntBT:0DN/tQxcZ+ceZ2mvGk+9ETAgfZQoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301624, "uuid": "4a3a7dce-5053-47d4-8e35-7538b010f973", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301624, "uuid": "0840c7d5-9176-4bba-9305-65095697502b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301624, "uuid": "bc5b2d45-77c7-4d9c-a6ff-ea17946639a2", "value": "20211304-008936_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585ac32d-9c2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1618300842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300842, "uuid": "8b768a34-793a-491f-8d02-87e6628954f2", "comment": "Malware payload (CryptBot)", "value": "a108fca4217b9e6ae3a44bd312eb6009", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300842, "uuid": "7a252df6-54cd-41f0-a3d2-45321a127b1a", "comment": "Malware payload (CryptBot)", "value": "1b5e4b6d3d7e43bfc663ffc92778e7f107104e300d10b99c6f1dfc6171e835f6", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300842, "uuid": "3704f323-ce76-49e7-ab5d-bebfbe74ce2f", "comment": "Malware payload (CryptBot)", "value": "531ffd701a279fe372788a75927f1b1f91d01daa", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300842, "uuid": "4ec17e6b-ffbb-4bc1-892f-b6ef4ddceff1", "comment": "Malware payload (CryptBot)", "value": "03c54eb198e0fd50035cd31f1ece700dd8fe6a5b7c581f4d2220b1acf8a81af9eaef4a1888a4e074b6708beeb9e7d0ff", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300842, "uuid": "52dc21a5-e55c-4e89-885f-bc2cc55ba294", "value": "01E4011237D1C133E2A334364755CAB52AABB8725B264ACB7BC41B7D4F343E19A2570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300842, "uuid": "f51d7a2d-e345-4796-a6e3-8b0f2e70f4b1", "value": "75f5095e96ef29561ba3a46aa9d00439", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300842, "uuid": "3eb178a7-8648-4585-a436-40039759c01e", "value": "12288:GEleQ9DRO8g37GG83nTkFaKBI1ABkPNWhGoJ1FYQEV4jgfqIYzA/h:RndO8gLvknCrBx2P4hGoHEujgS0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300842, "uuid": "8d198d52-54ee-4842-bf4f-7cd199ded647", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300842, "uuid": "4c1ec38f-960d-41de-b2e8-b9b39d8b3cfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300842, "uuid": "5a89c77a-e123-4873-b84c-1f337399093c", "value": "a108fca4217b9e6ae3a44bd312eb6009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab67d16-9c19-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618291827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291827, "uuid": "17b64f0a-ace3-4ca1-8852-8bc3a8c44b14", "comment": "Malware payload (AsyncRAT)", "value": "c6ac4ad71174b253b36f16113ca50c83", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291827, "uuid": "1c18fa0c-fd92-41b3-b768-8c16b5ef4fe9", "comment": "Malware payload (AsyncRAT)", "value": "1dcf43f57f670d13db87c017c41b45c500385b2544789b89876b0f59c4bf7df4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291827, "uuid": "4fa8c8b0-d028-4533-a8bf-f123e1b050bb", "comment": "Malware payload (AsyncRAT)", "value": "c4a6a56fb3331c06e1c2aba8ef6f406663812292", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291827, "uuid": "1c93dffd-a19e-4b9d-9ecb-5ad8ec689104", "comment": "Malware payload (AsyncRAT)", "value": "549d5a7ac281942995aacf4ebaffb8ff2b7044545922f990c7ad2989ffa2e3ef77e2779854fc2ce6406785f68e9fb00d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291827, "uuid": "605a01e7-9d67-4774-b82a-e44f2c9d5961", "value": "C0332C007BE9C12BF17E4F7499F22245867BF9672603D54E2CC4629B4573FC28A429FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291827, "uuid": "5f5fbbf8-fca8-447c-b6ea-6181a947e142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291827, "uuid": "53bbbd5d-cec8-4218-a40e-f1e8df48a196", "value": "1536:5usG1Thsd2wQyALhlAbgOouw0YTMfydFg:5usqThsd2wJALhlAbgE0tbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618291827, "uuid": "c5fbc6c1-0f62-46c7-bae7-4e85efcee9fd", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618291827, "uuid": "f5cef054-e5b7-48a5-a9e1-3cab5846412b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291827, "uuid": "fd30baad-75fd-4c52-9e07-17fb97513e17", "value": "C6AC4AD71174B253B36F16113CA50C83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97716797-9ca0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618349911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349911, "uuid": "16f73c37-6c21-4303-a05c-3f90e07a41b7", "comment": "Malware payload", "value": "9019d1a1ac9ad9f0dbc1699c9e57c46e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349911, "uuid": "14e9c205-c478-454f-82cd-3df6227da4e2", "comment": "Malware payload", "value": "1dee59cf62b44cd513ab3ddf71998d6593fe955bb39839aa169d7838a36fa68e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349911, "uuid": "d8d7d50b-78f7-42e7-89c5-a72f6e57dcae", "comment": "Malware payload", "value": "98ac2909567f57bf0b023f131848808cabb094e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349911, "uuid": "80d1a29d-ab5d-4d89-b72f-bfc260aca85f", "comment": "Malware payload", "value": "528ec8b70c78fce983e26318696ab6075b228bf167d3f2760ab883bc11c4f287636a5f846e81591e02a3bbcb65675967", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349911, "uuid": "35122559-aea3-4811-9e90-e4941b5b6cfe", "value": "5BB174076B558CB7D35B42FC080F852DEB29A722E1660601BF448D0D1E56B83BC2BE92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349911, "uuid": "c5c0c204-07e7-4bd3-b2d6-f43d20e80d32", "value": "46e1bafa8de02cdeeed7aee385350cb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349911, "uuid": "6f572dd3-fb27-4352-87f5-d2c81fc97a1c", "value": "48:aPV1/AQJBxD6lXkuBhxJKaC/kaYSe/ka/GDyQETawf3Zy1QF51VD6l2RuqS:uZJBiDg3YSC/G8+wfZ4APel2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618349911, "uuid": "e6c307a4-96fe-4105-9901-4b1d2f1934db", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618349911, "uuid": "ee4dc075-4848-4b0a-b7ff-b5ab08754e42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349911, "uuid": "dd99ff52-50ec-4983-9c4d-f86a70362b0b", "value": "SecuriteInfo.com.Trojan.Loader.761.22154.9796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a876870-9c45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618310725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310725, "uuid": "631a1aa6-28a2-43a8-bc95-62d9ef8b5e2d", "comment": "Malware payload", "value": "3100fc6307bd5d1ac6dd1287429da190", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310725, "uuid": "ad6a012f-b8ae-4f1b-8fa0-f36b490960fe", "comment": "Malware payload", "value": "1e0683affe2511b252e570ea700820891cd62c85537f54d70b6880cd394721c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310725, "uuid": "17a92fee-5390-4133-85da-d58bf79413b9", "comment": "Malware payload", "value": "2a19b5e2f03c2fd01d1f0ff678f70821915e20f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310725, "uuid": "f669538a-43e8-484e-ac08-328606da6bbf", "comment": "Malware payload", "value": "3bd316badef85162ae83eef67394127dc176992ec96b0b4881e36c30ff9718a7c24a30c08e0348a8f709b07ac8fc1b1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310725, "uuid": "0d1b2ad6-51ad-44f7-abcc-0f27f0e5d53a", "value": "CAF4334B9C5D80244B8A47A5F06F6E7627E93639C0943DB18E8F30EFB6B3D1D509D294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310725, "uuid": "c27494bf-d454-4237-8d91-9b327f08ffa4", "value": "12288:/YXIJjWXL9L7Et9c+CkXoWuFgMb207ktQJ0oVi1TDWNVfov0Ap0XXPSMsyZZDYNT:ascLtAjc+CkXoWEgukmJDVi1cVAv0ygK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618310725, "uuid": "06ae04dd-9775-4584-b764-95d2db31615b", "value": 726993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618310725, "uuid": "035b3b6d-e794-4820-b95b-5ec50c43a976", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310725, "uuid": "b452bdfb-5fe7-40c7-8fce-dad2c1d1e639", "value": "DUBAI REGA PURCHASE LIST -2021.pdf.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a8133c-9c8d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618341640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341640, "uuid": "b4c492ce-29a7-42fe-bfbf-41dcc62d8849", "comment": "Malware payload", "value": "85ebc7f606033b79c690aa1549158fbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341640, "uuid": "330400b8-e5ff-4b86-8e71-2a0ee975e7e0", "comment": "Malware payload", "value": "1e2445485c42894a99be87ece8eaca0ec2751d5b8242ad5f512130b6ecf22790", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341640, "uuid": "69b04564-f59b-4059-b3c2-ef7a72fda798", "comment": "Malware payload", "value": "e1cb4d02e568fb35f8598b2dfe8df19ba0418e6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341640, "uuid": "dce8389d-3091-4a4d-a7e1-941f8efe47a3", "comment": "Malware payload", "value": "f5857f9fac717be8a23daff728c6f1ba7eab23b2b110914efe3d886438ec391e8758dce6a054340da787af8fb3b243fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618341640, "uuid": "2d9ba180-78d6-4edd-a1a3-0e346e118423", "value": "4E04123CD02A4959C2E5403BC8588546AC2A2123BDF865EE75987998FE237F31F6F784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618341640, "uuid": "ad9c6893-e10f-47fa-a0b0-c740a44bc079", "value": "3072:enGJLXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGE:enGJjE5SDvbXAyHbVt15wTQD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618341640, "uuid": "9624f0b1-45da-499d-ab39-e29f6d44d1b3", "value": 175247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618341640, "uuid": "b0a673ab-a33e-42b0-ad46-a102e114e3d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618341640, "uuid": "1764848e-edf9-4ba5-8f94-b3677fd7ce7f", "value": "malw.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3926b66-9c0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618285507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618285507, "uuid": "73824a55-c4ad-4408-8aa8-b5a16f04cf15", "comment": "Malware payload (Loki)", "value": "7d8fa31a52d1629e1357cf92d2c3a1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618285507, "uuid": "2a5158aa-31d8-433e-9b40-8bbe1c5116a9", "comment": "Malware payload (Loki)", "value": "1e316e0843104004ae2e64821a45a595d8b5d53c48a3b72eaf5dfdb1faa4f58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618285507, "uuid": "33bfaf6b-4364-4c9e-9588-310cb09b865b", "comment": "Malware payload (Loki)", "value": "1e4f895ec68f8ebd0e9d322a50da86156a87aac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618285507, "uuid": "f335c768-02ef-48e6-ac70-17464d798baf", "comment": "Malware payload (Loki)", "value": "20bca53abe59d8af400f28660c39552ea7bd410a1f04dea8d79c3156922516617971d1962ef17715bc35097ac977f37f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618285507, "uuid": "d12e9a3f-53fe-46b0-91ac-db49729be5bd", "value": "7D0539AE365072DFC85BCD72CAA81C64EB60747B830BD207A42716ED9A4D59BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618285507, "uuid": "dcbfea71-f789-452c-9280-47291b28b134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618285507, "uuid": "e9959cf0-3f3c-4e31-bfa5-6b69ba03a7c1", "value": "12288:3iwD+J5e9yfUJY+j9MWzMfKDhSYoREOCIP8BVLxc49G9K5C+YkoMjM0vI2q066f1:y4jyfEd9MRApWEIPsLr9Gwk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618285507, "uuid": "e1a9ca61-ccb8-4456-aad6-868942509961", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618285507, "uuid": "9aaca940-570e-4a89-8ca0-c233bdca1b6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618285507, "uuid": "40d0fa1b-7e62-484f-b237-cb469d21ffb3", "value": "VT-154-21-KHI ( 13-4-2021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb7c3ae-9c99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618347024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347024, "uuid": "afeb2433-02f0-4e52-b098-47bf23f43b12", "comment": "Malware payload (Loki)", "value": "bebf9fe03f112b3d56973f0dd4701848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347024, "uuid": "a963b95a-5ed8-4bd1-afc8-1b470e4a8b2f", "comment": "Malware payload (Loki)", "value": "1e6b26fdc09c75cc8fec8aad04012c705ae9a64018772cb38d0ae14dd6f72477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347024, "uuid": "af3e7915-daa2-41e3-8154-65882602d14e", "comment": "Malware payload (Loki)", "value": "3bd1dec5a13a4e6f0fa8c475b551f6ef542691d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347024, "uuid": "6a34eb5b-6c27-440b-bdf1-4c8ba0a1b7ec", "comment": "Malware payload (Loki)", "value": "be38fb3916c32e0d40833af7288251226f77f77b7565bdf7c3578a893fafb5e77a8a9856d1ac5f3607a05457d2bbed5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347024, "uuid": "f0e0c049-62fd-404d-bbbf-3d945ba648d5", "value": "3C35285D324077CFC867CE36CD64AD18EBA0746B570BD603A05722ED9A8EA97DF110E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347024, "uuid": "3d13dc26-195d-4e3e-9505-e993de9930df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347024, "uuid": "6ca61eb2-99b1-423b-aee0-011ce44bcb03", "value": "24576:s4h2zGHIkJXxMcY9ekQ80p0Q1clS3TIZ4x7WRNgVWfK0wd/Fk+:5hgGHIkJXxMcD9VSITm49WR6+wd9k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618347024, "uuid": "23944def-6a87-4bbe-afc6-7b44052be6d7", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618347024, "uuid": "ffaee2fe-f8e1-449d-aa9a-21d13b4b1b1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347024, "uuid": "44cb1b65-4f28-45b1-81de-cdd596e238a4", "value": "VT-154-21-KHI ( 14-4-2021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ac18b9-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618300536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300536, "uuid": "e9577ed4-3fdf-4a26-b8af-f3105e9ddb86", "comment": "Malware payload (AgentTesla)", "value": "b5cf7979d4da0ca245b6fdf87d65593a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300536, "uuid": "12b0ba80-0add-43db-95e7-0598228a012b", "comment": "Malware payload (AgentTesla)", "value": "1ea47052336cde8e7336e678acc989a3ad9a05301654cc380bf97f70f2b9d8aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300536, "uuid": "f917c28e-309e-4863-9e56-bab1e69e4072", "comment": "Malware payload (AgentTesla)", "value": "46581c30f7e5b420b18ff7c2ceadc4ccba948439", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300536, "uuid": "68d516b0-6574-48f5-95ce-f8af6ba8ac84", "comment": "Malware payload (AgentTesla)", "value": "07201d1b631f68964dce5372f2d1845f13ee9e0f8a86668d599fd913a0759b763b3d8dae7fe649aab3105fc6c54c449e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300536, "uuid": "0c561fcb-fb36-4287-a41f-8b4ab17196ca", "value": "A855262C31049AD3C6AB03F6A32C4C0096F19D4EA6FBF65DE8833DA6B6BD741B525153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300536, "uuid": "f58b0da3-cb6a-40f5-bcb4-09b5fb5ba604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300536, "uuid": "763498b1-7433-4c10-99a3-e3c8b1fb91da", "value": "12288:NdsE0NzzzkKhdcEhfoJzj9RVckn8U3RdQYhv8h4orWD+6a7omgSImgr:NKE0t8awJjHn8U3H9h8KoqalxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300536, "uuid": "a8a717e3-9f11-4ff5-8f12-e7f4db82b497", "value": 1324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300536, "uuid": "f67a2edf-f403-4a81-8170-f28551291e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300536, "uuid": "6960e22b-305c-46d5-9bb0-9f5b585cde38", "value": "b5cf7979d4da0ca245b6fdf87d65593a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff96c06-9c77-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1618332235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332235, "uuid": "4a3e8ff4-ffe9-4af8-809c-1623ef37fd12", "comment": "Malware payload (FormBook)", "value": "ad284445ea4c090b90b02c8fb9d5cedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332235, "uuid": "d3a31f1f-369a-4147-849a-2613208051a1", "comment": "Malware payload (FormBook)", "value": "1f5992fbc69275585f817e70e7c8766e6b7a03e1b17386de9b65de6d48ee852c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332235, "uuid": "e536b5ed-a4ef-4bb6-a731-967dfcce5b5a", "comment": "Malware payload (FormBook)", "value": "eea09937da17f884121b22c5131bf53109f64271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332235, "uuid": "93074eb2-e13b-4474-9d64-0a18817cfc51", "comment": "Malware payload (FormBook)", "value": "fa1f2ba5cf8cf034a3826569e498d07477641c2947a3d96c29b159ed6f03f3053860c939b61efdb6d586fb6b3572d087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332235, "uuid": "9fca139a-76ad-4184-9ad7-905b46c7cdf3", "value": "31E49D012308AF69F07DE775A4A5A400D7F1E407E36DEEAD7ED984CE05A5F11CBA2A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332235, "uuid": "0db263ab-5312-407c-ac98-4cb54b72e32e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332235, "uuid": "2d104d62-76ff-4e56-9945-2be4623c6e57", "value": "12288:rk0YGgWuxHP8wA2aVfKQWrYBNrBilmt86WFKv5Mw+MxWRZ0K:r6PdQfEkBuhFW7xW/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618332235, "uuid": "5935e553-5186-4685-b1a4-f97c7628ff30", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618332235, "uuid": "89edc2ff-b526-4d40-b526-b917e7a25c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332235, "uuid": "9e481b2c-1c2c-4983-87cd-0d8a7938f66f", "value": "Product List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b75d33f-9c55-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618317652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317652, "uuid": "5d11a0bf-49e9-4868-b61c-814b947a103d", "comment": "Malware payload", "value": "95d5537838b3abc1664476c106f4a62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317652, "uuid": "00d6070e-25f8-49a3-b4a8-ea12f365a630", "comment": "Malware payload", "value": "1fdc884013eb3c487174b1d0c5e6cc1d1f571fb25b45d6706a35f65513647296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317652, "uuid": "a8047bd0-2a85-4c3e-9313-9f440d6e1964", "comment": "Malware payload", "value": "2ff9c696f555fc6acb9efd90300bbe62d891e5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317652, "uuid": "1dc08435-06e9-4f41-9141-5802cda3bb61", "comment": "Malware payload", "value": "ab50d023a49ce47ed56b941851228c434a0edcccad5c18b23767ec416603efdc35566c3ad09c394d7dc20ee57b79ba34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317652, "uuid": "299f7130-a7fa-438c-ab2f-6e1502eb7f46", "value": "17E4D0E1261AE32CD968E779084441E233E37C0156DADBC57DD43E5F782B212C6EF2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317652, "uuid": "846d10ee-9319-415b-9226-b7ace858e501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317652, "uuid": "de8a8373-99c5-4852-8093-61d43f0b590f", "value": "12288:H8pQTWEuOzjH1Qyh5XNOzEGcYcrH3c+XiEoTIf68jn0tK:ceTYO9QyhPYcAoeMiMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317652, "uuid": "a6d2dac7-4139-4c6c-ae64-27def00f6a3e", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317652, "uuid": "2b8ba5e0-e887-413c-8074-e44c633073d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317652, "uuid": "33b5c3ea-7811-4457-863f-33b05a5763ad", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5365adbe-9c9e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618348938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348938, "uuid": "7dbddb03-47c6-4178-b5c3-c768845c67d2", "comment": "Malware payload", "value": "af05a8d9240939a5e1bb15011951de3f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348938, "uuid": "0fbdeeec-f2d6-4e30-97a5-dd28c96f31aa", "comment": "Malware payload", "value": "208df81449220c5b55744c392de567fba058df020e4a988a0d211580dad7e8b8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348938, "uuid": "3bd1ff0e-690f-4f44-aad6-3f6cb9c883bf", "comment": "Malware payload", "value": "3a0376dbac4945e49f12aeabe103d90795de1cd6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348938, "uuid": "c7c9530c-4918-4fc2-a04d-43bcf6c3e521", "comment": "Malware payload", "value": "20b2995678138efdf0d35810f873847dba8e70a6022423fbddf1476fecefcd11829081d4646b585499a50f1952a40944", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348938, "uuid": "5e04f9b4-14cb-4343-8f7e-e85daf11dcee", "value": "89F4237C27687093CB51AA478EF12D766201DDCD569392AFA46C9008C6DA2FFE7523C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348938, "uuid": "7de5d1d9-c832-48a8-8881-d6a659522e5c", "value": "12288:L9xItcF/uMurkLORfDbJsPN0lI/s8/Zhv/s5zPdWVqUHEaYpHBPWTaobGi6LD6rq:JxI1MGkLSPWPN0Ks8/ZV0V1AkPpHB+GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618348938, "uuid": "58d713bd-7581-4512-97f3-4dc7d6487450", "value": 731433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618348938, "uuid": "e3c32aa4-e1f4-4faa-ae3e-b1a423ee30ad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348938, "uuid": "e019b24f-5e12-4dba-a88f-2459efd1ccc6", "value": "Purchase Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d457711d-9c94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618344859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344859, "uuid": "4a52684c-26fd-4b57-83fc-0e0046bb75a0", "comment": "Malware payload (AgentTesla)", "value": "09ae9fda8fe2a5b51bd1e9b7a6603277", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344859, "uuid": "de220793-7b7b-4fe7-b7a7-2efd85ea0a62", "comment": "Malware payload (AgentTesla)", "value": "210626850228332defe5a26a843759cf4b5e5cd51d5b1000efd863b41aa094a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344859, "uuid": "f4954d1c-7e2f-4cf3-baf8-bd7a78dac809", "comment": "Malware payload (AgentTesla)", "value": "35116074cceaf474b9f5bcd460ad02a1e72949db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344859, "uuid": "9e1ddf1d-d953-4f67-bf5c-397b55c6558b", "comment": "Malware payload (AgentTesla)", "value": "f0f5bec11813e3f1f223dd4d2817e3b24dd5e54b151b35049049018bea3288204c9db19aad8b56cdfdecffe7f2502436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344859, "uuid": "dcacc555-0842-4059-aa2f-f5c6db990929", "value": "E2F423732C2A8B6D5362E7F7876F2793292B81132663B12301891F57094E9EA54FD3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344859, "uuid": "9953cbe7-9b38-427e-953c-eb6d86452e73", "value": "12288:2srHX1TpxOzT7cGSO/9KG2gnyr81SPpjQh6CeZ+u8X8mzjcxUKE/VyKNel4p:2sr39vODG6r9+jdCeZTmBUyeWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618344859, "uuid": "c5449129-7453-4fd0-b826-ab8d4d1c267b", "value": 734129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618344859, "uuid": "0eec11f9-6327-4182-adf3-161634781c25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344859, "uuid": "84322a1a-c002-4b97-9586-d9711bafa8d4", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84eb7ad4-9c32-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618302635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618302635, "uuid": "4c95924f-7669-4238-b6fe-0b5505074fc0", "comment": "Malware payload (AgentTesla)", "value": "d04a8791440086afc26dd9fbe4c29e17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618302635, "uuid": "be944cc1-08a6-4571-ab37-47d404a14f17", "comment": "Malware payload (AgentTesla)", "value": "21bc42c7f9bf5ceca873ce78ab74b8a0222d0d378904f505cd9c46f52adb3060", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618302635, "uuid": "ff9200d3-1a25-4abc-9e27-5466bd532dab", "comment": "Malware payload (AgentTesla)", "value": "d8b5a33d64bf9365ddf1bef7cdf9a2308039768d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618302635, "uuid": "4b646070-f8da-420e-8e55-d42f06589421", "comment": "Malware payload (AgentTesla)", "value": "543c85967296c2af0e5473ef96defae5d8cda156d2a0bee3c10b10381621b218edc6a08b001a1433c1639eacd278044c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618302635, "uuid": "961201ad-fc27-4cb5-9e38-be4ca536bdc0", "value": "E345395CB50486C3DDAB03F6A2294C0093F2BD5EA6FAF54DE8873CA676BB741B521443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618302635, "uuid": "46295bae-2bc7-48a0-88f2-da027774373c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618302635, "uuid": "d8070123-9602-4c12-9e00-5d40985577a7", "value": "12288:uRPqvNzzzQ4w6LX7ZtxDiql1w7hOEW2KddfQb2Ntyx8wKhdh6a7omgSh:uRqvGMXN5Twdwj3fQyNtyx8nPld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618302635, "uuid": "56645950-2a4f-488a-b320-7479d5de5d8a", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618302635, "uuid": "d5136fc9-a5ac-4b3f-a136-4083fcc7a6a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618302635, "uuid": "11095cb1-564c-4023-8184-05fcd32a6105", "value": "DUBAI REGA 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e8855d-9c2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618301273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301273, "uuid": "a70047fe-00e7-4471-953f-bca94663bf88", "comment": "Malware payload (Formbook)", "value": "8a9000a24cef76769a85053089698746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301273, "uuid": "60d3dc0f-7cef-486c-b4a1-96f8a052c736", "comment": "Malware payload (Formbook)", "value": "23937d5a0c43160688d1f164a4fa52d777661d61a00fdee79d96d8fbc25cac6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301273, "uuid": "6756e809-85fd-4a01-a309-fef4210be4c5", "comment": "Malware payload (Formbook)", "value": "f99387cd21cf808b3945bfa6fbf3219d026e5c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301273, "uuid": "adaf6ad0-0622-4cf4-b233-dab67a5974c3", "comment": "Malware payload (Formbook)", "value": "838443f95ed15e75526ef9d3438ea63e0ce6cc334f8affac66b9a28212284368d1cee24571165e8864ef1413cf81176b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301273, "uuid": "3213f341-4099-464f-b7cc-5faebb25e9c3", "value": "F8141217B6C1587BEB5BA2740C2B772BD777C1042013864F4B45BF6FF221683862B256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301273, "uuid": "eecf1cc6-b203-447d-afe1-f9b171939574", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301273, "uuid": "6ae61ef3-6fbc-48be-9046-ac5ab995347c", "value": "6144:HddBrjiUAbc7sP+LyGJK94SI1RfHRWKcy:nRdAbc7sWLBJK9eRpfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301273, "uuid": "c9dd9d13-ad5e-4648-b8d2-355bbdecb31b", "value": 206362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301273, "uuid": "46149335-eab5-4538-9279-e5b199feea7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301273, "uuid": "e45af1d5-a760-4d13-89cd-4ef7b309df2b", "value": "8a9000a24cef76769a85053089698746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d655482-9c19-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618291778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291778, "uuid": "09652034-5e46-4021-b39a-5b98295c481a", "comment": "Malware payload (AgentTesla)", "value": "48ba862fb2fe5608269fa9e510d285cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291778, "uuid": "634065ba-6834-41f2-8f87-4c063f4f0114", "comment": "Malware payload (AgentTesla)", "value": "24178fa3969b7256e53f2f77cc080cf5819fc303bbfa0f51ac97e7734beb5212", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291778, "uuid": "144dde6f-3c69-4bbb-b7a9-31f67635d3c9", "comment": "Malware payload (AgentTesla)", "value": "018ba770ed5e10039266079bc470ea97257dbfb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291778, "uuid": "b964004c-4ff9-42fe-838c-6ff2686f2069", "comment": "Malware payload (AgentTesla)", "value": "9ae247ac36ac29d32820117f0f1b0abcbf076deb00a93d5a80f7240ee6eed75e3768fe68a3bbf2032f878fdf731c5562", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291778, "uuid": "2907786a-8478-4199-8c8d-ed9392f5e68c", "value": "3005023923E4DD26C9BE5BB954E0921453B5F161AB33E30BA9AC20781F73BD1875B306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291778, "uuid": "e177cf12-4053-41d4-8f4f-26c27fe11572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291778, "uuid": "a59f823e-5774-4be4-80ab-08d6f52ebf1c", "value": "12288:kqR8Nf+5kyNnRSIstyOIVbBSWqqGG1vPY/8iiieXVRZYpvglgkCls56RHTXlLKY3:vzDs1cbB0a1ClOXVRCo+Q85wYWYTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618291778, "uuid": "1a6126a9-c203-466c-9183-478b047ed755", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618291778, "uuid": "ef7a8b1f-158e-4f1c-bf3f-ad8ef7fa995b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291778, "uuid": "47cf6035-cc0b-4faf-bd7b-012d50c36edd", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fdecad-9c67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618325533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325533, "uuid": "59f73af3-5a9a-4dcc-a27d-344f851053b9", "comment": "Malware payload (Gozi)", "value": "0761f317aa8b22a10bea8e02196d3034", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325533, "uuid": "0e0bf7e4-00bf-4220-bc65-74967e537ce5", "comment": "Malware payload (Gozi)", "value": "25331b3f761fac923a31166f0b6b3fe7241f6f0f92dcb0f5af6bba3449682b74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325533, "uuid": "67147035-5812-4645-8b5a-f0e89f680c08", "comment": "Malware payload (Gozi)", "value": "507ab5c17b2d0c9c2e5c2b4b8afa5804433df641", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325533, "uuid": "7b9a343a-4a3b-44b9-b8ad-865c1f9e09a8", "comment": "Malware payload (Gozi)", "value": "9c30bc00f3342a60e7dc10f0d89e3f80af91381592e9c6a65e55558846ff40cd1cec74be33e7d9959a9f1aafdd7b7386", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325533, "uuid": "cb95404c-14f6-4c42-b72a-ec775c05d830", "value": "AC948B117991C032D2622A348D79D6F649AE7D608D35498B73D83F7F3F72180AA34B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325533, "uuid": "d001716d-1d9b-4f32-a37f-53a84e11a0c6", "value": "cccbd047fbb954cdc0c8d4cab334424e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325533, "uuid": "f4b53cb1-289a-4937-a268-f2c63cf26bde", "value": "12288:XChk3gjWAgJHSZU4tFtjywyz+qbiHChX/:ShkQjkH9wyz+qWHChX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618325533, "uuid": "d985a597-fa16-44a3-b580-df49c53d8f85", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618325533, "uuid": "e175b493-f835-4297-9926-12922fc16e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325533, "uuid": "3eba0e8e-4146-4eb0-a9fa-29a169e7d610", "value": "pasteCounterArray.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a7daee-9c46-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618311245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311245, "uuid": "d475bbcd-b46a-4ddb-b8ec-17c79c3ec981", "comment": "Malware payload", "value": "280760187ce6b00655d97d375438a2e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311245, "uuid": "f2771e07-b512-4d49-96bb-6e797336869d", "comment": "Malware payload", "value": "263c008c85bef27e85bde7f29d5d9f82fbb11a185efd69d908392efe38327084", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311245, "uuid": "1f84cd51-d2cc-4cad-9d95-e5ebf6e5e115", "comment": "Malware payload", "value": "f86e71588446c83e6507c8739ecd902114ba796a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311245, "uuid": "d3118229-a1b8-48eb-8985-6070ddad4254", "comment": "Malware payload", "value": "9ac53e2ba4a879eca37ec31fd03e80251768f4eb6bfec2372df92d40e917d44d1af638673e3a3c9d8f654694729d3353", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311245, "uuid": "1cc4f564-ff23-48f8-87ec-60bda1b705a4", "value": "D11533B23705A84C82A0F4E67B1B34ED2694352E55432BF8CCEBB394930F19C666FD25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311245, "uuid": "8f106e53-ccda-4ed8-acdc-f3dcbfbf42a9", "value": "24576:4u2E/MIxg3GrU2aKge0nCo2vIOhx0Vecc4+:N2E0Ix+GuKgeeTWhx0jc4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311245, "uuid": "0903b552-2217-4e1e-b243-64733351c8d0", "value": 906877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311245, "uuid": "3a13cb2a-1492-46ca-bf2d-717b7388bf92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311245, "uuid": "4aea6702-9bcb-408d-9336-1c1c56bfe86b", "value": "SAI09000.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff617749-9c63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618323886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323886, "uuid": "9d4409b7-a9a3-4843-adc3-176c933f5421", "comment": "Malware payload", "value": "7fe5682c5a4505d2c24231e331fd4e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323886, "uuid": "b8ea6fb1-c108-4909-b6b7-80a1cf92223a", "comment": "Malware payload", "value": "267c4676e49346ae9fd8169c6f49643cddbf37d0af809b19044c4b5bf0fa55a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323886, "uuid": "431531c7-d7d2-49c2-948c-86f81e4fcb6e", "comment": "Malware payload", "value": "e9098c3531285c4cdd8693dbb29e0173de3a634a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323886, "uuid": "44cbf1eb-492e-4ec0-a240-1bb272ae1134", "comment": "Malware payload", "value": "ff154350213250e55a5da535fbd5a9594a28b03aaf17c769934f63c685d03afeb65ce8dd2f2a9bbfd111ba256deed8a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fbot", "colour": "#FC9149", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323886, "uuid": "0e8144a8-3304-47a1-be1a-7c55a3e57e01", "value": "11A3C80A6E518FADF769833447F78E32AB9923C637E1C685D25CDA001F6034D645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323886, "uuid": "9de9c79b-15e9-4c44-85a4-d26de0affa12", "value": "1536:7oUgqR8RVctRNZAStRBVcdLGZu7S6RiKzAhVCP3i7vy7diev6Gu/u309DP:MkgdLGZux3i7vyJoGGu309DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618323886, "uuid": "7a72dfbc-d3e3-4edb-9609-614ca3c8f7f3", "value": 99712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618323886, "uuid": "c1d5ebc9-e039-46aa-b0e1-29d6daab3abd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323886, "uuid": "7d986e43-b862-422a-a382-b12dbd61cb95", "value": "fbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a868d98-9c63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618323690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323690, "uuid": "8e51bab1-b30b-4168-968f-61efcec5a93b", "comment": "Malware payload", "value": "67abf8c564ffec70e8d655fa08f964cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323690, "uuid": "551fe6b7-a57b-48ce-90a4-ff0fd3cdb3f1", "comment": "Malware payload", "value": "26b51ae7eb953d6c5c9d935c90e63d432a9912c7297dbba9c93aa07cf2e009f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323690, "uuid": "98d02181-55b3-4c8c-9370-f378aa45d314", "comment": "Malware payload", "value": "0b9fd0fa47e91358c649981e8fd8ea5728bf1ce3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323690, "uuid": "56f8194a-9dfa-4f30-90b2-061be0667276", "comment": "Malware payload", "value": "3a5e8218aa74683b1ebb252ce2ab7f09e0a692775fe29b8949da6adef21e363f881a646c9b2d19d8c8ce31c47169b434", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323690, "uuid": "0cfb7e14-e866-4c3b-9b39-eb86e83a5971", "value": "64E2190BB886D0BCC18AC1B56EAFC572A931B0B85374395B37D1EB322E15D651A7CB09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323690, "uuid": "82c623d2-aa1a-416e-84f2-1e8e78b37dcd", "value": "768:YKPHI3hRt045btOobTulKBdU6Yum78V60:XPePftOOqlKBdTY1Q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618323690, "uuid": "f3ac080d-a8d4-459e-850e-5da99a3f3864", "value": 33272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618323690, "uuid": "67965127-ab6a-482a-8ddc-63939ed4645f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323690, "uuid": "1e5b4827-a569-45d6-b485-d8f506197aa3", "value": "jackson", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4642a2-9c4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618313091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313091, "uuid": "1aa4edda-491c-4573-8ee6-3ef0b3fde682", "comment": "Malware payload (Formbook)", "value": "e329bb8cd53c8c5936f2e1687696725a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313091, "uuid": "e9839335-c25b-432c-ac73-fb88b46b8615", "comment": "Malware payload (Formbook)", "value": "285d83b08b512c3cb922fc5e1c91f075423638f4e34304e16309a5e70aa13784", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313091, "uuid": "8f1e53a1-15a8-4e8d-9d7f-5645367b7eca", "comment": "Malware payload (Formbook)", "value": "171327e1977d20ecfa83daa5240fac1a91b98dee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313091, "uuid": "91299a4d-b6cf-49e5-93eb-2a69099ee9ea", "comment": "Malware payload (Formbook)", "value": "24f075e0f03dbf66e257be79e28b3e98eb8a621c16274f0e00c434fa36225ec872003242d6be8cfa0545b6c162e5237f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313091, "uuid": "6d09f921-63e0-483c-8e88-8e06885fc677", "value": "16E4234B2C505CCC269D38328EFD79CA25D3DD3D4EF68E9608BD436B2D538962EE5A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313091, "uuid": "7de6fbee-9a34-4319-94b7-272cb0f9fe8e", "value": "12288:4AhXxbnFMRQKgT2xv8oc897CAAprU8pgVsoXgUBqbBPvRy2k64f+O1cn6v3yg:BXdT2xv8ot9PApdBPQyi1cn+ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618313091, "uuid": "308c3686-f7e3-4f11-a62f-15bf3b0bee24", "value": 719707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618313091, "uuid": "092a59ef-8aea-4899-897a-6029bb762be2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313091, "uuid": "f5f13d89-7ab5-464c-a42b-f37f9f48df32", "value": "Way-bill doc.085685947005848.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993a1ead-9c4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618314695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314695, "uuid": "d047ea39-e980-49ca-b52e-6536dcf256f0", "comment": "Malware payload (Formbook)", "value": "12a098c033a8fad3420eba0103069a42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314695, "uuid": "87a1d6e2-11f2-4d82-b72d-edeff126122c", "comment": "Malware payload (Formbook)", "value": "290963ddb0862d90575e418931ac2cfacfbb79146f5846771e81046298bf75e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314695, "uuid": "d8491007-a4de-4c1f-a4c3-851c7a053df3", "comment": "Malware payload (Formbook)", "value": "6d6d53810c511baadacb787389aabe2988d4c0b3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314695, "uuid": "0a4a077e-c9a6-4815-9b3e-f265af918736", "comment": "Malware payload (Formbook)", "value": "a62c5c3a949c17f830e42a6634e2f866403a06efe5cc996c47411cb61f337bb030d9784421728c1fdec9a58fe06d8368", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314695, "uuid": "48b380ff-ebb5-46d9-971d-2ec8318b3a4f", "value": "6D3512797A98CF25E27F93781130110553F0F50AD362E68DBDE420EE1EA2B855B27B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314695, "uuid": "8d2f6dd7-2edc-4be7-931e-ccb7c8c051ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314695, "uuid": "02a24c0b-78db-4ae5-a92a-b9b15bfbc437", "value": "24576:+rGRTqxG7+xnG9WRkY2kH4QPOk805x9qLH+7:LTOGSxG0kP6Yh08LH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618314695, "uuid": "6420af09-6a5d-4666-978f-b86be5c1a1f6", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618314695, "uuid": "310a8b1d-a493-4a80-b48a-e71e8e93c2e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314695, "uuid": "0a355c3b-a1fc-4c4f-ad82-9dc496609a06", "value": "banka hesab\u0131 onay\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66c887b-9c54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618317429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "4116cad9-cd3b-48f9-a427-773ed72930a7", "comment": "Malware payload", "value": "314cf76ce73e3f4fec65c25a808063e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "6e58ea7e-d724-4456-a4be-63907dfdfdb8", "comment": "Malware payload", "value": "2951f52fa3475c72c84bcf45f9320bc92df4827bf3de15aedbfc3bf8fcf3369e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "f0220410-25c5-48d0-b6b5-5aac06004f66", "comment": "Malware payload", "value": "8aedf59839916dfa014b991d5944cd513585b9af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "db6c8c88-f252-4aee-8a61-46f8362a5f17", "comment": "Malware payload", "value": "870aaff8b8772366767e2a2db44a1f8700f2cd048c1c6834d587006d7dbf4fc6685eaee5e06c9d07e0ad1493e4159204", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "2ccc9457-2655-4b87-acab-339f4e4e5280", "value": "6893F299D7974819DB72D036FA6689E26A0B35032252B00E308191D52EDB5FB0FE5EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "1bfd4cbf-be79-4134-9c97-23376f9aabdd", "value": "1536:ltf9gwtr3JfMCMHeh5AS+9SvyCbXwOHGE8feeTE0hJMcPmaDpdSu19ihY:lJF7Jk3rUvyCjws58Gf6JMcuaNB19oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317429, "uuid": "6a56bc42-8c67-4acb-a9ec-05378767409c", "value": 96834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317429, "uuid": "9524181b-2292-4dd6-a4d7-81f9a5d03259", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "6424e0eb-7b0c-4880-8943-0c05e5d7db97", "value": "documents-347218554.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bceb20-9c87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618338961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338961, "uuid": "2963b991-ff48-4248-b993-b8b3d75aa1ea", "comment": "Malware payload", "value": "bcb6cf160b065cd7c806f41e24cdc0e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338961, "uuid": "37fd364d-5b64-450e-a9c0-321392882cb4", "comment": "Malware payload", "value": "2a716861355d880adbe421368be7570bc58358006c57d74efbcaabd9574518b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338961, "uuid": "cd039ea3-c896-4971-a8f8-c5bb70e2e987", "comment": "Malware payload", "value": "ef04745cfc8eb5b1bd7fe987b9ca9d8499bcaf36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618338961, "uuid": "c1e48ee1-5332-429a-af50-e7be5c193e9b", "comment": "Malware payload", "value": "b50f0346b0f86e0a0fe3b4e57414d607b2baf56f225410666ac7fba04b7027c6df76a85cc22f75ca939fa5a95a2ee0e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338961, "uuid": "279514b4-97e1-4236-a625-7c73e03dead6", "value": "44637106B797C963D0595A358EE2D6DB3731BC21BE91830F308A736F2D3B6909E02B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338961, "uuid": "1536feef-c5fb-4ef3-960c-4b816f22461f", "value": "384:p40mDNMLEakbavBYXLuvyAGI6pf8Vjz2:kZ7aEWBYXLuvtBgkhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618338961, "uuid": "66d660bd-10e8-4a3b-8321-c63f7412f291", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618338961, "uuid": "4e801dbf-9072-4519-98f9-15c2254dce1d", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618338961, "uuid": "4141af66-af71-482f-928f-042602c4779f", "value": "SecuriteInfo.com.VBA.Logan.1396.5306.25238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e027bbe-9c57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618318327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318327, "uuid": "52b54b93-c792-4f6a-9c2c-9c86f3af1bc9", "comment": "Malware payload (Gozi)", "value": "9af81da4fc50b5a359e1b9d64a6fc7d1", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318327, "uuid": "43adc631-9e2b-4db4-8a3f-7137bbd47e1e", "comment": "Malware payload (Gozi)", "value": "3003a0c48a2bca43910d1878d0ce17d6fde11cad4d114ee2ede50a404ad0e863", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318327, "uuid": "183ac874-0b5b-4720-80d1-32f2b244528f", "comment": "Malware payload (Gozi)", "value": "2f16dc39a06f4b8592295bc61ddfecfada7c6a11", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318327, "uuid": "3e432077-1045-4630-8567-bb39b7392d9b", "comment": "Malware payload (Gozi)", "value": "e6a1bc50c85b2c0160c588ce47ec65d21f0ed94e499923e9118701f0eefc7d2df7be34a66d60fddd2df4c3b19156c1e5", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318327, "uuid": "9f8abd24-1c3d-4acc-a394-0f3279a5e401", "value": "19245C6AA2E40195EDBBDAB5C952D61BE7F334051B28C70F13B0CEA56F57321F218392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318327, "uuid": "25cd21ee-4d0a-433d-b40a-2df1d28b6a11", "value": "3072:Lf0iSwbhJlRNAw4YboaEzitrOd9TRMm4hp1P1Pc3vrtzwrcGvjyKg5kufSVl7:hSwbhZNzizeOd1VMp1NPAjtzGjsp0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618318327, "uuid": "42993346-0631-422b-9fa4-fc421f585d11", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618318327, "uuid": "834b22dc-8909-47c5-bb83-d4dd004f690b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318327, "uuid": "310387b7-3d22-4b6a-b151-8b06781ba3ef", "value": "a140000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c2aff1-9c36-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618304430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304430, "uuid": "b49a6977-8fb1-4f01-b119-b99c8f1cd6c3", "comment": "Malware payload (RemcosRAT)", "value": "c9c74870ec5d5e567627f377e43376ef", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304430, "uuid": "aa1b2baa-b962-4fac-873c-7b8114a54fd8", "comment": "Malware payload (RemcosRAT)", "value": "304a18cd687053f61b78069bad3087fa27715f1896fb0c89afa07f77a47cc861", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304430, "uuid": "29fa2827-dba5-4834-8afc-5154fe16c36a", "comment": "Malware payload (RemcosRAT)", "value": "7c6b8461bd03b715ad66b5eb774a98a4ac24c4c1", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304430, "uuid": "90a95fdf-e76c-4355-a838-a30290921611", "comment": "Malware payload (RemcosRAT)", "value": "ca1e19d4cbc51e9540fbc9ee75cd50891fbd6fb1e3436c581beb23d25862ccf9f15cd1be4ae730836cf0cd0341ba2900", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304430, "uuid": "d3528af8-89a1-4615-aacb-13db70b995cc", "value": "77055B11B651C4B2C06E19748E0B86F869A9BD30F9345C8777F47D087EBEA503E2DAC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304430, "uuid": "0e7f89eb-5cfc-4ea5-b932-bee86879721e", "value": "5460111dfb820e05d52b9be905fc0229", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304430, "uuid": "ccb9d210-b389-4ce3-87f1-518c742f0923", "value": "12288:VQOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9ihKRmpW:mrjqQRVeSOywSSx91vi5XDf6ApK8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618304430, "uuid": "b61b1f1e-9501-4519-b4e7-19be6f530af7", "value": 858768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618304430, "uuid": "27358db0-830c-4190-9e88-483d56a270ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304430, "uuid": "0eec2c57-200e-4382-81ef-0cc7aab6b66a", "value": "Kemmler-New order requirement 90901U,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cc3322-9c2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618300738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300738, "uuid": "7f775d5d-ebe1-48e9-ac8f-9fdaaa94c2e1", "comment": "Malware payload (RaccoonStealer)", "value": "93391e7b0dd5fdbe70ed2667483a981a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300738, "uuid": "7f494b7e-8f1c-4a46-8b98-efe9d2178773", "comment": "Malware payload (RaccoonStealer)", "value": "3080fa79635ccba71e7ef8c44eb3dc8869d8453ffe827a70571fc4a479682caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300738, "uuid": "076a6134-3ee7-4716-afb2-d40cf5d7e52f", "comment": "Malware payload (RaccoonStealer)", "value": "333f6bae0c9112747235f42dd442ec1e41b2f53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300738, "uuid": "46aa1c4a-b1f0-4f3b-8c75-902de8b6d000", "comment": "Malware payload (RaccoonStealer)", "value": "8b278abc13ae2e39d9fff6fc83058773b9199a826508cde2fc2d259e960dea125c071213a65235252947a44f452be959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300738, "uuid": "eb9304a9-08b7-4eb3-990b-6df9e9ecc106", "value": "B5032B15A780E233C14274B0932997F29A3D96722798B9D7E3885E356FB03D1B63934F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300738, "uuid": "32216b6a-d8c9-4896-bb0f-07a74b30131f", "value": "768:40tOrD/q15RxO2zxW447oWvYxPl2WnJGm775o4qkSsK9OuMBexE9L:O/Y5Ho42GaWJ77No409OuMBeGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300738, "uuid": "e1cffe24-05b6-4b29-b53b-a3e788ca1b98", "value": 39094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300738, "uuid": "d1184441-deb0-471a-841a-25c3088e949f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300738, "uuid": "6bf7c229-1927-4ba7-81b3-0fe2b1054139", "value": "93391e7b0dd5fdbe70ed2667483a981a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14df0c5-9c3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618307488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307488, "uuid": "c7430238-08fe-4da6-b437-0ac5794ab1ea", "comment": "Malware payload", "value": "7539ea9a8f0b422a90cce62fb0c81bcb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307488, "uuid": "c1618cbc-ab55-4776-8040-3f33a303a242", "comment": "Malware payload", "value": "31ccd0212885720b6684a6596cdff63d05cc47106522d0d45159dd7d820fd7dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307488, "uuid": "218e0f61-bd4a-4829-981c-a99a32aa7b28", "comment": "Malware payload", "value": "909674bc4a50a28c3cecf2b113d3ae48dfcf5a2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307488, "uuid": "3be27d27-4d34-4580-9231-7fc2beffec89", "comment": "Malware payload", "value": "68f60410e09a84913b5be991d41fe727d2c0d859d1df02fcf01c489dcade8848d824e612b1a34650fce11946a7cf4f7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307488, "uuid": "d5c7c531-06ed-4389-9530-fd152d4aece2", "value": "02F362BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307488, "uuid": "47727fee-7982-4df8-b437-75d0de648402", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307488, "uuid": "4ab376d1-a9eb-4747-88ac-1818c7f9c68d", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618307488, "uuid": "c75d5044-c732-4e30-b0f0-68a26d0aa4ae", "value": 170896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618307488, "uuid": "004b85d4-232e-4808-aea4-f3fc03887f5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307488, "uuid": "7079a83c-a406-4d8e-b3b0-ade6f7d35bc7", "value": "ghnrope2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9565bef7-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618300515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300515, "uuid": "35d84954-ad04-4096-b4d6-722b1de69e44", "comment": "Malware payload (Smoke Loader)", "value": "0d1334075336455a13a36fd909417556", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300515, "uuid": "14b36d55-4c84-453b-b535-4ee2e27fd7e2", "comment": "Malware payload (Smoke Loader)", "value": "33d7fa2a8936cc5064b63592b77f87c02fcdc1396395ae2316e3a7c783523ad9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300515, "uuid": "433a3cf0-4af6-4c6c-91f8-92a0fe291689", "comment": "Malware payload (Smoke Loader)", "value": "4f1937f0eeeb697ef992547701295134fde65c20", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300515, "uuid": "eb6ce06a-6559-4a0e-bbb2-174bfd806d97", "comment": "Malware payload (Smoke Loader)", "value": "ef1675d2c681e335c9ae8e9c87e1960bb8a552d4e1e31a93c55d05c367e70c975fb25eba65bd162270838508e60b0ad6", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300515, "uuid": "127fae6b-65bb-4abb-aa4e-49e27e7978c3", "value": "5DE2E12EA9A43DB4D1735E34CBCE8DF989F8858A2430C36D5FB474DEBE474882952187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300515, "uuid": "96df19ed-2dd6-4a7a-93fb-4c1c5b6a68b1", "value": "768:FrqQ7AmV3rjBkyo1b2kP8K9RWZmUAiPatwTxS+IASDO39UYlyaQtZZl:F33kKZZxP3FS3AXDuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300515, "uuid": "7ed5ff65-ed10-4ccb-bf84-8eaa0ecada25", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300515, "uuid": "e3d6fb04-c94c-4402-b88e-9831f02423a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300515, "uuid": "7044f0e0-e21e-4198-90d1-7877befe5baf", "value": "0d1334075336455a13a36fd909417556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1481524f-9c23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618296004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296004, "uuid": "46296843-3f6a-4076-bca4-3fc4846bda2f", "comment": "Malware payload (Loki)", "value": "0e753ee23989ca8dd53e3627ef777c12", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296004, "uuid": "78b8b7fc-0085-4dca-8e27-a1b58d9c4ddf", "comment": "Malware payload (Loki)", "value": "35ea57e0275d6901c5de0995a9c2f52c668db46cab52cb9baaeaf3c327b98788", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296004, "uuid": "497aa34d-8804-4e3e-aae9-5c6ee479342b", "comment": "Malware payload (Loki)", "value": "c6409d82bfab6ad32e1be51d11f4c39e5f8b8f25", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296004, "uuid": "2be5428b-0ef6-4962-b596-d0da2796f32e", "comment": "Malware payload (Loki)", "value": "0c8fa95f11b60561866e6cb4658e018c334ccd512a3b4999775b5673b8e273e163aab3b51d843a54c7ec17438460c2a2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296004, "uuid": "c51b3ef8-50b6-414b-9083-6d0e90250ee7", "value": "D0329E79C54EE460C972C178B09913F6FA098606B662D12AB857F8E9C864577033EB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296004, "uuid": "b73b9ec4-262b-4188-bf90-e91b081e5156", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCAuVw:aNxUyn0i13LROEiOLkX6Ujnw+3puVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296004, "uuid": "d106a00d-bf6e-4fa1-846d-13a49a3fbdca", "value": 11741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296004, "uuid": "971506cd-69ab-4d98-bae4-c64f065b558b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296004, "uuid": "c388ff71-10d4-46b5-94d1-bbacbd15b344", "value": "INVOICE JPYE3EDDSE3E.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84102c7f-9ca0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618349878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349878, "uuid": "0a11159b-a692-410f-8f30-e987dd0fac69", "comment": "Malware payload", "value": "0e5a32151bc2d235ca8b57bfd1684f6e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349878, "uuid": "3d2b2116-8210-4621-a1fa-d3bf629d260b", "comment": "Malware payload", "value": "3693a93f4ddbfa1eb9207e06cf87041b59b9b1ddfd866e6fbbbb52aaeae7ed83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349878, "uuid": "77e8e00e-a9a8-4212-85cd-8725d3dd0b10", "comment": "Malware payload", "value": "db048b176a6f99934f13d1bac90a7918600a0f23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618349878, "uuid": "51665555-1a2b-4816-9e44-65b7f18ebbb3", "comment": "Malware payload", "value": "bc3e90a5deec6b132741be1365264a40637968e186cbe28311e35802be3f3c3f93685a2fdcdc59c898d88e7006c33f7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349878, "uuid": "455c9099-d484-4446-ab71-88285a0fb061", "value": "AC459ED1B150CCDAE96B49F1BD2BA53024D3BE9C54A4410C56AEBB1B76B3342309FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349878, "uuid": "c92729cc-ae97-43f8-a93c-853c8e85e919", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349878, "uuid": "a20a0e49-7390-4d89-a1a2-bfbb238fa046", "value": "24576:zy2Vomx23+VG2+agecnA+23sydrsVWcs4s:zy2SmxA+eage2HSdrsfs4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618349878, "uuid": "e6c4a381-0d67-4db1-b134-f0fdacbbde28", "value": 1193475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618349878, "uuid": "27b44dc2-1e9f-4881-a456-12594a92163e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618349878, "uuid": "0e2259ef-6766-481f-a89e-747db76ff6ae", "value": "SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8ee88c-9c53-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618316689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316689, "uuid": "d1b78e1b-f6ee-4b5f-a8b0-e5eebe390d77", "comment": "Malware payload (Formbook)", "value": "e2602509c4cc8ed71ba027291309e021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316689, "uuid": "bf38df55-6009-4b14-9915-9a7657a910df", "comment": "Malware payload (Formbook)", "value": "37b040cc151ca844f2e350c96b3bc0650fad6303a91cb55337be1b6aa8b21f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316689, "uuid": "3072d77f-8274-4323-9d19-f5a088e5032b", "comment": "Malware payload (Formbook)", "value": "10e8e74537509b03ff8090a89c64237235a71abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316689, "uuid": "aca276b9-e2df-4bb1-82c4-3cc837ab68d3", "comment": "Malware payload (Formbook)", "value": "c3d0e86f1ea20ea33ca3b9d22d62c28f2664d934e4890e0624b5b288cefe4eed660387ec0d476df3e8c3b2894b842821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316689, "uuid": "bac3b65b-ced2-4193-b52c-fdbdece09e44", "value": "DFC4E03A67A8CF25E27FD3782131110543F1F10AD322E78C7DE451DA1AA2B859B277A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316689, "uuid": "a474e95d-d7df-4d45-8e05-cbe8e1cfd5a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316689, "uuid": "cd861cb5-f8c0-4dc6-aef1-cd89786296df", "value": "12288:TknMg8To32ZvA/jvhEpsxdHNs6BcWHiYrj9xRKugBkeKQdf/1NHD6xEFSiK:MvSMi6BZiY9xRk2Of/DHD0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618316689, "uuid": "8f605fc3-cd05-4565-bd42-cb428495d4be", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618316689, "uuid": "f284e931-37b0-4c93-8f84-6134c86ac212", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316689, "uuid": "671ea31f-453e-4786-9c76-0dd09bb1f2ce", "value": "oEWV80rj6fgwF5i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ca47d9-9c71-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618329881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329881, "uuid": "47bfee5e-d5e3-4f5e-b358-af391bbaa373", "comment": "Malware payload (AgentTesla)", "value": "75fb4c6ac75bd462bc69ac759d151c16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329881, "uuid": "f062d198-92f9-4308-832d-e11088021190", "comment": "Malware payload (AgentTesla)", "value": "39164f1392b16c4e3d22e2bd9f7bedaa80f4bf5b9ff1b506e0a78f7da05419fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329881, "uuid": "e4911468-4147-43dc-b010-7c6aafa5e09a", "comment": "Malware payload (AgentTesla)", "value": "dc63c2943403dd9e3d2fe95c0b5e906d8257dce4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329881, "uuid": "04bb53a6-0891-4565-bfe6-9dcf6aed892f", "comment": "Malware payload (AgentTesla)", "value": "3868b5d578b29c87491b655ddf7f5a694b1f0c45cf39a51d05d1391910ee04968bcb51488ed21089d1452b07caa4f67a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329881, "uuid": "7d4f6f49-b1ad-4c5e-b076-fb41afde3410", "value": "A0D4D03E77A62E15C18C1F3A4917788C92F0C1C3BBB9F26F2CD619E85901B1D6B2E195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329881, "uuid": "eb7c7968-b316-46da-9119-44af620d0a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329881, "uuid": "1d90509f-1509-4b24-bf1a-abdc4ee42e2f", "value": "12288:UvJTE43qWzqqB3PQhPp5ow92ObxtcohB5kW:UvbqWzqIgfoiXcEjkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618329881, "uuid": "98283f98-4a9b-4bea-a621-f79f2a36d795", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618329881, "uuid": "5c4ccf80-90e3-4c92-b51c-88f2d786623e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329881, "uuid": "6037a2c9-f386-4556-80ab-8e3f51b5b713", "value": "Quotation AE2101137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027f0444-9c2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618301128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301128, "uuid": "c6398352-7351-4d19-a617-35190b2baa91", "comment": "Malware payload (RemcosRAT)", "value": "751b6e0bc633b26c52bbc8be230339b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301128, "uuid": "ec5cca30-b213-4f25-8144-b215d9646fd5", "comment": "Malware payload (RemcosRAT)", "value": "39d5de9369e325dcd8f7a15ce88dd495295e87fa945682ae6f454f2f8d0130ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301128, "uuid": "62b66222-3d0a-4ba1-a6a3-ca76998ea6aa", "comment": "Malware payload (RemcosRAT)", "value": "4583d909035d53e1488d926e2147a9de31181ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301128, "uuid": "a58ae2d8-f4a4-41d1-a8b3-1ee685792ade", "comment": "Malware payload (RemcosRAT)", "value": "d641de051c8ea6d7061285223e3253927939a189e4fa7b2252b6e90f8d067e49894873593fdeeda3ed8563bb97f240fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301128, "uuid": "7d448c10-3cb8-4410-b767-6b89b0404f0c", "value": "37A4AE12B592C032C07251741D29FBB5D9FCBD202A6595BB73EA1D6BBE700C0A72A773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301128, "uuid": "c29145f4-dba2-486f-b662-92832b613956", "value": "3044bf45883fdbd5ec8c4e64bf749839", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301128, "uuid": "27c3f74d-16d7-4508-a389-fe73d553291c", "value": "12288:jp85GzC+LZ5DsOwPEsfI2Mt23o/ZMBPYC:u+LZxsJI2M03eZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301128, "uuid": "0feb3f87-e484-4f90-9b96-cd42599c0a19", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301128, "uuid": "a9ba8b42-7d5f-45f4-a516-87a5452c20e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301128, "uuid": "9bcbcc99-8a01-43d1-b2e5-b2366b32b4ae", "value": "751b6e0bc633b26c52bbc8be230339b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0820bafc-9c1c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618292977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292977, "uuid": "efe5df74-8e63-432e-9834-c77c53316b8e", "comment": "Malware payload", "value": "9c503420ee9e1f93d2b3c069b42fb899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292977, "uuid": "9d98351b-e0eb-406b-b809-859d5be928e6", "comment": "Malware payload", "value": "3da0ff15c077f76e57bd5c116e8c85599fc420a4433b19c705f0d437f7368cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292977, "uuid": "43b9d46a-fdc1-4f1f-a56a-cedd44c4b04e", "comment": "Malware payload", "value": "f2a9791d5b394c7c25e31807e1b241fd5021fe58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292977, "uuid": "3054ae17-c50c-4d32-8c03-7d217e563819", "comment": "Malware payload", "value": "ce746d8d11b04dfffc246ccac6c7951d01fe785634def3f598ece0306092e757f8bfa6a1c21a1d70f5d1d25437752ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292977, "uuid": "a26d3773-b408-448a-b60e-a3d21f6c4409", "value": "5EA5AE62B3424072FFC241B350A65BFE8C395E156B2651EBD2847E3969303E16B3F71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292977, "uuid": "b47be71d-970a-4682-b7e1-95f5556fee0c", "value": "e3174a156aad936f2e028053e3d100bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292977, "uuid": "870d9641-daa5-4c3e-a947-4e19b1d87bff", "value": "49152:yFcg7fVW62gD7IQ3zMX62ILatrQT/R/hqo:o8LUx3zMX6Tat0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292977, "uuid": "8866a81e-2d73-4a5d-94dd-a94287dafab3", "value": 2223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292977, "uuid": "ea1282b1-1092-4ceb-a2c9-c595645a328b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292977, "uuid": "7290c06e-b7cf-4c5d-8a3a-d043e03ee4e1", "value": "MySqlAssemblyConsole.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995c4933-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618292791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292791, "uuid": "8c7d1948-920d-4ea7-9701-be7592442a77", "comment": "Malware payload (Formbook)", "value": "5b3cc5131d9e2691d3602f91c6c3a5b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292791, "uuid": "f0a05c91-c40c-4fd4-b595-8743a61c4f47", "comment": "Malware payload (Formbook)", "value": "40bd49e559d5669b17aed509ddf20919a8f6fdbd5d483bea5ef1a371038aea31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292791, "uuid": "5dd071f5-af1a-4b62-baba-60ec81da354d", "comment": "Malware payload (Formbook)", "value": "9bcbedd0bb0f2abb79851a52d1521526ebde6d6b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292791, "uuid": "d6e74aa5-2ff8-4653-8ee7-0604a534da4f", "comment": "Malware payload (Formbook)", "value": "867cfcd067e4dce89763aab6184f979e1f8e568b0d2a2ea70f713646656d8ee4849f236acb0ebdca8a4ce38050e4d3e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292791, "uuid": "b0256f71-e31e-460b-8926-4ee16edc73cf", "value": "21B5337BA897DF1AE28D33B1855CC3B559FCAE64DA419E89760D3F20B033B704B4614A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292791, "uuid": "3776038d-701b-43c4-ae73-d34601797b06", "value": "49152:OSB0AOuRQ6WiNNzxYF2Mt4tqiST/6vT4k1bogX31ubjbDg/jE:NO0FSSM6vNbhFubjI/jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292791, "uuid": "b590c83e-8c60-4d12-bb97-fda7514ae959", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292791, "uuid": "17a616be-cb1e-4492-9c53-79211d40ef5c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292791, "uuid": "979f6d78-c494-4b53-a579-88e1640c34a9", "value": "RFQ3936.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7b1e55-9c2f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618301526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301526, "uuid": "5f39cd07-d833-42e7-a142-fb917572a97a", "comment": "Malware payload", "value": "ed526d05d4d73f592db4f58244f13d78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301526, "uuid": "772e2f44-cfcf-434f-ac0c-abe4ffd38182", "comment": "Malware payload", "value": "4216d742a9bef987d4c87eb093fcd249af166c2f2ce1532ae23e199085ab3098", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301526, "uuid": "db4adc05-3bde-442f-b819-1be73fddbfee", "comment": "Malware payload", "value": "5c82be710e8bc01c13161c3f81e2fe0e1f4446f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301526, "uuid": "34c4fc7a-5459-40b9-9c60-4ec7bc19e2fa", "comment": "Malware payload", "value": "1199af8fbd4b24f9b189a97b5a5337642b061952d4099c27f30508654407b704caa4de58a81f1ad862a52affa7e76a1b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301526, "uuid": "def8f2bc-5001-4aa9-bd06-5d9fd14c5005", "value": "D0136D1F91B7C833C90D28B98A5CCA7CE92B5CA6395139B263DF1E09DD7BAC0190C756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301526, "uuid": "6ab33624-7675-4052-a716-443907854f5b", "value": "768:y1qTvGqblFQNu3wm6JsGDbi7OZmvEy5264w+2feqcyQYj+hKDZx+f+Hv0f438TFV:CqjGqJFQa7rM6264w+2f5cyQYoCZx+fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301526, "uuid": "4ea7592b-9467-4c23-8f7f-df8747d03d33", "value": 43251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301526, "uuid": "87153626-9f1d-4121-84b3-9f0090031ef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301526, "uuid": "76da0581-469b-4440-bd2c-08461eba5024", "value": "ed526d05d4d73f592db4f58244f13d78.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ef9968-9c1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618292487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292487, "uuid": "3b18e062-24db-47e5-9fd6-a9bd8bfa4cc3", "comment": "Malware payload (AgentTesla)", "value": "98bf5048d9a7c8b473336ed4f6054ff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292487, "uuid": "77d36676-bd7d-4d7d-ac92-c68f9d75ae0f", "comment": "Malware payload (AgentTesla)", "value": "456abb148d30fb6584da90a18d89603b88e7a28b35baec8b91db73e7cabb0664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292487, "uuid": "cea3dcef-3079-4384-8bf2-a03f394f5d85", "comment": "Malware payload (AgentTesla)", "value": "506e0d287ce188c5719a8a644a609746a6a5085d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292487, "uuid": "11e04102-da99-454c-80cc-3cd21fe6e8e2", "comment": "Malware payload (AgentTesla)", "value": "cc78f5c9955fa90484823d4138416555db0ae4cdfab073293db2ac1f8a27ac812aecdd0e21a6d366e576cccd425c912b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292487, "uuid": "47d5cfa6-b590-4c20-af42-ad20223aee1e", "value": "9BC4E0752698CF25D27EE77C2531120503F1E15BD322E64CBEE410DE1DA3A859B23BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292487, "uuid": "53eae42c-7e6e-4184-b7be-dc5f0e9f83b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292487, "uuid": "8cc8e568-347f-4ee9-ab9a-22ef986ec2d9", "value": "12288:gn8rqXg8To3mZ1A/qrV4o551od6maqJSNLDqLOzUhDb+5zxXAZK:Pqduogr98N+KUhDb0zhA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292487, "uuid": "6d60fe2c-ca32-4e5c-aafd-5fa112134d4e", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292487, "uuid": "db77db79-e362-40e9-8fb7-7128dd3762c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292487, "uuid": "fa0e1c5f-6283-4605-83e8-7adee68081f3", "value": "Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fdebf2-9c54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618317404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317404, "uuid": "de458f5e-3fea-4123-b5e2-69c75d0e5130", "comment": "Malware payload (AgentTesla)", "value": "0f8793838e4ff59e502ae71d64f1ad1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317404, "uuid": "ce1a3364-6cbf-430d-ba74-c27373c95bd5", "comment": "Malware payload (AgentTesla)", "value": "475feaa6e165954303d55d8449e0760f0bcac7ddeb8c35bb1b00f35998018991", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317404, "uuid": "607ccfcf-198d-41a6-b4f3-824b3e5b721c", "comment": "Malware payload (AgentTesla)", "value": "b2aa0bd307ddf9f480f8ad18bb443b8483101be8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317404, "uuid": "0451bc6f-4e4b-4916-bc7a-fb32d2b1dad1", "comment": "Malware payload (AgentTesla)", "value": "c608715b467199a52424d30825e5c9829bd2019cc44171cfb7242f124d89cb8bbde6b6393eff3e143b1b09ad89ae607b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317404, "uuid": "b507b55b-a07d-451f-b424-6c988f38e44e", "value": "3E45152C72049AC3C5AB03F6A32C4C0096F19D4EA6FBF65DE8833CA6B6BD741B525553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317404, "uuid": "c989ea68-4fef-48fd-b5be-849f9774c62d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317404, "uuid": "18b8b5eb-9261-40b9-b1fa-f36826191684", "value": "12288:TjTD+9NzzzJ+viqmG2U9s+UI2S5b2TYnEyg2qmXdpyBLgtZT4QuduuKhdh6a7omh:TD+9f+vHNsS5b1RwLgttYsPleU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317404, "uuid": "1cceb769-fbc7-41d1-bef2-52d31283a180", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317404, "uuid": "e9708cc0-3bf0-4f1a-93a6-588bd70a9ae6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317404, "uuid": "fa66957b-e7c4-48e8-b22d-6cd4b11a461a", "value": "BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT 709447464231.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fdd7bf-9c1d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618293624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293624, "uuid": "d4445cb8-e36f-4060-9233-c2672711fd5a", "comment": "Malware payload (RemcosRAT)", "value": "6d2eb9b00c1b0315b410106b94baddee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293624, "uuid": "16fb23c4-8b87-4b60-a935-114edb4e6a8f", "comment": "Malware payload (RemcosRAT)", "value": "47af2f9f21616bd0172d62e44d875a0532242717d7716cb019d2cc4bda84b8c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293624, "uuid": "0f456655-8625-4bff-97b6-61c533faab74", "comment": "Malware payload (RemcosRAT)", "value": "c73feee24176db14c63676ac9e88d73e90ed9869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293624, "uuid": "ded33eea-7d31-492b-ac4b-463471dcd528", "comment": "Malware payload (RemcosRAT)", "value": "7e2ffae7c37be6a0d2cdb59fd34999afafc4ba056cff3de4e26c2fcee078917fd04e00304f7c582b2eb3a63be6a96c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293624, "uuid": "6ea373b0-57d6-4435-a22b-c67b25a268e0", "value": "0B055C127690C8B6C02E0D389D0746F958A9BD30F9349C8A66F4BD1C7EFF5503E6DA86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293624, "uuid": "40288e49-0091-48df-88ed-84e7942d8f68", "value": "5460111dfb820e05d52b9be905fc0229", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293624, "uuid": "89f34714-e6bd-426a-ac73-b12b34ba4099", "value": "12288:VQOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9iCKRmpW:mrjqQRVeSOywSSx91vi5XDf6AKK8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618293624, "uuid": "4337957e-0e99-43fb-94bf-b8b4ceeac5f9", "value": 858768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618293624, "uuid": "7acf48a9-23c6-476a-a74a-fd3f9efcbe22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293624, "uuid": "fa3db8bb-12ab-4ba7-9fc0-397e3ef0514c", "value": "??RFQAP65425652032421?pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccb0814-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618300420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300420, "uuid": "10bc17ec-58a9-4c9e-936d-9490273e496a", "comment": "Malware payload (Loki)", "value": "966ab3cbfde36683f31801bb4e1e9563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300420, "uuid": "ef4c4800-72ad-4584-8681-6cc5f71beba7", "comment": "Malware payload (Loki)", "value": "48609729a683ed52c319cf91bb5c44c566e9f5bc4acb832989946086aca5e071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300420, "uuid": "ad67bfac-5a6b-40c7-8e3e-2ea342d715cb", "comment": "Malware payload (Loki)", "value": "2599710041fcdf6fc71f660382dc9eeca7d7e7f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300420, "uuid": "28ed4ccc-429f-4fb7-858e-0786bf6adf5d", "comment": "Malware payload (Loki)", "value": "b38bd93952ccfd3cb338a7637339f26365809f00e5ce671e9aa11036b652a35691a13307d4502d7a9c394a7fe37bd036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300420, "uuid": "07c9bb3c-6ab1-439f-b055-b7ac849bbdb0", "value": "63B4E07A7798CF29E27FD3751131121507F2A10AD322E64DBDE510DA4AB2BC48B277A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300420, "uuid": "cd635f01-553a-4864-a30a-6ab85e2b0b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300420, "uuid": "a94d0718-57cd-425f-a3be-eb71c7a25525", "value": "12288:IIOtsg8To3wZWMA/bZpt6etUpuyRKMm+XDmoR/y3mb+vYoAFuPJMZaSK:I5dCealm+LR/CSwPJHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300420, "uuid": "42ef7342-79c4-4c42-b49e-51d7e6bd13e0", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300420, "uuid": "cd2486c0-ce56-43d9-9fad-2aa19b2bec3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300420, "uuid": "c609f7ba-a0c6-4d78-a06d-5c91e809de2d", "value": "966ab3cbfde36683f31801bb4e1e9563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11169245-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618300293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300293, "uuid": "b47e85aa-eee9-43df-b00b-18632b3fcaae", "comment": "Malware payload (RaccoonStealer)", "value": "cf5546412e349b49b8aafb77af57b5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300293, "uuid": "227381f7-6b44-45d8-8eee-ee0389184dde", "comment": "Malware payload (RaccoonStealer)", "value": "49ae8012110cb36ae61a138a492531bc6ddb2d69618bffef6a93077fefba3a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300293, "uuid": "7fd4eb78-caa9-4a2b-bd59-b4b067cbc55a", "comment": "Malware payload (RaccoonStealer)", "value": "8f83ecc2c0d0046c51fab5c75e419c0d2adde1a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300293, "uuid": "d3193b9a-d75e-4c2e-bf37-fc2cfba61611", "comment": "Malware payload (RaccoonStealer)", "value": "d2b3c6c2615dd07a85c008fbbf8b7868b2fe98232c9c7590499de08792ec8f090d80271d999171bbe87fe1926d3fdc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300293, "uuid": "650fb313-c12a-4aa5-bc39-84fda178d1c7", "value": "A3B4E00136D0C033E5A3253281A5C7F15B7BB8B65B61A6CF7BC41ABD9F342E19A2570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300293, "uuid": "a1ff41e6-f845-49e9-9fb7-f7645940e3bf", "value": "fad9fd2f25ba79ef0607fcf1eb27b49d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300293, "uuid": "fa82e9bf-c86a-4773-a6c0-fe66390ed923", "value": "12288:7RZ8qs3KFUZjBM35FAcG7hItP5b1CfMg/OsfF:vJFMBMJqcdhb1CX2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300293, "uuid": "95991cf5-2e71-4fab-adee-3e3176d11e88", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300293, "uuid": "1c98cd47-6fe9-48af-b7ed-e6d72f51628c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300293, "uuid": "5e0c08f7-d095-4d73-835b-4cef2abb73d9", "value": "cf5546412e349b49b8aafb77af57b5d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa0e7d2-9c45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618310832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310832, "uuid": "5a9feb6a-8fda-4b63-ad79-1609aeb11ff6", "comment": "Malware payload (Formbook)", "value": "60557b8fe8456a142ab65e6306ad8f7e", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Pfizer", "colour": "#792ECD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310832, "uuid": "fac20ea4-9784-411b-a9de-90b7f5b6312f", "comment": "Malware payload (Formbook)", "value": "49c65c3ac340bc3cf7d356c5d9ab4dcad04de64908df63908cd29eaea002869b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Pfizer", "colour": "#792ECD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310832, "uuid": "2e233aa8-03e9-416c-82ea-b4e7f748518d", "comment": "Malware payload (Formbook)", "value": "a98c212d850d43ee554ef63dee98d9ecb900b0eb", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Pfizer", "colour": "#792ECD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310832, "uuid": "ff94d4c6-a319-49fd-b249-29198f8a7a51", "comment": "Malware payload (Formbook)", "value": "7ef142b99c330b59a2a1160095aac49207eb240c7d6502002039ec37cc031bb3d384f14dc54ffbe6c97a7d50dc7e6ce7", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Pfizer", "colour": "#792ECD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310832, "uuid": "2c710766-5ab8-4885-8736-94dfefec4ccb", "value": "73B42367F43291FF9B4D4E4660A3642C35542346FB8C8CEADD4DD8B2FDA8B900198E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310832, "uuid": "e7ea8d54-fca1-4fb3-a3b3-88322f5a2cf8", "value": "12288:I9Q0hrsvBHv4APoAGzYJ0Hq5iR4HAkJ/5wJhMhi:LICRgXWkRwAq5Kmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618310832, "uuid": "26067c21-65eb-40b1-8ba3-db92f0630655", "value": 510194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618310832, "uuid": "7405a9c6-16c2-4098-9b39-c25bda12d4c1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310832, "uuid": "1159cceb-c7bf-4e80-9ecf-81695c642305", "value": "Closing Balance.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bf116b-9c2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618299957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299957, "uuid": "bf8e6cf3-5959-4d81-9ac5-855747c5084a", "comment": "Malware payload (AgentTesla)", "value": "65406ea39e3feb364b6ade9a0dddaecf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299957, "uuid": "0dd07825-2b83-4719-9e4c-fbe303f813ac", "comment": "Malware payload (AgentTesla)", "value": "49c6faf9f27c231045827c532d9b9c404c79f8c5cfe38689560c3acdb0993418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299957, "uuid": "42866ac4-018e-4b8f-b620-b3a0e581faea", "comment": "Malware payload (AgentTesla)", "value": "91260c62d3897cafc768c4469984a0f1f9d2cfd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299957, "uuid": "15bdd49e-0879-45a3-a4e8-31b3b446d9a6", "comment": "Malware payload (AgentTesla)", "value": "6e1468aaff57c907b2d21dd6abdc624f7f288d52f017e0f6ba845a39d882839830d137aa148bcd4cae44933c36d9b20c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299957, "uuid": "8d8e7546-f228-4367-8f44-f0efc7debcb3", "value": "B755152C31049AD3C5AB03F6A32C4C00A6F19D4EA6FBF65DE8833CA6B6BD741B525553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299957, "uuid": "268cac07-9ede-4b8a-8460-6823f12fef60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299957, "uuid": "1cc32f9c-6dde-4582-acb8-1cd277d3ca21", "value": "12288:USnvaNzzziKaZzb1PpOa7Min0OEtgwAA4E8hhSOcD9nFurNdh6a7omgSGmgj:UCvaXaVbpFGZt+A8hynFurLlTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618299957, "uuid": "e77efb8d-bd77-4676-bcdc-02fc71699496", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618299957, "uuid": "6bb4894f-f816-4224-b7fa-1f76b15a61c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299957, "uuid": "067bb9d7-f4db-4b6f-bf5f-0675fd97d4b6", "value": "TRANSACTION_INTTRANSFER_1617266945242_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d502de96-9bf8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618277859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277859, "uuid": "3636a65b-1d13-4ed4-ae6e-d849ed0c5466", "comment": "Malware payload (AgentTesla)", "value": "182abc572f6585600944af95fde0a378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277859, "uuid": "cb080b7b-491e-4bf8-ba69-8b9ec8e521f1", "comment": "Malware payload (AgentTesla)", "value": "49dd3f6f3c4b24f17bd3ab7354a9d34bd5624240865b18121dad79ee22d0ede9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277859, "uuid": "5297335f-8151-41a7-b14c-16c67371cf25", "comment": "Malware payload (AgentTesla)", "value": "b9152d2a06f475e984f31cb3dbd1abf4c7605286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277859, "uuid": "277340b4-993d-438a-ab98-7fb59d4164d1", "comment": "Malware payload (AgentTesla)", "value": "ecf9216cc1eb948cafc28a52b950b0aeb5403845c3a91803287c3dd51c9ccd037d78938f766e659dbb19496534c61785", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277859, "uuid": "537f35d1-5021-4b73-9c27-391638050114", "value": "4605BFAC366076DFC967CD72CA981C64EA60747A930BD203A01716ED9E0EA97DF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277859, "uuid": "a7b186d5-f10b-4a1a-ae2c-e9b7cdc1c024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277859, "uuid": "de5947e8-0d59-4d56-ba11-3b95311b3775", "value": "12288:KBCxRRHiR2x8tbs25KUV591ID307GmErrMzygRNH4WH39rKjvY1xKkaOBpbrQ:YZ2xubs25utrrMRRNYWX9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618277859, "uuid": "2dc28ec0-742c-4c50-a058-b600f4f6507b", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618277859, "uuid": "9531a38c-aedb-4879-a36c-4c349e9cb05b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277859, "uuid": "e0bc2344-52c1-4506-9931-9be889a29c5e", "value": "Scan Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7efd1f-9c1c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618292988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292988, "uuid": "1958005d-e498-4c43-9b7e-3e826529c1a3", "comment": "Malware payload", "value": "12569c0f42b8dd4d8d6777dcd0d098db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292988, "uuid": "4abc57f7-8eac-4fd5-a16e-9933eed494ff", "comment": "Malware payload", "value": "4a623ed11ca5628bac56eab735d098671db69fd003afebe09ce18853043790dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292988, "uuid": "a1aa3261-e589-4867-89b4-a90c025968a9", "comment": "Malware payload", "value": "de03988c899ed67e4eb5375ae30349898af3fd28", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292988, "uuid": "2a0cc7ea-047b-4d5b-8ecf-be56d0b76f25", "comment": "Malware payload", "value": "a70317c31564e6e2f6b3d8885f659a9bff3acc4974619632158e08f8e7a1b6594db680df863592509be59433b55f5d3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292988, "uuid": "105d2d9f-be47-4ca3-91e7-f2f6ca47f66e", "value": "15D533677C6E8507DE115E7EA20CCE9FC12BA24354917F61E4099ED2E503BE4B3B6388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292988, "uuid": "0ce15dc6-474c-46cc-bedf-184e1c2053ec", "value": "49152:QvAeGvLckfnO0QPIg/3gIx1KUhsz/UF4YwFBx45Viz+YkLSKgtSsHnMJ/nBaEwND:QvANI4O0QPPwIpsz/UF4Y8wAz+Yk+1SI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292988, "uuid": "2673bcd2-de4b-4cd0-99d3-25d6c2ff0db4", "value": 2931033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292988, "uuid": "73af3c46-4878-42cd-9851-d75fd8e50e5e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292988, "uuid": "61ce1688-c5a6-42f7-b853-4e508873cef8", "value": "4a623ed11ca5628bac56eab735d098671db69fd003afebe09ce18853043790dc.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0def71ab-9c55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618317468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317468, "uuid": "d4d7a354-b298-4f85-91bd-84af58be6ada", "comment": "Malware payload (Loki)", "value": "5ffee332587d0584020c7b3ff85a83e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317468, "uuid": "70f7eeed-cb68-47dc-bba9-d7c21f6f7929", "comment": "Malware payload (Loki)", "value": "4d890b10b862b7936ba658bae26643c933d8d2194703b71f41958acbc66dad18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317468, "uuid": "807fc963-1cf1-4e8d-a2a0-90624872d338", "comment": "Malware payload (Loki)", "value": "fc594eb2b5fb25e02a60d14169f044e3cfdc8457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317468, "uuid": "75481cd0-5806-4e56-894b-15fb7e3f0da5", "comment": "Malware payload (Loki)", "value": "08ca327eef9b643f0e890af0aec46f2ba1eed159bc75dc7b3cdd33e1390a47d3439f3d3df5bf27fc7be38978c67d50a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317468, "uuid": "402b1780-c762-4a5c-b2b6-50b161cafa51", "value": "7FC4D0E02B06E72CD978A7B8484541F133F3BC1166D9DBC579C03D5E652B242C6EE2B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317468, "uuid": "8d2d7517-a602-4587-8b0b-2c0594fe93ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317468, "uuid": "fee08ee3-f16b-4bf3-a008-756c1ee5a5dc", "value": "12288:5ZepHannvn9dma2U3UwsXpemY5UaVlLsvcB2JTaExFK:feQnldmaf3Oet32vcB2go4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317468, "uuid": "fe736fc6-cbd7-4b5a-8d22-b322fe91bb93", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317468, "uuid": "a88f735c-cc05-4221-9042-53e2c5b742cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317468, "uuid": "f5424b03-6c94-4ef6-9d34-07ebd023bc58", "value": "P.O 0000237701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841658d7-9c2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1618300057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300057, "uuid": "93e594ee-de24-4c97-bb17-587247b8203f", "comment": "Malware payload (STRRAT)", "value": "df2814dbb5f4e8a741897dc4a4a33759", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300057, "uuid": "dd3ab29c-0f11-4fa5-b3b5-37c02c787223", "comment": "Malware payload (STRRAT)", "value": "4e29627464c67499598f420742449f22e9719536001325ad2077945975db3746", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300057, "uuid": "95954597-b1b9-4023-8b2e-e82a014a5e54", "comment": "Malware payload (STRRAT)", "value": "0635f5199b38532241032ec5d696d8460f3c4636", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300057, "uuid": "3a1b96eb-3635-48a1-a849-2dbbb8b21df7", "comment": "Malware payload (STRRAT)", "value": "99b00dec6198025084f192f43b749b00c6c199e60cb278e5162c5d5a5d45c957107a8e9e48980a4d9a71943d7161b6b1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300057, "uuid": "f0ecef13-5122-4f6d-8a99-a895783d03a2", "value": "C8042308D4BBF488DB4FD161A8D7C4F7EB5EE894A835C45A4CAE63765F834E02431AB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300057, "uuid": "6e866d6d-1d42-4ee2-a837-7b81b4ffdfad", "value": "3072:sgPQ8QHxgV/QaaEWDmRgPZJrlXvzcwxt6+jmwZaTffoFMMU44cbkCxxBRtbM6j7V:sm/exgV3DW28rl/zcMt9miajQl4cbLDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300057, "uuid": "f1791c71-d2e2-40f1-833d-5b596c197b29", "value": 179596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300057, "uuid": "6d3b3909-cab7-4f1a-88f5-4bda4337e19c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300057, "uuid": "f62000dc-a1d6-4ebd-a53e-ecec66ba02de", "value": "SKMBT_ Request_ Quote RFQ PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9888a146-9c24-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618296655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296655, "uuid": "74805301-f2e5-4ba0-9ae3-7fba85d8ea0c", "comment": "Malware payload (SnakeKeylogger)", "value": "8e1478374c689b0153992443e5092951", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296655, "uuid": "d03a9e30-b8d3-4ce8-9281-96ba185af3f9", "comment": "Malware payload (SnakeKeylogger)", "value": "4f0342f7efa1c881326c2883f825cefaf392870b2bc19006958d9074b2948dca", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296655, "uuid": "726ed45b-13bf-4a87-9419-f1db2576fd11", "comment": "Malware payload (SnakeKeylogger)", "value": "4f9681974344533aa799e3c588966524c98fbf56", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296655, "uuid": "791d01b1-9edd-4882-8fac-b331a13abe58", "comment": "Malware payload (SnakeKeylogger)", "value": "855471933df6e031af433cba3496b6e002a57c9a23a47ca6e7f97e7275c50def54b874a28abc9c3c612034e0d7be58a5", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296655, "uuid": "c4f77471-adb0-46fa-a979-6d0a834522a9", "value": "2FE4127C72E8A97BCA3E40B142C094885B3193456AA1DFDD4CA1E3E845F3FE569123E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296655, "uuid": "60a78a33-0d2d-49bf-98c5-4939a68dd87e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296655, "uuid": "b861ab92-89c5-4d94-8ee9-77008597eed2", "value": "12288:iUSa8Cym56Uwa2iNZFhA/IGPbTB9SokqveVt2TH9oX7/mamrjXH415EVZS4gvWZE:Eo1XFhcPnZGcH9MmrbYvvvWiH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296655, "uuid": "33574467-b8ec-4785-82d7-61268823df62", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296655, "uuid": "3d13f537-c028-4574-8f61-22f49a28ca8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296655, "uuid": "e6d5c210-4576-40c1-8b01-dbeb267df2be", "value": "PO#HD512-6 5700)12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11204bb7-9c9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618348397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348397, "uuid": "9e852b6a-56b0-432f-8503-9d7c1ff420d0", "comment": "Malware payload (AgentTesla)", "value": "7384ccded5987f88529fa10f8a393922", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348397, "uuid": "e3c7a11e-0e74-4aa8-a9d9-a59a48a61388", "comment": "Malware payload (AgentTesla)", "value": "500210620afbcbf1bd6aa7e1928ea7091169c42a7f02840432be9d4c58dc26db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348397, "uuid": "1b9b0cdd-20b0-4ba6-a163-4c6b3e4d9abc", "comment": "Malware payload (AgentTesla)", "value": "947b889ac52600daec1435a6fce7e694bc5991e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348397, "uuid": "261f3c51-5653-4985-9f14-128f8fb619ee", "comment": "Malware payload (AgentTesla)", "value": "856eaa9a7f09d962873a65e15f20237f67f2ccdb56d9805dff402e52862fb9a0b9f86e51cffe877748f388e5d3d70aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348397, "uuid": "27f6135e-fbcb-40f7-a8af-bb4cd0632c23", "value": "21D4D0E42B1AD71CD968A7B9040141F133F3BC1296DACBC57DC47D5E646B602C2EF2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348397, "uuid": "94e4cdfb-32b9-4e4a-bfd5-0bf8e0bfa249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348397, "uuid": "a3311a5e-f825-4f79-85f5-871161c7b690", "value": "12288:Hoop9KUeVChT7s/c0HlIEngsNrtkNr4xalJPRLpTK:jfKUeVoFxsNJktMattW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618348397, "uuid": "db7a5a31-4b12-4214-86c3-b171573b2b93", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618348397, "uuid": "da0c35b6-04a2-4512-8f3c-f16f48ec5b2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348397, "uuid": "9a1f4a40-9da1-4013-ae74-1e165d7b811b", "value": "RFQ_078KEINIV2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0d8033-9c30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618301599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301599, "uuid": "740f3013-a734-4e3f-8497-295bcda11f36", "comment": "Malware payload (Formbook)", "value": "b2e46b8ad3081ee99c70acb3c1b17027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301599, "uuid": "1283fa85-6d7b-4ac9-94dd-b0156462ae83", "comment": "Malware payload (Formbook)", "value": "51176a8d50bde78f39d91c45d1286ae6394996c10248a50e46b4134da1903511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301599, "uuid": "64319517-37d2-4adf-8723-008e9b2e1841", "comment": "Malware payload (Formbook)", "value": "116efc2fb1209b02ce0b034dd7c17f7b5ae40050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301599, "uuid": "08ba2fd1-8ce4-4c60-a9ff-13d93003ee4f", "comment": "Malware payload (Formbook)", "value": "9a7a57b948d80370e043c723c7f7a5f36b716e6f41b0094479c68165495c42493c6e5b47c3f65708b2f69e5484f339a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301599, "uuid": "92e64b52-550b-471e-89d4-44837d60fdb6", "value": "B284397B9DD53755FC73957E2D81AC61B6260C0024232927F7FC7E8913BBBA2B20845A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301599, "uuid": "d2d64bdb-ad37-47a2-849e-1ae0fe09663b", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301599, "uuid": "fe2b1f0a-0ef8-451e-b554-4786ba3333e3", "value": "6144:rdeFFFFFFFFFFFF3CHgezqTUXtW+s5nzHh0jvy6HynjlUS6kMt:QTezqTYtWFxDdHnCHPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301599, "uuid": "0fb2cc95-fd11-4de2-ae96-a342d29582c9", "value": 375504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301599, "uuid": "d4110d24-d703-4bfd-b717-8b25af875f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301599, "uuid": "d6d27cde-172e-4254-98aa-d459e5f7649b", "value": "b2e46b8ad3081ee99c70acb3c1b17027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af89d88d-9ca8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618353387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618353387, "uuid": "3df23132-ab96-4941-8242-d096098afaad", "comment": "Malware payload", "value": "d2af3a4f2843aa206a5bd9a81d2c0680", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618353387, "uuid": "79dd2bd8-43fa-49ce-b430-c10f26dd48f4", "comment": "Malware payload", "value": "511ac09187424957eb24e6b917a7b3694007737056e73e00a40636b9f2d34571", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618353387, "uuid": "88e1c30d-5fce-4914-8126-d44f8bb7be37", "comment": "Malware payload", "value": "580faf09e778a096dabf0ac3ec0b07ae7688d43b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618353387, "uuid": "8fa4edf6-3d84-4fdb-9858-5aeaa9f9856c", "comment": "Malware payload", "value": "c1b0866db2d678151c21e1a830bb216c906b7f4a7606cdcb642b6d5b5f08186a91fef1a7ad1e6727eeacc70f2b4de26b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618353387, "uuid": "6462b868-366d-4c00-928f-2ff4bfb21e2c", "value": "E2A43350086CA91CF3D0BD6C3AD7D97C26ECB0046378C9A5941DB279667D83E13ABB2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618353387, "uuid": "5c36cf1e-d599-4ce6-929d-84b5444515e0", "value": "12288:DCJc62Ke7g+9Zm60F9gXb2EgMejDdZNWmf4sqzeRNJBs:V6leB9Z0Dgr2EXKHNWmfQz4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618353387, "uuid": "0715fd3c-1a86-4a2f-9384-68557d8d5105", "value": 486497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618353387, "uuid": "084be50a-190e-4616-a689-01c9267140e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618353387, "uuid": "276d8f5c-140d-4162-be81-25321c4d2963", "value": "VAT INVOICE_______________________pdf_____________________________.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284a42a5-9c55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618317512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317512, "uuid": "a68e96ed-4434-44c2-b44b-5ac48dc50506", "comment": "Malware payload (AgentTesla)", "value": "9a68970f1b6bfe8e1b34c806b28e01b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317512, "uuid": "d7e01562-04f7-4dd0-9960-0ac3d2b3e831", "comment": "Malware payload (AgentTesla)", "value": "53d0d18cdbfac08a202292b4ae5c8b0b1a62ea72ef1372abe5e451a5c5e15c03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317512, "uuid": "e03a96da-fb79-48b9-8531-3fbb9830483b", "comment": "Malware payload (AgentTesla)", "value": "b0ed6142a9e3b841b12433710bb8b3fc792181da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317512, "uuid": "0ae69eda-eecd-4ebd-89d4-7c0c5da0444c", "comment": "Malware payload (AgentTesla)", "value": "f6a16ad94e37616ab66822cfc6585ebee5e18a819bc8205d08c60e3234ea46e9282a3277242cd89f9f695bd42d046d99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317512, "uuid": "d945418f-81e8-475f-bd5c-09047279fdf1", "value": "11F4127E62AE897BC63C49F100D0B400E3B1629D3A62EB5D5CB493DA4574FE276097E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317512, "uuid": "3836682d-1932-4bf3-af76-9cedc52eca4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317512, "uuid": "9f4b68fb-9913-4506-b1b2-a48def7034b7", "value": "12288:fG12iNNFhuWD4+HTheYgzU5k/xBvKT5gt9kJBSweRtlBn5k:fy1bFhrD11eYlCZZOTPSwgld5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317512, "uuid": "ecd1ad21-7888-4be3-aea7-63562903ab4b", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317512, "uuid": "7d41f089-57c9-4cd3-a0f9-10228c287e7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317512, "uuid": "b7d164e1-af02-4784-9b33-4683a83904d5", "value": "Order 01001O02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e7a9e9-9c70-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618329054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329054, "uuid": "a6460bbf-eb98-403d-a419-e008dc81e35e", "comment": "Malware payload", "value": "7f35ea6eaf84464d10991c4ffb0e9b91", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329054, "uuid": "3a614bc9-4b13-4815-ab74-2974b0c486bf", "comment": "Malware payload", "value": "5561044c9ab4d581c24090bef73282c3dfc149dc6808814c56c9ca2c1f173a83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329054, "uuid": "85a0b164-70ad-48b4-bf69-15ebdb07655e", "comment": "Malware payload", "value": "7b0779b34a103a9f1f281e9dea02a6fc492fe240", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329054, "uuid": "ba161a0d-244c-47ef-95d9-6c732fb16dc6", "comment": "Malware payload", "value": "5cf72be88592266f0f4d0f13667a739934462097b3487f6e31187a22eb1c41a36f9371f798d533273752f4be895f7e29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329054, "uuid": "d7c3f77f-91b9-4b5f-a720-bc24eda7273e", "value": "2493F299D7974819DB72D036FA6689E26A0B35032252B00E308191D52EDB5FB0FE5EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329054, "uuid": "cf056c5a-907d-4716-83eb-73d1c88337fe", "value": "1536:/tf9gwtr3JfMCMHeh5AS+9SvyCbXwOHGE8feeTE0hJMcPmaDpdSu19ihY:/JF7Jk3rUvyCjws58Gf6JMcuaNB19oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618329054, "uuid": "92ebe863-209a-49b6-8663-1014fac12edb", "value": 96834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618329054, "uuid": "250633d6-cdc9-44f0-81c9-17dc2633ea16", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329054, "uuid": "16943b1b-8960-413b-86d7-128b7fa490a0", "value": "documents-590858122.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b903c43e-9c4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618313890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313890, "uuid": "2708080e-ba77-4a7e-ac96-56952ebfe8ce", "comment": "Malware payload (AgentTesla)", "value": "b4d5f491a197244f187815ffa07e6a67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313890, "uuid": "14f3b129-4a8f-4d1a-a459-82e21567fdaf", "comment": "Malware payload (AgentTesla)", "value": "57153e40e494be02a7c3591cc470105d38ec7a300183d9574afc4319998f70b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313890, "uuid": "c088de16-7610-4182-a002-e78ad70e61ed", "comment": "Malware payload (AgentTesla)", "value": "df79ba8f57538ce7a8285de77a3182bc7022af55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313890, "uuid": "2c520925-e4d5-4a9c-b645-4f86d180a886", "comment": "Malware payload (AgentTesla)", "value": "031198c67bdc6687783d4b2bf1fc8fbdfdcf3c7f87a18d5cfc4caad22148205dc4d1b61aed0f0e724d694ebe469cd8e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313890, "uuid": "25b45e18-9568-4268-945d-77956a0f4d49", "value": "1F1523C405FFA3D30CD333724EC78B09A0B5FB953D69476286D1B649636532B64AE34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313890, "uuid": "7d482e18-0796-4c11-8cf2-055b471a93cf", "value": "24576:BBtaY97XIb49qKN/zGqSxHYBtaY97XIb49qKN/zGqSxHf:B6Y9DI49LTSxHY6Y9DI49LTSxHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618313890, "uuid": "ed2fc387-3136-4461-b2b5-9ebe4dc71ba0", "value": 960816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618313890, "uuid": "fd066333-f20c-4fb2-8c7f-cdbb810b711d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313890, "uuid": "4a88d7e2-25bd-4000-aa3c-94d2bbd02d4f", "value": "Official Machine PO.241120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed7d767-9cac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618355050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355050, "uuid": "46a63491-3abc-4981-a926-7de5594c7904", "comment": "Malware payload (AgentTesla)", "value": "c87932c9689f5c2cc0f35d183776e317", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355050, "uuid": "5add8c41-b7f9-434f-8b5e-6084e9eaed2f", "comment": "Malware payload (AgentTesla)", "value": "577d4a686110fac3e636d9aa40e4cf4b8234f8fb87a7b584ee9558496c3bf1aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355050, "uuid": "b364ffb7-5516-4e2b-939d-014fca394ba5", "comment": "Malware payload (AgentTesla)", "value": "ccb00f9db48884ba2f651169e2b9bbe1539acddc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355050, "uuid": "a0723f2a-daee-47c8-9a59-b1f5bc441aa9", "comment": "Malware payload (AgentTesla)", "value": "49348ba2a78fa2f98e00a9f3a9ee1e88910a08a720f0493a204340c4bc82aecd08ffae88bd5ab95f5c8af97f81d3c969", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355050, "uuid": "4a426ae2-131e-44e2-b57d-63dbac82e618", "value": "96A42305C4194076C8E66DBFD690841281B59EC877318494FDE23BB317FA7AE5ED21CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355050, "uuid": "4214ee58-3e33-43e6-bfed-ce9796c50564", "value": "12288:PT556BE68GFBtwNuk+Fis+tH78/+vUoHkRrR59gPQ3s3:bv6B5BusF+tw9oE5gY38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618355050, "uuid": "587586d1-b1c7-407c-b569-2470ada7d9f8", "value": 486460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618355050, "uuid": "64e75144-8df1-4851-b807-34a61513de43", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355050, "uuid": "37f8d312-ca21-4b79-845d-f7cb7960266d", "value": "BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT 709447464231.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67aaa4f-9c55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618317724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317724, "uuid": "a5bf8a13-87f6-4b0e-9f9e-12a55244235a", "comment": "Malware payload (AgentTesla)", "value": "87797ee7639b67e5297dbb810af5bb78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317724, "uuid": "a6380667-60d7-4d6a-958b-3b16b7f70230", "comment": "Malware payload (AgentTesla)", "value": "58ac29f3dc15440b4d98dd855f69c901a51774891a85e01cc53de308b632aaa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317724, "uuid": "adbf3ff4-15b1-463e-8743-c68768bd7965", "comment": "Malware payload (AgentTesla)", "value": "b0a99c3d1e395aa1d672fd5311d0b715d5ace24f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317724, "uuid": "9f90f1f4-dce1-40f5-ae8f-891d54bc7c72", "comment": "Malware payload (AgentTesla)", "value": "bac5d192eceaa91a5e4fed77d4435ad19224e935648be12fc2c6251403ac5c65e5ae888a04ec115f92f40f169d742016", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317724, "uuid": "c0c31d33-9299-4173-a356-8f32b121e18d", "value": "4F649ED1F15088DAED6B49F1BD2BA5302493BE9C94A4410C569EBB1B76F3342309FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317724, "uuid": "36e33028-d1ad-4cbb-8a17-1c762a8f4d7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317724, "uuid": "6c4131e8-e9f6-417c-92b2-19f36036b677", "value": "768:KbDPrz9t0sDiGUGflg3zye8rjcljsSRGBf4hTfdUzzH8TbtRuzg2/lwkK95WM5:KbDPwsDuFcjcRsorTPuzg2/lwL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317724, "uuid": "b7094962-fc05-4a19-9862-c556ba3555aa", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317724, "uuid": "70551c31-f9ae-420a-a90f-5789363c40e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317724, "uuid": "7805fb7b-406d-4b4b-88eb-843d6130af9a", "value": "new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c449095c-9c46-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618311331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311331, "uuid": "a88b4631-3932-40c5-91bd-7dac15f65787", "comment": "Malware payload (RemcosRAT)", "value": "b82d6cd9096026375c0e930ba11d760f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311331, "uuid": "6b460441-625a-4aac-9416-e7a74f87a8d8", "comment": "Malware payload (RemcosRAT)", "value": "5968501b6456f12a9f36071f5e663bc48214007b9ff78601cb3e5585b8df29e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311331, "uuid": "fa7f2542-8c55-4f47-8de5-85560b965e8d", "comment": "Malware payload (RemcosRAT)", "value": "22588876117b44b97d91e565a11f762e57b4349c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311331, "uuid": "4e2b0dbe-ae65-4a34-98cb-9745cb086086", "comment": "Malware payload (RemcosRAT)", "value": "8a8e62d2314a4161e469186b507f581097b91afd09ab57776fba4fb85a5fdc55ed6a5de7c479eea5493c535e148e0769", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311331, "uuid": "4e8b08d3-b6b3-4422-99ad-3fab2bdae03f", "value": "406423D89EF62753A79205461DC8DF341DC4051FF991E07A3DC9CBBDA0CAAFA1848887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311331, "uuid": "627ee2be-9839-4c1a-bc40-75c5bbd672b5", "value": "6144:4g3gHJ8TWMF6bkzCGED3RMykhOCLGX4fdvqN2ex1YHPqvM0pxe+7E:x36IWMAbkOBehHLGX4fdqNFwHPaMY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311331, "uuid": "f7fb2cc0-4f36-46e7-b4d1-579ff95f6a23", "value": 317439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311331, "uuid": "1d2eb5f7-594c-4729-bfd4-b4203439fb27", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311331, "uuid": "a60d2acb-f2e8-4abc-a8f4-cce48a8eb084", "value": "Scan_Documents-001HD4847DHD346G.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e9fa36-9c2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618300753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300753, "uuid": "6263f010-6114-420b-9211-98e7ba2991a0", "comment": "Malware payload (Dridex)", "value": "b6d564b81b10214b855599fe12443878", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300753, "uuid": "9942b9fc-6e52-4fae-8ca5-bf4c355da5bc", "comment": "Malware payload (Dridex)", "value": "5b57f69b0ced99442ed8adf46eb8de14698bb4e006d3681edd9203e60624009a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300753, "uuid": "f09de04c-1e60-4162-ba55-c01ed838ed4e", "comment": "Malware payload (Dridex)", "value": "fb86f7857d3a97772b976ce351649332d26237d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300753, "uuid": "ead2ec59-636c-47ec-8920-e1e683399d3f", "comment": "Malware payload (Dridex)", "value": "ba550a7dd062a2341f8f716f8e3bf77ff34c5ced6090e5471f41cbabba16b2d046e0f53f80930da7191c22385ca4172c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300753, "uuid": "483374b8-b5bd-489f-8dec-a3d27d4fc624", "value": "99F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300753, "uuid": "abbbed02-2dd9-4d80-8013-b57c67f7c8fc", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300753, "uuid": "c7ecfd80-3349-46b8-a18c-13b53d3f412b", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300753, "uuid": "5143b289-e052-46f2-9233-a747428d8f68", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300753, "uuid": "80666daa-48e6-4222-9b51-dd839a29d56a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300753, "uuid": "ec975adb-716c-49f9-bd95-f71ca43efe81", "value": "b6d564b81b10214b855599fe12443878.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413cf96a-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618300374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300374, "uuid": "3e59afd1-3340-4232-bca4-84f14a9650b5", "comment": "Malware payload (Smoke Loader)", "value": "9fbd32c6bb25f6a660696fa9830c5040", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300374, "uuid": "aa380d91-2cfa-4ea4-aa6b-1277dd5dc9ac", "comment": "Malware payload (Smoke Loader)", "value": "5de2819f832f06f69009b07779eacabc1b171540b10689b4b23eaac8f3232e14", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300374, "uuid": "19a9cc99-2162-4c97-a271-9ef5b53c3806", "comment": "Malware payload (Smoke Loader)", "value": "1e41347d36792e823a8982b10170d83a0722e3cc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300374, "uuid": "4976f08f-45fa-4af5-872e-cda31d7be1bf", "comment": "Malware payload (Smoke Loader)", "value": "d9cb17578b7c4c55939c7932cf9a35a8bca18141140fe4a3ce27f9cd1fadb295c771fcb63c1c531f5dd0038f0c1084c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300374, "uuid": "e2c3e52e-64b7-45a1-bb2b-4728f1a95cbd", "value": "B6058B0273D1C036FFABA2739B6AF60556BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300374, "uuid": "29b52cd2-97cd-49ca-bbb6-8b87af8079d6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300374, "uuid": "4286655d-7876-4fa8-91a9-eed3ef718f4c", "value": "24576:8AHnh+eWsN3skA4RV1Hom2KXMmHadhp5:bh+ZkldoPK8YadJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300374, "uuid": "485dd8d7-fc6d-41bf-8334-89003d45f230", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300374, "uuid": "be9b1e7d-5a19-4bb9-b5d2-06f322f202d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300374, "uuid": "cf98b1ee-97d6-477c-9e9c-88ff987bb8cd", "value": "9fbd32c6bb25f6a660696fa9830c5040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456e291f-9c61-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618322715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618322715, "uuid": "a69dbc25-1e45-43be-8150-eb70979e5888", "comment": "Malware payload (AgentTesla)", "value": "49988b8231690c0dc0a4b9c1119c76ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618322715, "uuid": "d4bdfba2-a2ce-48fc-ba5e-5d20be4bd904", "comment": "Malware payload (AgentTesla)", "value": "5df19a3f5cdbbae0d9305ebb6d7923fd7f355f4b5551756e0f71f79cb014568b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618322715, "uuid": "d9959096-4835-4e17-9680-91eb2667c323", "comment": "Malware payload (AgentTesla)", "value": "c02a7841b5574a13712fba9fb4b83931baea37a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618322715, "uuid": "c14214de-2a7f-47df-ace2-33c5eed89571", "comment": "Malware payload (AgentTesla)", "value": "2a65c214d5469a982f34f7997dc2ecca62b47fe9b55fdb616aef3e785a4af721bc728ce821c1f41c5a28993a9a32be9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618322715, "uuid": "9f34f53b-31f0-43ab-85d0-8495ca7265c5", "value": "68C4CF11669DF78AD86D17B2D8A08A7003736257E366C70FBC8D10CD4FA6B42F928797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618322715, "uuid": "5e56f70a-477c-4328-bc60-cfe70cf9666e", "value": "6144:5hmObWsvZ6CJhLHVbGIDlkqSqqm0pnzN5yLBLyS0KOTxLpDA:16C7J6alkqSqqm08Jyf1LpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618322715, "uuid": "34c293fd-03aa-4839-b653-e30af1a86e88", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618322715, "uuid": "b0642fac-d74e-465b-afea-2f80ce7c6944", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618322715, "uuid": "e266a714-457a-4320-a033-b3b650d84cc1", "value": "Request Quotation.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d2f02d-9c51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618316007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316007, "uuid": "01bc4e94-f1d0-4d94-b05a-272f3c66bac6", "comment": "Malware payload (Formbook)", "value": "1bdcd0c57af6df60cc6a2544ba32767f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316007, "uuid": "e3274c47-e22b-4197-9bcd-d4efd8346c1e", "comment": "Malware payload (Formbook)", "value": "65736c76cde32cd03d3d666a2164e85c6b445a334afb41df023f73cd32559f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316007, "uuid": "51d5aed5-2dd0-40ae-b22e-27a53122c070", "comment": "Malware payload (Formbook)", "value": "178e77ce88d5f731c08a838e23f3e52ee26b9236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316007, "uuid": "d2eb0f6e-f1d6-461f-9394-befe08fee2c7", "comment": "Malware payload (Formbook)", "value": "941277774d0add3df8c903003e4dcc8416e0752454dc855e55a43cd1bd1dbd7d780bf7dad38d19cc1bb563be6ec95a9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316007, "uuid": "2e748f14-a91f-4363-b910-cddeb1fe19c2", "value": "EBD4E0E4260AD32CD978A779044141F533E37C1156EACBC57EC07E6E682B642C6EF2B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316007, "uuid": "c3529378-d2be-4280-82c2-f235d0e5308a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316007, "uuid": "7476db59-de84-4b7c-8ca4-f8c7c588f4ba", "value": "12288:MEpcPu88hklXdCK/lPrEEJPldDS79PmYsKh1AQiByiS6K:TOP78hkp8K/lzEEVl5whmGh2LBV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618316007, "uuid": "7f78b4e6-1ddb-4a8a-8489-0fcba797beef", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618316007, "uuid": "07214466-ab38-4cb1-8940-507ef09324bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316007, "uuid": "bf356cd1-f6cb-43c1-af84-fa636231e64d", "value": "Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a47df8-9c1a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618292490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292490, "uuid": "23b9279b-3b69-4490-bcdb-b6b81d2e2e74", "comment": "Malware payload", "value": "deb5aa8655bc71b6c4e23b82fd44f067", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292490, "uuid": "7dc14761-9d89-4ca7-bd01-7bd8a463457d", "comment": "Malware payload", "value": "66da09f6742cf21d468ca0e13a24015d0eb08c4e8cc05678ff70bc97166ed279", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292490, "uuid": "9e048c0e-04b7-44da-aeb5-ecbf23ae83d6", "comment": "Malware payload", "value": "b7a86a13796bc7055ba43e88c31aaea9f3c5211a", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292490, "uuid": "64bb6c97-f498-4fbd-b51b-a54bfd5d5b40", "comment": "Malware payload", "value": "906fefffab2dfb42b22353adcf3ff5bf929c0c47ad57ed6fc26b6062df8bacfcddd39293a000bcff49d9f9d19e04e7f2", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292490, "uuid": "5463144c-aa8d-4aa9-a41e-e2a9efb422ab", "value": "4B024BF0CC40A79DCB9AD196881AB7ED052E797C71D35E863C6CA965BF5E6A90331040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292490, "uuid": "ea8817ad-7d82-4561-9e51-7253aa6c33f8", "value": "192:+nQ7LIJufUZXSIIXKrw34XrXN2TGJsRnH5Q/b2a5su:AQ7swflxy3zNOjRn+/b2KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292490, "uuid": "0ebcf32d-2975-427d-a678-58fc651be254", "value": 8294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292490, "uuid": "3e13aba8-8046-430f-9464-0c73eb5b91d4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292490, "uuid": "e3a5574c-23df-48ff-a626-b3bc2b7ab3db", "value": "deb5aa8655bc71b6c4e23b82fd44f067.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2435ef-9c2f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618301470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301470, "uuid": "e72396d2-9e1c-4378-9182-730a96e59254", "comment": "Malware payload", "value": "136726953fabe56c1752327c29dcc513", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301470, "uuid": "dccaf195-749a-4f8b-a605-d6a4f73f7abf", "comment": "Malware payload", "value": "67e2b31d9901502270dafcbeb6d2fbf1a7e4517b438fb7c2bd7837c92428c9ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301470, "uuid": "96cdc931-144a-4be7-ae87-e99c47dca3ec", "comment": "Malware payload", "value": "63a770fac36c68dfe5e84510bd5f1fd7fa3d2fea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301470, "uuid": "0518dace-1586-4a95-a550-33216bacaad9", "comment": "Malware payload", "value": "86d18bc39421373f7d9d72bf261907b312c7ded44812944fbc045534fd02fcc40373c418217ef8d1971cbc4c09cb5bb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301470, "uuid": "5cca7d0b-8f21-479d-81f3-8aa37e771120", "value": "E9548C59B7A510B9E077913CC9575906E7F2B8170371DAEF03A0426A3F273D0AA3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301470, "uuid": "a835c0c1-c8cb-4e93-8ce5-bd35eda2bbcd", "value": "251bd65e7ad85c8f203a739fcb998ce2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301470, "uuid": "a284ba04-f223-49ab-bf09-f3921cc3c403", "value": "3072:LHsfvkqyGrkPMbvGBWTNhocFFzebl97EA71mnOsaNUYZ7NrNzEToY46LcPc+UIZl:wLyGrkSvGBaLJF5eB97EnlYZoohROI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301470, "uuid": "9c50a951-f5d9-4677-b743-bfcf0acce3c1", "value": 302382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301470, "uuid": "0cce53bf-3a80-48eb-a164-6c8ee4b8e69c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301470, "uuid": "dc392966-02f0-4442-b037-12f10b63d8c0", "value": "136726953fabe56c1752327c29dcc513.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669e1212-9c7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1618334797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618334797, "uuid": "aa9d101e-f7c1-4adc-869f-104585a245e7", "comment": "Malware payload (TrickBot)", "value": "9d8889711256df5fba21cac45ff2be6e", "object_relation": "md5", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618334797, "uuid": "2496703f-bcb3-469e-bcda-e771bdc12125", "comment": "Malware payload (TrickBot)", "value": "68ef8ffa46a0d0ea1a981ad7bcfbaf1c7ad2680ddfac2a2d4b0822a23aaf4247", "object_relation": "sha256", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618334797, "uuid": "9df94801-a9ca-40bd-9c16-a0f3fad6f915", "comment": "Malware payload (TrickBot)", "value": "72c600faaaf2168a46922b101589dff2c3579264", "object_relation": "sha1", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618334797, "uuid": "7bd077c2-b8ab-4d01-9ea8-7a013ad84fe2", "comment": "Malware payload (TrickBot)", "value": "6fedad4ea618bd5187474eb95f9e5d86aff5d6e841256860ed1e67ec55677ea93af4fe00c07d594c500f20cbe55e5e65", "object_relation": "sha3-384", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618334797, "uuid": "e6598e3b-c33c-43aa-a5aa-fe6149c67f16", "value": "4C0435178D1C45C2C16E92F87E421EED3D092B5DED46AAFF25606FCA3E640930D8E16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618334797, "uuid": "e6c707c8-8e31-45de-9e60-69e8a679968c", "value": "3072:LRq4BgwRQXYDBipuk9ESroQT09YOUpM4SPtD+KfFi/VkDr5cc:LRq4+fYdiM0rrTsGM4SPtDr3D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618334797, "uuid": "04ce8d36-602a-4e8c-910a-da4c92f889cc", "value": 186659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618334797, "uuid": "50aaf162-f58c-499b-8646-7a5567a458a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618334797, "uuid": "d69ab7aa-2145-4352-9db5-c6134df414df", "value": "subscription_1618334083.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbd6a6e-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618300341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300341, "uuid": "45bddf20-2c11-4859-9594-d79802470557", "comment": "Malware payload (Formbook)", "value": "10a6ee4d2adc0ebf2c35aa538c391622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300341, "uuid": "ef9b0145-e802-43c3-a1af-58b558028a01", "comment": "Malware payload (Formbook)", "value": "6a3dbe59e320ddf283fdf1177f3345bba999e7b55e5c2fdb1eab9e2247b97eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300341, "uuid": "f12177eb-4950-475b-8cca-23106a32d9f6", "comment": "Malware payload (Formbook)", "value": "a098e20077e6b9fb45acd8eb2360dc4334a58d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300341, "uuid": "b5bd2ab9-24c4-433d-aa21-2df5d6514683", "comment": "Malware payload (Formbook)", "value": "03a80f3c22b5c0d960019f9b87ad1110c61a736e2fe5aff5e330ca0b92d607c1db5b01fefdc878deffe8e378ebdc9e40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300341, "uuid": "f01d9a4a-595c-4025-8f3c-95af7bb7f1c6", "value": "1274CF0132D1C076D05325B58619C7B59FAE78316A369ACFBFD90BB90F286D19B3630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300341, "uuid": "461f71cc-0d40-4820-8f19-91078d751f5a", "value": "0b6968a3728849da0a75cdaf93956fc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300341, "uuid": "2794ff42-f663-4dd7-b3e1-5dd9b579b643", "value": "6144:MMoLbMrySpdoKlkHK4VaAr02Uyaf2WAqa+bU2zC6CnFtnPE:MMo3rAoKyHK4VaW09y1WAqg2SFZPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300341, "uuid": "7c4c71de-146d-416b-bd9c-1a4bd16d870e", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300341, "uuid": "5887ad28-a6ee-41b6-b065-555c37e4cc19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300341, "uuid": "88e7bb01-b981-4ce6-949d-6f2af113b7c5", "value": "10a6ee4d2adc0ebf2c35aa538c391622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8304d27-9c1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618292494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292494, "uuid": "5355e915-eeaf-4510-9e35-7d9df40f0594", "comment": "Malware payload (Smoke Loader)", "value": "67cb98b84a7db5f2f69023b0c5c08309", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292494, "uuid": "f88bd939-8e61-419f-aabf-d7e92584895b", "comment": "Malware payload (Smoke Loader)", "value": "6b2e23e38be7ad27c11af03599f5caaf69dff237e39a5ffb1904db398e613221", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292494, "uuid": "c9af4b45-2b54-4e11-9143-1a52493770c5", "comment": "Malware payload (Smoke Loader)", "value": "9f04a27bb59ac6842ea400c95af131612bfe00f9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292494, "uuid": "3792f056-d0f7-4cd3-bf2a-e8bca005da27", "comment": "Malware payload (Smoke Loader)", "value": "209ed0e68477e843f8afdc3c6615792e73fa0ede7fa3c0590aef9c07cddc0ae3ea08c039def87293af2b3ba6567eddf7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292494, "uuid": "d7aa09bb-16e6-4a52-bb18-11e0c4405090", "value": "C135D0F8230426C2DD5B2D459A457DA93227F17ADAC61488F49EF7FA237F644CE08C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292494, "uuid": "1c346ef2-1583-413d-ba41-e3a47d66e35b", "value": "24576:T7777777777777777777777777777777777777777777777777mtU5e:mtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292494, "uuid": "84e31ef5-9731-4006-acff-6f5d05257b2a", "value": 1152096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292494, "uuid": "e1321341-348e-4e7d-83fe-800530ef6efc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292494, "uuid": "a7411560-04d0-44af-975a-fa254154b17a", "value": "2021lk049443.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4593ed5-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618292810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292810, "uuid": "dcec594a-2e30-46b7-b7b6-590037390806", "comment": "Malware payload", "value": "d756b5c2bad5a243c2c764de12b48583", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292810, "uuid": "b1444806-ca37-457f-90d2-dad192262f01", "comment": "Malware payload", "value": "6b4e502ead3025a0ac1a0fb6352f0fd0664e25d00cf4bd29de25a3b92b427998", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292810, "uuid": "844632cf-1be3-4de6-8e1e-f668c9c076e3", "comment": "Malware payload", "value": "465beae5063ae6aff33d35249f05925e17dbf635", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292810, "uuid": "6b7c1854-a7ca-49fd-91ec-1966f3997ec7", "comment": "Malware payload", "value": "a4796b0cc192d13094278c01a2660a5063641ebe8fefcb91f559f09027d9d1388a4f77a64c64cd490cba020ba171af62", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292810, "uuid": "17929441-04ae-463c-9af5-ec66b2370943", "value": "8EC53306F8CB9772C89DA8B7D15FC0F4667A8D561C289601331E33AD21F66A878D739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292810, "uuid": "f68d8f2c-7ef2-4071-85c0-cdfc2a4eea52", "value": "49152:7VHgHP+CJJgeKoyTBRDpPHHyngRTwpsEdtLOgIL0jci6XzEoL5LqJyf77x:7VYP+CJHKDTNyrpseMGj+Yq2Ju9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292810, "uuid": "c190c7df-14e9-4671-92e4-664b98634927", "value": 2519552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292810, "uuid": "8aae58f2-abb4-4090-97d7-3e2dabc5a4b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292810, "uuid": "b9092514-de97-4067-aa59-e59ba49b5437", "value": "Invoice-SRP0047459188e.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35ccf76-9c39-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618305800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305800, "uuid": "ac6256ea-de60-40cc-a182-d1c666134145", "comment": "Malware payload", "value": "86b3eb06801b81012b7300076e8a26a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305800, "uuid": "b8be17ad-e1e5-4bb8-b8f2-98ff1cf6928d", "comment": "Malware payload", "value": "6cdadcad860714b7eab83df7b607aa47fdf87dd64efbdf419504879097d26666", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305800, "uuid": "8535446f-ade6-4d06-a959-f662c3a6ebf1", "comment": "Malware payload", "value": "d316d1a0cddf89e409ef5733380eec0e58abf84b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305800, "uuid": "4bf6cb78-9972-4fc5-ad6f-60c1a7888046", "comment": "Malware payload", "value": "a9bc0bb16ac5d5fe881aee1b606f7ed3320009c36c7d228c847e3cb71a9a4ed5820c802e0d5c5fb20fb41f4bfacc9803", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618305800, "uuid": "0915512a-5d4b-4404-95de-af300cffddf4", "value": "12B423D15ECF957583434778C22E99BE8772FE46863952034364FE0D4BB8C8AE2DD286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618305800, "uuid": "c40d28d5-ba38-42fe-94a5-2c00db5ad7e0", "value": "12288:9kC0NmwpjXqaD8uPvlwG996VQOQd+wSooKn+6FVCh:GmwRzw/eOQd1UeCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618305800, "uuid": "fb69afa9-2211-48d6-a6cb-304949018177", "value": 495488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618305800, "uuid": "a12565d7-4bf0-43cf-b7e6-563d0bee68b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618305800, "uuid": "2fa93a4c-3d7a-4082-9b81-8fedc2414dea", "value": "proforma invoice.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82da26c9-9c47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618311651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311651, "uuid": "e3286d98-8785-4e6b-982c-454d0cff4446", "comment": "Malware payload (Formbook)", "value": "76716da82ddea6b11851468a523246a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311651, "uuid": "5c0f969c-77f5-424e-9881-b6d96616492e", "comment": "Malware payload (Formbook)", "value": "6dd32c31350f5e395c1e4e4571e3f0ad142d55803008d2371e041059bbf1b410", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311651, "uuid": "81bff60c-bb15-462c-ac5e-2325a750067b", "comment": "Malware payload (Formbook)", "value": "50f01b7bc9f5674535cd23017be1734d4543f44a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311651, "uuid": "a625fc91-d68b-474a-a544-704991aeb1b6", "comment": "Malware payload (Formbook)", "value": "32c3580a78ff42c4a65dfde80dd6022c02ec708b153e6d69096bf8198fdc43b69cc569d2f14605dd30455a8b0fb3084b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311651, "uuid": "663946ff-5474-4062-ab86-6056851e4ed3", "value": "DB24233832B5F86D272F0B9265B53302C0AD16415D9AAE0BC6BE495873E32CC4753E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311651, "uuid": "59101239-a3b9-48db-9274-e0acad5afdb2", "value": "6144:fgJqyoypLg/BrhR7a+Cl35wqbP+dIkkm0L02tU+j7zAv:IvjLg/DRT6weuIP/vtUCXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311651, "uuid": "82e90600-9227-425b-9789-86e0daaf439f", "value": 215369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311651, "uuid": "8adb177f-7489-4ff9-a48d-dad9059197c6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311651, "uuid": "8c415eb9-cfed-4cd7-8757-918ef27d5ac5", "value": "PI.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3864aa40-9c51-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618315821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315821, "uuid": "4d759e40-8bef-432c-8692-f19c48a972dc", "comment": "Malware payload", "value": "24bd4a3d25c469bb138fb16e587dbf02", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315821, "uuid": "750a1d7c-1450-4054-a708-3566cdcc038b", "comment": "Malware payload", "value": "6f8debb6acde9b5b878188327ea348102cc125e8f72245f79fb39967821a91fa", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315821, "uuid": "91996a62-d70c-47d2-a66f-0cd27b390762", "comment": "Malware payload", "value": "563d37fde327ea4fb70fa3959079f72161711722", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315821, "uuid": "13de23f5-2a5f-483d-8059-8c6210f66707", "comment": "Malware payload", "value": "a97c7494966d3ec35b17c1cee21555ffcad3eb495c6c1c35ee12c922afd103ef8ff7536af8b7ef46b1a265b51cbaa70f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618315821, "uuid": "8917a2cf-3c11-4b2e-b98f-b3718c05057e", "value": "FCA41227CA28C7A7C42206B374025EE9F9DE1489DFE17B1C367E3DDD1350A523E89528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618315821, "uuid": "8cf1eeb2-9a05-45b0-a7a8-c3f1861ac5f8", "value": "12288:xT6+8Ht6n1Wm8nbbJC3rusVrsiTdwYLKkwbyjAKEz1g:FoQnqnbbJC3rrTvwbahEz1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618315821, "uuid": "309a52d7-9ba9-4f57-9b2c-9135d3368ad7", "value": 477500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618315821, "uuid": "764e1191-5d64-4bde-9b9c-f492259d098a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618315821, "uuid": "d6155ad2-df50-44e2-9c5d-bdb53bdaa5b0", "value": "OMSMarineServices_order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9928aa45-9c51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618315984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315984, "uuid": "dee9d28d-c7d6-44a9-907e-eb0c88ed33ab", "comment": "Malware payload (Formbook)", "value": "84d1de6beeef5973d33a4cf9c8cd1e05", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315984, "uuid": "9d686e22-8c7c-4b9b-b755-7f18585250fc", "comment": "Malware payload (Formbook)", "value": "70a5ab9b9b2a7d07d942fb38acf479a05978995d7e5328593bf9ef1d74d1da7b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315984, "uuid": "8b137107-6e35-4c67-9fbd-2c19398dbafe", "comment": "Malware payload (Formbook)", "value": "f81d8104fa41de11ca00d65099ca7b00c120152f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618315984, "uuid": "9ab38b82-b8d5-4b37-a77d-f1e6ed63c3e1", "comment": "Malware payload (Formbook)", "value": "3c94599dfbdf8bdaf5d5daa48089e7ba05c6ac8d221efc33cf1535a1ac8b883690b99f6ea8dd8d83daa1c4b7d1f8c3f1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618315984, "uuid": "5812f210-9d54-47a0-a2db-b9d4ec0103b2", "value": "18B4235264BD2406BD7453E3876A87F1A5D1E087CD87E40B10F3D9A6CE78AD17A30AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618315984, "uuid": "c876c6a9-bffc-41fe-9d89-407db4b575ee", "value": "12288:DlR+Ke/5hpClXnO84fSy/gc0DcwsGtpJyPk2d5a7Ge:DlR23paOv1/gc0Dcw5KkcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618315984, "uuid": "06dbabc5-3473-4ddc-b3ae-3c4f7dbf7319", "value": 496085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618315984, "uuid": "f8a72e86-987d-4d89-a951-2dd9d35d2ad1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618315984, "uuid": "519529a9-990f-4e76-bba9-aa10a6b66883", "value": "Packing List.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558f50c5-9bed-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618272920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272920, "uuid": "58939b2a-870d-4eb3-820e-0426a8fb8487", "comment": "Malware payload (AgentTesla)", "value": "32ea017ce6cc2c399edf944b15e97518", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272920, "uuid": "954442e8-4cf0-4868-9549-6bbee0166fa9", "comment": "Malware payload (AgentTesla)", "value": "71ad4e9269c1c7da1c647e0caa416e00946f0a7bbf7cbb7875aa93c1b4453ef3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272920, "uuid": "facf4831-5a76-4ce7-8d7c-8c448fdb7eb5", "comment": "Malware payload (AgentTesla)", "value": "addde94265f65cc532729a61c4331d38884002f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272920, "uuid": "533825e1-336a-4b9b-82d3-399a2358d179", "comment": "Malware payload (AgentTesla)", "value": "6d8a5808adb7a86c5475ba97f59923f6a4d793f96833e49127be29c21c7687a8deeb7db868c2a22e23dc96b2cbe3aec2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272920, "uuid": "e185f88b-6a69-43c8-8089-985f1e555ae9", "value": "7705682362BDC6D2F82D7EB54421831206B5ACCA2433E65BC94FBCC5E437A1BCD949D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272920, "uuid": "bdee7313-4e94-4bd4-b278-cf9ee75b1848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272920, "uuid": "25b41693-81f9-4842-ba96-7773373b3dff", "value": "12288:WXPiP5RrWyeYH43OFiRr1HdhC5cfptG/AyD+vqI:CixRqCYeFi5h3oMt0AyCvqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618272920, "uuid": "45a17a74-5699-41cc-b38d-0ac5b1eb683c", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618272920, "uuid": "110c37d5-dd31-49e2-997e-2afd4c7d9312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272920, "uuid": "170e36f5-84b7-4ab0-bd86-3c923646743f", "value": "Quote request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e2e95c-9c26-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618297620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297620, "uuid": "351a925e-022e-4854-b891-e6b95cbd0b8e", "comment": "Malware payload (AgentTesla)", "value": "546b562e8622be3758f57b7ad57288a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297620, "uuid": "b8af2907-ac4a-4d3c-aa16-7e521e96eefd", "comment": "Malware payload (AgentTesla)", "value": "71c8c0b87172beb0ebc1bb67c75e43235963a81a85342125256323ecf51cad57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297620, "uuid": "74e29be5-39a1-412c-959c-a455172d50d1", "comment": "Malware payload (AgentTesla)", "value": "c1e1f20e28a2b0a80535d40d144b61931cf6ceb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297620, "uuid": "469ead40-98ec-44da-839e-4a6dd1b8a1dd", "comment": "Malware payload (AgentTesla)", "value": "74898777caad9eaf99edfd5d0e4e9bf5e4d17d4b3f0fea17fbf65d816e09eeca4276549e5c0aa139d0d7ee8928378691", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618297620, "uuid": "7290ac54-b0ef-4ad7-bca3-207071910f6d", "value": "38A484ACC09747EC8FCDB7B46A1A1F891208B76DE345E5533638A7B52B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618297620, "uuid": "f8cb97a4-05f3-4add-85f7-1da077aca653", "value": "6144:ElNNuUTIwbqkKuL7SxwqtOKz/cRWRRD/GoicGmaynEIaicslF5l:E/D8wbqpuKaq4I/BRRDOoitOErQ75l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618297620, "uuid": "8aeeb642-a793-4092-9504-bd5755ba9808", "value": 458399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618297620, "uuid": "4ca4eb8b-fb8a-4305-80b4-4994eb800cd9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618297620, "uuid": "34d33565-18f1-45ee-ae20-b64be923852a", "value": "20211304-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaa4c19-9c57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618318328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318328, "uuid": "de07fc5e-1f25-453f-976d-d67b1a074c25", "comment": "Malware payload", "value": "59d67c07a49993ee60a7ada838b4321f", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318328, "uuid": "2ccc30d4-5642-419b-97f5-4a97fc8c0c45", "comment": "Malware payload", "value": "740b1a3850fd5c6aedde9f7e415c9c7dd5aa38b38aad5922c16d9b84995d196a", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318328, "uuid": "adb75353-7955-4446-8f68-71676dcc7210", "comment": "Malware payload", "value": "7edf39719e8b09dc40f737da37b5784acd51def5", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318328, "uuid": "493c5a82-af46-4d99-a135-807778d89f70", "comment": "Malware payload", "value": "8a4f6d0e3f24c2fbf7b77b2f1e5e8dca2a7b11430ee797ef4a7147d8c10d106aaeb3a04b497e919cc79ee80a8a553f6a", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318328, "uuid": "57092478-fdeb-472b-a78f-1e63c99e560e", "value": "6AD4E0E52B06D72CD969D778144141E133E3BC1196DADAC9BEC03D9E746B242C2EF2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318328, "uuid": "187c5421-b33a-46c6-9a03-a8aaa6fd63ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318328, "uuid": "00a5a1db-93a6-4013-9788-885edaa74861", "value": "12288:gfpPkxu2kWrkUkLUd9AUqFrK0frwo6l0lUCmhlWK:UhUuttUT9AUwrK0frwrbCmnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618318328, "uuid": "16135972-e849-49b6-8d26-ce77631e9245", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618318328, "uuid": "b3f3624d-082e-479e-a23c-e643b55915d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318328, "uuid": "1e420276-ac89-464a-afc6-1f541d7eb405", "value": "EWDC99575757.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03739564-9c49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618312296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312296, "uuid": "1949e737-bede-4778-bc40-702e5d8c6915", "comment": "Malware payload", "value": "f4d6fcb61ba4b2d4340c9076accd6cf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312296, "uuid": "88649ca1-cc21-4c63-98e2-a1313a8a80a0", "comment": "Malware payload", "value": "742b2d55f11939f92cf8ee24aa7c5cfb52fab97e57b1afae4fb150fb4a8deb01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312296, "uuid": "992fd419-d909-40a1-bb76-b7336c0d848e", "comment": "Malware payload", "value": "a176b712c234813fd76ce4be2a74850ecdd4c55d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312296, "uuid": "211ac055-0f65-4482-b7ff-dad7df944db1", "comment": "Malware payload", "value": "cce257b2c6a8ee8d2e9a4cbe415daf8c281a82f6b2f95f0d3a68341eb40635c02fdfaebf6579108027b19a3e1b500d0c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312296, "uuid": "ebd50107-8af1-4dc5-94a3-a9bf0e4fc3d6", "value": "3843F226EFBC65A6C9A7BE928B5AD55BBDC6CC2C4728011B6418E68F0582778CE1C111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312296, "uuid": "ff3ff790-3fb9-490e-8e34-b7e30174ac44", "value": "768:Yx91pwJLRPr9mgz6tJ2JeHCd4GFjuGy1tksk1c6WSgVxjPjgqEOk8s9QcPEy84JW:+TwTh16twJR4GFjuTb6WpHDzV42O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618312296, "uuid": "fc1f3862-da14-427a-91e4-5c5397e94b33", "value": 59590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618312296, "uuid": "34924df7-d41a-43a1-9ba8-114acac426b8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312296, "uuid": "3478bc27-fd63-4cb5-92c1-b8dff87d834c", "value": "Purchase Orders.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26ec7b4-9c87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618339272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618339272, "uuid": "3ae2c893-3835-49db-a540-e036076e456d", "comment": "Malware payload", "value": "83c34365810dcb9ec5c2a91d64a07a23", "object_relation": "md5", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618339272, "uuid": "65315ce3-fe4c-49f9-9b50-eaa7c943c9cf", "comment": "Malware payload", "value": "75545bad6a58da94e8fd5974a85d7471ca0842200ef8a94386d0cf7952767fea", "object_relation": "sha256", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618339272, "uuid": "52b0b715-c3d7-479e-ae55-b22150362057", "comment": "Malware payload", "value": "c7baed05ea5213742c2b7c9cd96b3b608399c629", "object_relation": "sha1", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618339272, "uuid": "48957c4d-34cd-44b3-85bc-0368212fce79", "comment": "Malware payload", "value": "774889a9bc3e9eb0c2b113239e5e63277580569fbc4da5504893877c72b5b2dc6de6a790ae81f12d3f388625914df763", "object_relation": "sha3-384", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618339272, "uuid": "2b743a91-710b-4c7d-8cd3-994fb9d81547", "value": "26F0893478A1C1CD253F0BBBEDE97A5490840E13D8CCABC801AC80882EFD9793504691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618339272, "uuid": "d8146010-017d-475b-94ff-6febea992758", "value": "12:Su70dC+pQoWMBp3O6DYecMdoi74tn+qDI6TCVimkJXcgXPqb:70dBXjDYKdOtng6TEimklPqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618339272, "uuid": "1cd85b57-b9fb-4ab5-a564-b8cc86dd739c", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618339272, "uuid": "763e33ee-6ea8-42cd-b476-b2d58d72166f", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618339272, "uuid": "c0367a16-5a2a-48e7-ae37-f391043977f2", "value": "BR-169293.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e58718-9c5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618321499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321499, "uuid": "6fb825d0-d686-44e0-9395-1a7055804fba", "comment": "Malware payload (AgentTesla)", "value": "3e926383689515b57aec0d94d511d409", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321499, "uuid": "30ec77b0-a382-4614-8c27-0ad4c5ba03d8", "comment": "Malware payload (AgentTesla)", "value": "75b77ba51dc6c3810143bae58b72f8d15a6fdcbde7319a7d7ed3a8d8c39b1f80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321499, "uuid": "18b3efc9-1e88-4033-9da8-f68390e228b1", "comment": "Malware payload (AgentTesla)", "value": "3d9f5b1e047cec8804a523092ee8792f61db6456", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321499, "uuid": "c2a6f3ed-7d2d-4684-b37d-7698fe8541ee", "comment": "Malware payload (AgentTesla)", "value": "54fa920cc70c97ee9e5c04b99fd58024e7ebaef316d72899aab82bd7fa7e9ec54d7d0f59260f5988334c31bab7b6f20e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321499, "uuid": "2f345475-9c43-476b-a954-20eac045553f", "value": "7AD4E0E1260AE71CE9689B78185241F133F37C0156DACAC57DD43DAE786B143C2EF26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321499, "uuid": "572ab2d1-a3b3-4f47-a285-52a2d261ff5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321499, "uuid": "538e22c4-f552-4520-bdee-774b6f41c094", "value": "12288:OkLEe7g+jZK60D9gXbY6gOejDdZzWmf4sy9eRCqTRK:XYeBj50JgrY63KHzWmfk94Cqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618321499, "uuid": "bbc536c5-8fd4-4035-972a-3667ee3ae917", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618321499, "uuid": "4c543d8a-b557-4a3c-8ade-3140313db31d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321499, "uuid": "75df7dd7-f2ea-46d9-8850-497914bb8669", "value": "VAT INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955411a1-9c9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Qealler)", "timestamp": 1618348189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348189, "uuid": "238734b3-b9fe-4557-b44f-0bf0b10f6550", "comment": "Malware payload (Qealler)", "value": "4b804f4defa52df0534b9acc5503b808", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348189, "uuid": "6cac38b9-b39f-4f15-9992-ada6209aa10d", "comment": "Malware payload (Qealler)", "value": "7676419dc1507eaab9288f311f0b992ddad66ac9f4fced46403a1538644e380e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348189, "uuid": "42cd8d5a-66b5-4777-bee5-404b34f3b8f9", "comment": "Malware payload (Qealler)", "value": "57bb28ae3162c46c7342bba06c9b8a2f4ce9aa44", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618348189, "uuid": "1057617e-05c1-483e-a4ec-2a37295137cf", "comment": "Malware payload (Qealler)", "value": "98269e805e7580e7387556c100369c977c0519e2864d77f136cbfdc5801bc5a49a03e1bedacfc3435517caaf73d41fd8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348189, "uuid": "a3fd31af-8ed0-4e9e-85b0-93616297dc99", "value": "E1847C28BD87D0E4F44FC0B035C68657E42542E99649F91B3EBCCE9D5828CB96733AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348189, "uuid": "37883ef8-3b70-4caa-8b50-16f2cd539eac", "value": "6144:JDzE5I0znrcxbk1ArfVaaz+vnFzGEYJPCyXEFF3VBK3+DuiDcZ90jiKvO+0p23jr:JE5toxbkogaz+vnFzGrJPC3K3+DuiDws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618348189, "uuid": "62791b60-1592-4a5e-bbf4-d8777d2f7197", "value": 390965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618348189, "uuid": "d25d55f4-adae-4a17-bf8b-e8d13b4b37b1", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618348189, "uuid": "471f97e7-daa0-42f1-88d3-7ad1177ed135", "value": "RemittanceAdvice271-20210410-19143_212-50-20210410-203126128.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5cb41d-9c24-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618296423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296423, "uuid": "175d435d-ac6f-4a6c-a6dc-00dbe630dc4d", "comment": "Malware payload (AgentTesla)", "value": "f7a8849d8285fcc1b3cee5fa9eacd332", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296423, "uuid": "8dac5552-4fa7-49a2-ac83-cca4c61b063f", "comment": "Malware payload (AgentTesla)", "value": "768f08f9e09542f305f1cb0a72bf0a6438b2cbf276a5e70a64259d626f494d19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296423, "uuid": "b1bb12db-57a5-4b4e-92b1-b109a42fdff8", "comment": "Malware payload (AgentTesla)", "value": "47954dbd790e4dc596b9407c6d8fb2d8222a671c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296423, "uuid": "ab81f466-eba1-47cc-be32-b6c157c17f79", "comment": "Malware payload (AgentTesla)", "value": "d6c2570c783231dbd3caf13d686a6c4df51cb687d8dd1096b675899b11bd2a14bdcd8a03e4dcccee839a2148af0cc251", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296423, "uuid": "8bf43a79-5b47-408c-aff4-a6428468a955", "value": "40E4127CB26999BFC43D45F180D0A884177A426829B0DF599CD1E3DE82B6FE32441AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296423, "uuid": "a0708ec5-d526-4d33-849d-972d37186702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296423, "uuid": "145f4338-076e-47f2-bd57-d7b95d6f1298", "value": "12288:Ma8Cym56V5a2iNZFh3jyqSp6pYbjy6SOjrOtrjxcrtYl9Jk5geR5wlvfQaV7pAnD:o+1XFh3jYT26SOfOpj65aeRMvfTV7pAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296423, "uuid": "bd7fc0ef-8258-4427-814f-89847107eed0", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296423, "uuid": "a473d6cf-5c41-42d5-a8cc-a09ddf531a74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296423, "uuid": "511c9555-1dd9-4e3d-bbd9-d195d89bf2e0", "value": "Payment advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff00e37-9c34-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618303647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303647, "uuid": "f3aa3a4d-2a64-476e-86a4-064cef8d6f68", "comment": "Malware payload (AgentTesla)", "value": "d799d2e2c575abce14de0e52dfebc466", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303647, "uuid": "0acd07a2-a625-4df4-9d8d-1672175cb9c2", "comment": "Malware payload (AgentTesla)", "value": "7708f18b689a00ae80ca94d859dc0cd45b5ed325dd6dec34ea517ce3a4f7c072", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303647, "uuid": "c9828cc1-0b74-4b5b-8c33-f04685217a15", "comment": "Malware payload (AgentTesla)", "value": "75d292fcf713a20db6a2108caf9f6a319a061588", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303647, "uuid": "ff9ccbab-8fce-4513-a5d6-ddf3e9188410", "comment": "Malware payload (AgentTesla)", "value": "69edd7e3e24a2fc04ac2008b452778bb3b47737dffc1637a7c552d3b1f5b1110b170c3ca569ef22d8b38438ed43ee5f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303647, "uuid": "66c83a5d-0858-4f71-aef9-2da7d31e7516", "value": "39E4E0E52A46E71CD9789736588040F173F7BC0156CACAD579E03E4EB5BB212C1EF22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303647, "uuid": "08e96770-309c-43ac-a7aa-4b97b1e12998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303647, "uuid": "b7cbc1d4-91ff-4f07-a3b3-b037ae1ef76b", "value": "12288:d1hodKDHzZtZyk6LtfBy8e2rl3Euywho9OUlKg:RPDHlryk6vpbBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618303647, "uuid": "846d129d-8bdf-4952-a7f6-dba6ab97e9c1", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618303647, "uuid": "964f9f73-c35b-48de-8a82-6fa12f25352e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303647, "uuid": "674c91db-bb2f-47cf-9813-7b418a4098b8", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f771eebf-9c2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618301109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301109, "uuid": "42d3899b-bab4-465f-b3e1-1d84bb0d823c", "comment": "Malware payload (AgentTesla)", "value": "dffa03bc8964cbdf7ab52ac214ebcc88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301109, "uuid": "1ef1cb6e-c582-48b5-97b7-bb9a36e9f089", "comment": "Malware payload (AgentTesla)", "value": "776f2c4ae6ed17fe4516d3da89233b590c653c27832f6df06b2912f412eab285", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301109, "uuid": "b8c63afd-321b-4969-9bd2-61eceba40eeb", "comment": "Malware payload (AgentTesla)", "value": "6d8d147cf6a785a82596abf0b0c8fe6a50518bc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301109, "uuid": "10eecc7f-ced2-4d8e-b81a-81b9f8ba374c", "comment": "Malware payload (AgentTesla)", "value": "ae6848733f1bb6d6efabc5f07088b8f939180642a2787a064e2f25dd152f72422515faa38d47a56666f30d12513f4034", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301109, "uuid": "8ec617be-01f5-4016-acdb-836367aaeae5", "value": "F89207D82A894AE9E82CF63497E8051D17398DF24412CAAF19D5109369D33D13FE3DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301109, "uuid": "cc90e5b2-89bd-4873-8ded-1aa4207230db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301109, "uuid": "212779a6-8b91-4c65-a7f0-fcad45202bc7", "value": "384:QB6+tBg+tR0+txWSRzLhOZf/envtVCZUXwnT6A8PmMPKdZrFLUJflfL9HDi:ulj/b7rWSRzlO1ev2rnOPoLrFGflfxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301109, "uuid": "a8fd49b7-177e-4edd-92e4-bf416e33b82f", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301109, "uuid": "96666f37-6571-426c-960f-b16c02b491fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301109, "uuid": "5d892244-cb0f-45bf-a246-09a160368925", "value": "dffa03bc8964cbdf7ab52ac214ebcc88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91208a2e-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618292777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292777, "uuid": "77bcb65a-32f9-47f0-b6ad-ee768937ecf4", "comment": "Malware payload (Formbook)", "value": "46f0df536b0706b9b4162391f2818cf0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292777, "uuid": "67b4fb32-98e1-44b7-a10b-6ce33c36c3db", "comment": "Malware payload (Formbook)", "value": "777d824a8128a4232e7794e4f2067c4ddb1c3fe53cd2d021854e2a8f27f283df", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292777, "uuid": "6124aa00-886b-41c1-b188-350c1a1bbedf", "comment": "Malware payload (Formbook)", "value": "c003fab22ddd020137950392909ed15f0a131031", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292777, "uuid": "7dd14187-40da-46b3-98d1-43940954608d", "comment": "Malware payload (Formbook)", "value": "88e4bf93be183c2b0fe019c0212dce2f97bef1b782b1957963ed188eeba830a271d0d94e68d01f733ed44e931cc3c234", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292777, "uuid": "17184591-6d8b-452a-a51a-066f77a3d205", "value": "E3A423A072E5D333E957FC7891BE2838936A8C5402F5CB13116ABB594438B64EE8785F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292777, "uuid": "644ec024-7b50-4b75-8aca-f017e093b595", "value": "12288:lsapIWd48cUldbWvh9xETDFRhvjozfEdDl:JIyFkv7xqDjJszfEdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292777, "uuid": "d01d80eb-a4ef-47d8-b9d3-0656c0084cbc", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292777, "uuid": "8bae439b-fa62-47f4-9cab-7297b05d1886", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292777, "uuid": "6d5e617c-4032-45fb-a251-dd7b4139ad51", "value": "Product_Samples.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d484a9-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618292594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292594, "uuid": "128f719e-d933-42e2-81c8-36a16a0ad33b", "comment": "Malware payload (Loki)", "value": "266d4018c5bc1fab8efd02c470c8b0ad", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292594, "uuid": "59e9427e-453c-4ed4-b448-a005def6eaec", "comment": "Malware payload (Loki)", "value": "7848efb6f8588515f2ce88036782d891bf88604fc4b98f946aae276c1e3479a4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292594, "uuid": "b95c8b78-14f3-4a75-bcce-b868d8a355ee", "comment": "Malware payload (Loki)", "value": "9253051bd276aea8c196ae0bc4737ecee15af744", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292594, "uuid": "74698722-c721-4f3f-8e39-f7bf89b2adca", "comment": "Malware payload (Loki)", "value": "14fff001a2c1719a2c1168511c4de59cdd777a60644eca03e9ec281ed93993ca2abaef354137539f427c961f5490fea0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292594, "uuid": "d0007ff1-d961-41cf-a241-18ab49c714b2", "value": "E5B53359A5C75F6FE2AE44B940CAC7A80761ED142EA06D12332C3B8D7AF3470B352779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292594, "uuid": "cb04dbbb-aa23-4724-9130-28651459c0b5", "value": "49152:TGA+aCs0RPhIUckB+Yezfkwq/92lMSX5C8Rs05c+uw1Y2TjW/Q+Nv:ThYcu+3z8B92JpC8Rs05uwh2xNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292594, "uuid": "9a11a51b-15aa-4c5b-8c1c-dddc95be6f91", "value": 2285056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292594, "uuid": "9cbdab9a-d977-4bbe-ba6a-ea5626585eac", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292594, "uuid": "a8b71f74-b40d-4216-9971-f614df2d21cc", "value": "BANKINV28032021VBNSINO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27efdc0-9c45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618310845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310845, "uuid": "18653c7d-7e87-4a48-b881-a9bb0605990c", "comment": "Malware payload (Formbook)", "value": "45507c31a00a17d1c0cc6779f9f675d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310845, "uuid": "3cf7422c-90ff-46d0-9e88-7033b5c8ce05", "comment": "Malware payload (Formbook)", "value": "78e458ae8ef10267738b8b1b1591fc5ace8bbb126d415124b1f067ad98a4801e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310845, "uuid": "2b4cffed-5074-46b1-a022-f1b8e3b75dd8", "comment": "Malware payload (Formbook)", "value": "41086c2288b6a1b2b19211128c260cad59973bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310845, "uuid": "82b4e39a-0d2e-404e-8ce9-6170e9d9acf9", "comment": "Malware payload (Formbook)", "value": "c45d43a6ee58042f45a7629b309b4dfbd2ef167bcc6683457728da693f7eacefd9a7aabd1f74b24f982016186e7b5885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310845, "uuid": "7a69b99e-e8da-4529-9e10-9e436db2be6f", "value": "BEE4D0E42A06D72CD978ABB8084541F133F37C1196D9CAC57EC43E5E7967202C2EF6A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310845, "uuid": "c42e7695-7d3c-45f2-9929-2f01af769cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310845, "uuid": "75cd4803-4766-47c4-9684-fa5712100392", "value": "12288:hxXplQKY8+gCAq1rMyon/oNSG49O7/RmELIvAE0UHk9HuPiHGkaq:/3HYvdAq1Qyon/ASGqa9LjE0dHuP+GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618310845, "uuid": "a2c7d032-bb45-46eb-a1ff-fab20c659b51", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618310845, "uuid": "9477c645-24b6-40f5-9b76-fc254f2a735d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310845, "uuid": "b1639c29-d2ae-4d0b-bc18-cab8a8215962", "value": "Closing Balance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7ddce1-9c67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618325415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325415, "uuid": "5b4c053c-6eb5-4099-b688-4b1e49431e95", "comment": "Malware payload", "value": "fa0fa84d673fb0e4de0d95af10691da5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325415, "uuid": "d870cf2f-dc7e-4c86-bae0-2d9d59f00129", "comment": "Malware payload", "value": "79583219b48c5e5e8ff247b29d34388818db152457160d3420c37abd4c54ade4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325415, "uuid": "3e3d0e5a-e488-4421-bd5c-096ad522d3b1", "comment": "Malware payload", "value": "c232ca8c6c010f9adaff6cebeabbe5d28fe28a88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325415, "uuid": "fcfc9ad4-61d3-4817-b664-645eccc2a80d", "comment": "Malware payload", "value": "6310936c19697233873505a464be709aeff58fb24cce66ea88585ce86c1df58f1242fc44f64ed62d42f08595742d45bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325415, "uuid": "a3772f4a-555f-442f-b399-4c2bfe3f5514", "value": "4383125C01E19414A56A683ADB8E8FA2C76B53CDB875134852DC20FC8F910FD9BA8977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325415, "uuid": "9e0ffa28-2c12-4254-8834-fc7fbc8218ca", "value": "1536:No+Vjr4JvbNOBiE+vCfq+e8cLoZgxzs+L4K9pNkvSOb80hJMcPc7lM681R124ZbZ:u0jr4xbNOBifvoFe8cyf+Lz9svSI86JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618325415, "uuid": "44a3c32f-f653-45a5-9513-9cabb0b719dc", "value": 88199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618325415, "uuid": "ca3ffe99-c4ed-4b4e-825e-372726f51ab8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325415, "uuid": "4d703915-d4ce-4632-b797-91c88437563d", "value": "catalogue-97.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f32959-9c5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618320614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320614, "uuid": "711e93ae-d52d-4662-8928-05c105b45ac8", "comment": "Malware payload (SnakeKeylogger)", "value": "154a751af24f57096d183d2643e5ce56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320614, "uuid": "64ad0f3e-1b11-4306-b73d-de17b0dd1019", "comment": "Malware payload (SnakeKeylogger)", "value": "7b3b751039673c3dae4739a5019f00fa9cdf13edd569480bda13a5815b038b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320614, "uuid": "6273e672-f880-4608-96ae-f28b22b40a3c", "comment": "Malware payload (SnakeKeylogger)", "value": "416319a0d6f34eb48b46c3b8d12ff562c447ccc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320614, "uuid": "49f62e84-0894-49e7-a104-83bc825502f3", "comment": "Malware payload (SnakeKeylogger)", "value": "74d88532492c94c91f557bf4222260045513f239fe30a449a7d251823019c8d16e82fdd0d45e0627babc5476e291ab76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320614, "uuid": "c92c579c-81b5-4a6a-b366-b2f9b0e4dafd", "value": "0C84A164AFA31F5BC6CCC1FE50C6D169C9A9FC5DC2B1251A37B2CA8AFE04544ED2C285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320614, "uuid": "38b1cbfb-dd40-437d-a457-86b14db91183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320614, "uuid": "2ae9ffe1-f208-47db-a73b-7ff6ccd72a1c", "value": "12288:jZSTYw4wYw9sw4wYwIwIw4wCSu6eCO6vYwFCu6eSu6eDryboDlh:jkrVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618320614, "uuid": "9a790a77-3873-4799-bc39-9d5ea2f64426", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618320614, "uuid": "1573bdbe-7a34-4bb3-b5ae-5bced6a33065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320614, "uuid": "02ab0124-5410-4f15-aa1e-a4fa42183efc", "value": "SQ8ON254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0ee1a8-9c1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618293255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293255, "uuid": "3460fc35-33ef-4334-8110-31197f7c70b3", "comment": "Malware payload (Formbook)", "value": "5f1ae1d123da91314aebe1665515da59", "object_relation": "md5", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293255, "uuid": "85fb03be-b82d-41b4-815f-d155d3e9a265", "comment": "Malware payload (Formbook)", "value": "7c9d339779cd57c95e4466405ed0d93829199bfb714363317d52a55dc54929b0", "object_relation": "sha256", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293255, "uuid": "0f337d3d-886d-42c6-b1f1-db44c29f93d8", "comment": "Malware payload (Formbook)", "value": "a15de387b09510db60901026c889b7bcbd82ca6a", "object_relation": "sha1", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293255, "uuid": "54febef2-334d-4141-a305-45ce19bc8495", "comment": "Malware payload (Formbook)", "value": "6ffce585d2f4785312b755eb61eec1e7a3149bd5d5b76f680cb6a5e6a1a9441231a268deb97e6b0bfe778e5c975639a7", "object_relation": "sha3-384", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293255, "uuid": "f84d1684-024d-4434-8676-8bed2b8543af", "value": "ABD5335872964EE2CD7A0F5AF9B91516DC12E8F11BCCC7097DAB22E9C93974FDE08402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293255, "uuid": "9d2f5a6a-ebbf-4581-9bd3-2358033bba55", "value": "49152:1r9Yg9KBrVkY27nKNrTGn/ZcVLC0jaP+HhEQwIHhgKjta8qUmNhT1do6fxS:1kVkv7nOVO0jaPuEjUeKpEUmND6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618293255, "uuid": "7e4b5167-9818-49a1-a86e-28c2a591f3d5", "value": 2935070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618293255, "uuid": "e819f411-a8cb-4175-b49c-791417142015", "value": "application/x-bzip2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293255, "uuid": "9e467c0f-c164-402c-986a-2ce376fd7332", "value": "awele.com.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fee6ac-9c23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618296035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296035, "uuid": "e914c4c2-a1d0-4c4b-8512-6a70648018c3", "comment": "Malware payload (Loki)", "value": "1cdaa623830dcebf2db77edd69615463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296035, "uuid": "3d99d449-8165-462a-a465-ad571d310dd3", "comment": "Malware payload (Loki)", "value": "7ceee6ac5320ceb868957ef8bea74ed6c5ebd5216b1548e566431a95bbcdd83f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296035, "uuid": "7da0a526-cf21-4f6c-9afa-e281803c05d6", "comment": "Malware payload (Loki)", "value": "1a11106d46fee66aa794ce68a29c64b107c56b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296035, "uuid": "66a97672-f02e-49a5-a31c-0c9bc1d5b308", "comment": "Malware payload (Loki)", "value": "383ad4166e0700eb5cd2a6011da99eff1eb69019d8964d36199997e37926be57e02ae486a273f95fe11baad9baa33317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296035, "uuid": "81a99b5f-8e41-4c97-b903-561a6649b8f4", "value": "9445052C31049AD3C5AB03F6A32C4C0096F19D4EA6FBF65DE8833CA6B6BD781B525547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296035, "uuid": "3f044929-9924-47f8-b680-5aef7fa518d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296035, "uuid": "3a3233c9-8873-4ff2-afce-77b8dc5d3cc5", "value": "12288:uJdHZ/NzzzccF/uMuJkLOBfxJJs19ulIxs8/Zhv/dPCKhdh6a7omgS5mgA:urHZ/oMSkLknW19u6s8/ZVlP5Plwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296035, "uuid": "16b4d2b4-2ddc-459a-b09b-964b444f6442", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296035, "uuid": "198a987f-3140-411d-a236-99204a393d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296035, "uuid": "2573fce2-c905-47a2-a3a4-c51d4b24f8e0", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01acce6d-9c19-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618291678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291678, "uuid": "69d27e0b-d6a2-4a8e-8115-0523bcab6b25", "comment": "Malware payload (Dridex)", "value": "e27f47d9eaabf4eed6a3ce86d806aa24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291678, "uuid": "636daed2-aaf7-4092-bf7a-637f4057ae9d", "comment": "Malware payload (Dridex)", "value": "7d35cea1b862c808a12513e77008281751d39242f532139862da1fda018e404e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291678, "uuid": "24e8a088-3b19-463b-8539-d7ea180d18a4", "comment": "Malware payload (Dridex)", "value": "af1d6436884c6e232a8356ef3bf43a60f2c7ef3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291678, "uuid": "fa709266-03a9-4a58-8313-52f98716cf94", "comment": "Malware payload (Dridex)", "value": "5e183e38139843b6de50eadc3c2dcea5bc3540e1d9bdcb18a0195b93de5117869e199cd89315d14b34f4cd16ec6d7461", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291678, "uuid": "f8a976dd-57bd-4362-9696-14274404cfd7", "value": "9A44229CF1ECA274D7B69C7D501C6A8BA604EEFEA61DD05A18DE4EE873094B3035760C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291678, "uuid": "0ca1e1af-da2c-4712-b65a-deb8b3cc362a", "value": "6144:Z4PbdZ+zZrTYJ4Qk8wGoDqKzyyoNE+W0WxwpFO0:ZwYdUm8pCvwpFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618291678, "uuid": "4da3c123-1ed8-4a37-ab29-7e88a0a1bef0", "value": 259477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618291678, "uuid": "793d944d-76f9-4a1c-bcbe-8df468ae3aba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291678, "uuid": "14ff533f-1d06-4245-b74a-faf6322725e4", "value": "Invoice #96076.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c01b0e-9c13-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1618289423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618289423, "uuid": "b269acb1-ff37-4b85-a0a3-baa0ac042e9e", "comment": "Malware payload (njrat)", "value": "ad150e40bab3da33beaea2a475e66831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618289423, "uuid": "fc79f5bd-6bb7-43fb-8105-3e2cf57a3d18", "comment": "Malware payload (njrat)", "value": "7e3f7054c4420c2ab31ad285cbc28f799ee67ab678c1c22f9b15d652cec92193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618289423, "uuid": "0094a7e0-3bd2-450c-a038-6394e2fc05f2", "comment": "Malware payload (njrat)", "value": "1b3b7a78652d048b365570a37d6b9e592cdc2faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618289423, "uuid": "64847851-b200-4bca-a6fc-57f7912cdbd1", "comment": "Malware payload (njrat)", "value": "8ccd5a544b6d93639c01620706c05c03d025dbbb66c19c40f047cccbad0ca9726dbeeec41a71e64a7bd4d721ee613fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618289423, "uuid": "0f13fa05-6dcc-4ce4-866d-1f28a45fac67", "value": "B535333B88F15468CD8A053FB59B0847F386EF0CFDA325B7698E723A1C64A403F9A555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618289423, "uuid": "e5473a63-0a73-4d35-b8bb-758cfe52c6e2", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618289423, "uuid": "3e988203-1248-4ce1-a62f-9b11dd1833b4", "value": "24576:boOnKSJ1uWRQTQHobYEmr8t5LU4X7lGJCCzQc2nkdgT9Lb:b91uUhtGLU45GJPQcSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618289423, "uuid": "5c3a3c78-0dce-434f-a580-f8e6704dfe59", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618289423, "uuid": "ae90c4a5-4a99-4035-a943-f1db0de38099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618289423, "uuid": "2d76911d-87bc-4a67-8082-cfea0bab56ba", "value": "ad150e40bab3da33beaea2a475e66831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f07df3-9c72-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618329915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329915, "uuid": "e459144c-73d9-403d-8beb-d324f052ba5d", "comment": "Malware payload (AsyncRAT)", "value": "59fbbfb0bfb98023f94ff48a638e76c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329915, "uuid": "e86e1ba4-169c-4a12-8439-0acf932eb966", "comment": "Malware payload (AsyncRAT)", "value": "7e3f71fb52aadeba59023508c06fe7ee6848abf5deb9ce8cead1a0c1410e7830", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329915, "uuid": "9f85405e-c1e5-4824-8f0f-7e841b207a35", "comment": "Malware payload (AsyncRAT)", "value": "399706f83ee7e4a848d69339f7f7b0812091302b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329915, "uuid": "1ce5066e-ea92-4e38-86b5-c6b6ef27b947", "comment": "Malware payload (AsyncRAT)", "value": "2e13d07ed9e5fbdbe8c0c9f27b15ad51209eaed208542ebf95e4f6b6ee71ae729c3fad123321b81ae0b132f0a52a0772", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329915, "uuid": "45e4af70-d99b-4d66-965a-88532810c5e7", "value": "30C4ADE42E06D2ECE9A8977804C541E533E37C0DE5DADAC57AC4395E2B37202CEDE1A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329915, "uuid": "b6e00bab-e12a-4996-8a8b-b55042be1c22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329915, "uuid": "75f81aa6-c29f-4830-9745-8c09122f9eb2", "value": "6144:GSVApH9mTj4iIotrSmfXERuo+whMrX1wE5r+94DZuSpiLlbmFjfpgHLyoMaYERVT:G/pdmTeuSWE921Zr+9yGcdEylToLKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618329915, "uuid": "c9b9ba3d-c27f-4aa7-a63b-32def3f16e7b", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618329915, "uuid": "e9dd75da-194e-4365-b45b-4cb4c65b9679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329915, "uuid": "596e1d39-8e6a-4773-a57e-3a27f85a2039", "value": "Ansteel Spain SLInquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07549953-9c46-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618311014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311014, "uuid": "551826b8-8641-4641-8b69-4ed2dee8ff47", "comment": "Malware payload (AgentTesla)", "value": "9b46f7b646fa7ee0d557e08d02ae7279", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311014, "uuid": "034982f2-1d17-488e-9c1d-2f6438a01b7b", "comment": "Malware payload (AgentTesla)", "value": "7ffcabdace7953bb5884040ad1c805599e0a4642dba13dfd0b50055314e3286d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311014, "uuid": "3bf1aaa7-5a60-437b-8268-bac923176b5e", "comment": "Malware payload (AgentTesla)", "value": "f97b1ef938911940b5c49310f97b886a30fa5bcd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311014, "uuid": "dcbaed94-bd2a-467e-bd29-6a064c900360", "comment": "Malware payload (AgentTesla)", "value": "6c7a58d26b1ef330dd37a8d58225497e246c3ed1076ef422f3224e937432fbbfd0168dc217611574a8ae98f1aceb8cb2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311014, "uuid": "1587bab0-88bf-40da-948e-72a523d32eb0", "value": "C6053327AB370A2E3C94C1787AF15487801192DD6CBE6CE67D3E1B92D2C91CB11B3B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311014, "uuid": "ddc65325-6d2f-49e7-b1b0-5dd31dfa21d7", "value": "12288:r6QLodxK2NirSKwgW8TGIYG27eSVfndb4cv6jMEBph2di7cFWj9O4M:r6QUDVirSZ8nYGyV1DGph2m59Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311014, "uuid": "c0080fe7-1f45-481b-8eed-75d21b2a1ce4", "value": 813149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311014, "uuid": "87072874-409e-4276-93aa-8ee91ceae93c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311014, "uuid": "305af7b5-e605-471c-a827-13e294450ef3", "value": "mv Sider Capri.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b9e702-9c4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618314213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314213, "uuid": "99e6d0d5-9a65-4201-ae28-516b01dbb018", "comment": "Malware payload (Formbook)", "value": "be6f1672a17f46fd4a44b18feca9be5a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314213, "uuid": "9c52e1e4-082a-400c-8de6-01ce7bc6fe9d", "comment": "Malware payload (Formbook)", "value": "802280250aaa94b3ea73269453179e57cb61342ad90ee2b49a07b02d069c7093", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314213, "uuid": "38ea0441-e42c-42b2-83c8-ad1435cead0e", "comment": "Malware payload (Formbook)", "value": "fadeff0bc449d53bc0e4b37b2018c043ebab568c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314213, "uuid": "25756233-1e7c-46cf-b2a2-5f66cbb2bbed", "comment": "Malware payload (Formbook)", "value": "8f4b05f38010430bacf3718684e3b990ba59f9924ebd0fa1201ebdaf51179133306bfcf41a634aa634d066c0c2da8832", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314213, "uuid": "6330f557-6423-4fd0-9535-3bfadcac64b6", "value": "A3F433DC9889412384737B1B816AFFC72E1D88D27296E3E317FE390A91F78152590CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314213, "uuid": "90c2de7d-4f52-41c1-acd2-24d5f46e8e20", "value": "12288:1N7VafJPyBxGTxEm1rpJ9yq4o8/Uj/XXRAI1HX7gT4YT5Uz2iysbtqvUWsOb84wQ:15IybcpXm6HRAwPYEysbtKUWsz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618314213, "uuid": "04eae315-3cca-47de-ad4d-5968a4a22586", "value": 753668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618314213, "uuid": "f22ef7fa-0c35-415c-a8f7-b6b6127662cc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314213, "uuid": "28963f58-5fe4-4783-9e8a-6cac60c58701", "value": "order# 10632259.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07c0c97-9c56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618318197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318197, "uuid": "c8485ad9-d776-457a-831e-ebd67875e918", "comment": "Malware payload (Gozi)", "value": "7f7f419319a47fe641b18579468a031b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318197, "uuid": "0087d7a5-3e96-406c-a7b4-18d96b408629", "comment": "Malware payload (Gozi)", "value": "80d8869ef6ca657ae6c081792747e553c78520a8bed10526951028634377de29", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318197, "uuid": "382eaceb-ce97-48b0-b344-ade43ad61c7f", "comment": "Malware payload (Gozi)", "value": "f3e2fa4f4d475b7d1da504d4d527279554ab95a1", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318197, "uuid": "8a6607d0-46f4-4acf-8a96-5e64c164b8d2", "comment": "Malware payload (Gozi)", "value": "067eea59edc3cf47c906d344752a0209c604ae0f5faad2db27539bacff0c52d2e172eb2eb84d7a8ff4b6e129b9b4aa5e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318197, "uuid": "5a4a6642-d2dd-407b-8c6b-a863fbf029d2", "value": "8484AF317A92F439CA5304F24A25C2F1D5F57C190B2A62D37BD5372F9E381D2AA323A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318197, "uuid": "c8233c99-0675-4957-a7f2-b7544703d54e", "value": "b0641168c6b12832621271a9db41e054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318197, "uuid": "f05eefd2-abb8-4139-880f-e77c23682b8e", "value": "3072:sJCeW1S+L8/+MQ3xBZH4Ax9wje91pyp8OsYRLFlaX8hZ+paCcq6kxT8lo8JFo/F1:F1zLo+MQhBxJ9wEpyp3LFM2OT6733eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618318197, "uuid": "1ff8c1d1-8fbc-43ca-b0ac-770be7cc0653", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618318197, "uuid": "62eb4c2a-2565-4fda-aea7-05b27811be2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318197, "uuid": "72803721-77cc-4785-97e0-47c114568af4", "value": "bee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b9d710-9beb-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1618272248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272248, "uuid": "5cddd9ec-519b-4d90-be87-d40e711a8365", "comment": "Malware payload (TrickBot)", "value": "fe721f290080445685d355d94c3611ec", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272248, "uuid": "0f2f370a-d69e-4062-8c2a-49c28de69199", "comment": "Malware payload (TrickBot)", "value": "80f34ac8c2bb698ff0c2754f44d18e84452135b31a5a12d2665da6e9204c780f", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272248, "uuid": "94fdee8d-1459-43c9-a188-384e08a9af21", "comment": "Malware payload (TrickBot)", "value": "0f34b98a819170e58dbf849d64ab0ac2a8f2f68d", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272248, "uuid": "4b9bad9e-8e3a-4e09-a480-6b5580a70f7c", "comment": "Malware payload (TrickBot)", "value": "1d847fa9aa2a8cb12ed0b95587d7eb044e4cab31f224120b1c22e22a2baf2f6d9e8e1e58de1da3f0b4fe8a21834c2886", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272248, "uuid": "96df5685-6d72-49b7-a210-1093e8bc5b85", "value": "2493F14D6657356DDB9D363C83887368BBB210718183FB272BFA907A0F47B86192C45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272248, "uuid": "98fa3533-e2cd-4fe5-9347-dde710035c4b", "value": "1536:AevxJQVyZEbrMj34410mHyL9c988gHhX8jCNnKfl5ncSn2tPsQqHmrFij01:A9br0o45GUgHhX8jC9ySS2xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618272248, "uuid": "ef54176e-8dd0-4bcc-b4c2-73b14ad7c4f1", "value": 94660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618272248, "uuid": "33c93a6c-7b5f-463c-958c-e7a4a783c630", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272248, "uuid": "0db7fd9e-86fa-443b-944e-11b06dd54a80", "value": "Invoice_572880703_2082292576.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d13b21a-9c40-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618308501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308501, "uuid": "6e498657-5eec-46cd-9a09-ca8e5164c3d5", "comment": "Malware payload (AgentTesla)", "value": "8e34024b8c1434babd9bb908ec2e3fad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308501, "uuid": "350e5ed5-280c-49f7-b6de-c67d02bf19d8", "comment": "Malware payload (AgentTesla)", "value": "81018af4c22d2b0b73b5ce38dffddabae8e510ff407f437e64f98a093cc0d973", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308501, "uuid": "0c34a11a-37c5-424c-8f64-da383c3004ac", "comment": "Malware payload (AgentTesla)", "value": "57030b9dfcb4eb2ac4995e6f52a2a63d2bdb18b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308501, "uuid": "01413943-d9ab-4cb4-9b71-cf7cb476717b", "comment": "Malware payload (AgentTesla)", "value": "3d092ec5d092e24ce1f804de312066c35b250fd40e1723d1c0dc6496aa2b89b155f02b830d04723a43519cd05b37f91c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308501, "uuid": "cdd785cf-8e52-47a2-8a28-83930fc12050", "value": "82D4D0F81A06DB1EC958A7B4484645E232E3BC8129CDE7C43DC43D9E759B206CAEF16D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308501, "uuid": "5f3369a1-46bc-4ecb-b9c5-a2051ece38d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308501, "uuid": "63cfe645-a066-4d63-bf97-fddb8082a722", "value": "12288:oLazaCyaVHPCEvSHRFl2Hr7drpP40l5KE:oLanlHzvORP0pVQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618308501, "uuid": "b21a9c75-cf90-45d7-8916-7b3096cda164", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618308501, "uuid": "ae455333-623a-448d-a8e5-182892fe7109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308501, "uuid": "67979ee0-b13b-40a0-b1dc-212c4f99884c", "value": "GS_ PO NO.1862021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25969fe-9c47-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618311811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311811, "uuid": "9fc6ab8d-6e04-4e36-8e38-8513b1b89187", "comment": "Malware payload (NanoCore)", "value": "cd8e6d32b877eb428436df8dbec731ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311811, "uuid": "2a2aaca4-ef09-42d9-bf01-2db5264f13ad", "comment": "Malware payload (NanoCore)", "value": "84d72bc7d2b71715cd2a7294087980b1721cd0f8741d846fc0dcfb3771d3787c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311811, "uuid": "7a671851-434a-4999-9233-cd0aee879980", "comment": "Malware payload (NanoCore)", "value": "29d53b7a58d7e40e7315915542491f3bd486cd3c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311811, "uuid": "59720afd-a6d8-42d2-8ff5-98aabebc00e0", "comment": "Malware payload (NanoCore)", "value": "06620d8ee1a831f2635ed45251a206161b94ab91a0056c6d79dd7a83d565c143c84835884be3a3e27f5835a356b4c604", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311811, "uuid": "539da13f-26ff-4436-9e08-d946c57ea526", "value": "75B423BB09D3A9D55C49A66AC2F41263A767E5BD02F367881275C304CF7C08B073A7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311811, "uuid": "a6717225-ef71-4e73-9fb8-5c7595f3db0d", "value": "12288:lUf8v4dCLcGCB6LauagaFFTq8wT1q3MOo8It5zDM+2KiZM7:lmddJUhVaFtlwT5tt/2KiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311811, "uuid": "ae65c5a9-96c8-425f-a979-46f846dcfe84", "value": 500435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311811, "uuid": "bc3b6a1c-5b20-4ba1-a7ca-9a88cafe099d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311811, "uuid": "39932e13-721d-44eb-9df0-cd8dc79cab9a", "value": "New_Quotation_Request.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaaa964-9c8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618341112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341112, "uuid": "a82213f9-8907-465c-905e-cf3de6fde94b", "comment": "Malware payload", "value": "5f5f1f8f79787e456bf8c1e6a52ef26a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341112, "uuid": "f3bd5740-237c-4684-96a1-1286028a6321", "comment": "Malware payload", "value": "84fb0863381ae8ebb32209dd0b9eb39d75c806fbb38fd7f1c9572783642b09b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341112, "uuid": "a18fa8e8-ac85-4252-87c6-8cd193ff0ab2", "comment": "Malware payload", "value": "7e7a842471e47ef453a2cb718a05a936f7a3c3b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618341112, "uuid": "dbde0c4b-e750-45b2-b7aa-6c352d2783fd", "comment": "Malware payload", "value": "3aa06b12cc6d48395ba114bed525e0dd26233478f61f0ff4018cc511235e138e53facefa9af111ca1f2db949331fb01c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618341112, "uuid": "cee599b8-1df2-477f-b8be-3db8ba739494", "value": "0993F299D7974819DB72D036FA6689E26E0B35032252B00E308191D52EDB5FB0FE5EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618341112, "uuid": "7f1f012b-c919-471d-91ad-a42eed99f253", "value": "1536:Ftf9gwtr3JfMCMHeh5AS+9SvyCbXwOHGE8feeTE0hJMcPmaDpdSu19ihY:FJF7Jk3rUvyCjws58Gf6JMcuaNB19oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618341112, "uuid": "a1923e8b-6dab-4a95-bd09-2bd085a5a2bc", "value": 96834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618341112, "uuid": "682358d4-11a1-41ea-a76e-56e126217c9d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618341112, "uuid": "9b6c78be-2709-4aff-bc49-f1101878dd09", "value": "documents-1472071891.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bfeb08-9c4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618313403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313403, "uuid": "72826429-22c4-41c2-8b1f-b1b62b12f4b9", "comment": "Malware payload (AgentTesla)", "value": "5ead50696ef49859a89cbab29fe072b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313403, "uuid": "1892b1b1-07de-49e1-9f5f-04de88e07046", "comment": "Malware payload (AgentTesla)", "value": "865be6910571e1334ef42b0396a44f76c45ad6048132da31f5599fe2dcfa2081", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313403, "uuid": "d405bf24-a8ba-40b6-8676-d56323b95e90", "comment": "Malware payload (AgentTesla)", "value": "0d9d917d9e93ae1799d35903951ecafe7beb4ab1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313403, "uuid": "8bd32430-583a-4df8-adbb-677bb3ac98ac", "comment": "Malware payload (AgentTesla)", "value": "2c22aa808b50228f08ac378814f48beb71c3fdb824674adece2232ed894247ae35c17f19a5f2e84527ddbd7e1f68c7fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313403, "uuid": "bfacf25c-f289-4bde-a830-f422d6d93dbe", "value": "908218D88B8846E8C22DF6B163E57D4D56705EB25810CA1F588920538CE2BD51EF2DEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313403, "uuid": "51070ca6-433c-4bb7-a254-0890b07c0f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313403, "uuid": "2fafe59e-8e82-4a92-bfb2-476726ad4068", "value": "384:NBN+thJx/pzLE14m9h/VFyv426P+pPP9VmXqg4+uG6k9LUJflmLHjBC:HYjJx/pzgim9ZVFK6aPP9Vm6g4p/k9G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618313403, "uuid": "67d52fba-db94-4134-97a9-23c8466e8c6f", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618313403, "uuid": "7bc2f3cc-1eb9-4d25-8171-8636929fb5bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313403, "uuid": "bdd8082a-040c-47a2-b992-30b603a4dae2", "value": "REEVISED DOCUMENTORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024a16d7-9c90-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618342789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618342789, "uuid": "59085c91-66b4-427c-be7b-0b668bcc40d5", "comment": "Malware payload (AgentTesla)", "value": "0e26a8a9bfdc4635cd9d182a8e1d99a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618342789, "uuid": "57249bfe-9f0d-4c88-9058-01166f0200c1", "comment": "Malware payload (AgentTesla)", "value": "8ad30eae5696ae1f56fff494f6736175ce75e62ef79970919c5f008e057d5e63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618342789, "uuid": "0450278f-131b-4b16-b416-8c2f59467159", "comment": "Malware payload (AgentTesla)", "value": "3ff04acf1130c617cf0797fcf8aa7e375337f66e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618342789, "uuid": "37e24e08-9dc0-421a-91b5-f51cd703e195", "comment": "Malware payload (AgentTesla)", "value": "ae9774de620e2aa4e650c72ee09e8534e3e8bf3800cd6086747eea6a0a72f38ec8bcb252141a340a179d8b56afad7638", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618342789, "uuid": "5274e738-73cb-4f4a-b880-35eafc5c2f52", "value": "AF058ED1F15088DAED6B49F1AD2BA5302493BE9C94A4410C769DBB1B77F3342209FE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618342789, "uuid": "78aa160f-e8ec-44b1-aca9-9b9a2a644f8c", "value": "768:xhhgbDPrz9t0sDiGUGflg3zye8rjcljsSRGBf4hTfdUzzH8TbtRuzg2/lwkK95W8:xhhgbDPwsDuFcjcRsorTPuzg2/lwL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618342789, "uuid": "34f7a810-cc76-4235-a8d4-0cb4bc012a46", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618342789, "uuid": "5cf6a943-2709-4018-9011-c7b56c00ae5d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618342789, "uuid": "b69fa8af-3358-4a21-985b-fc98dd84dc0c", "value": "PAYMENT SLIP.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32da32d-9c67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618325476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325476, "uuid": "d98c07cd-dd9f-44a5-bda7-2cde13e8589c", "comment": "Malware payload", "value": "6b7691e79b6c33c5bd2749f719a9f762", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325476, "uuid": "7e638dab-e412-4cf2-bc6d-f81af336c000", "comment": "Malware payload", "value": "8bc87eab223521d252d95298e7bee61e903116d55d91303a78805f04ccc8b533", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325476, "uuid": "59308f26-041f-4a39-8268-4b141b3b4426", "comment": "Malware payload", "value": "4fe2c28d52ff9166488cce73a88b4091a4bad621", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325476, "uuid": "6b86d30c-7040-487e-b21b-a300fed9c12d", "comment": "Malware payload", "value": "c6a295d6e6d352bb338c500fa716a378135eb9843fdd982266d0abc1387c89d5c8c17e264d18d62b2543c128e369dd1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325476, "uuid": "6aa33274-5dbe-461e-a466-d273f7493691", "value": "8E82D01AADE3DF9EE52746F4068A4D1578FF4370FE1D19A68CA27688036F40D14AC384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325476, "uuid": "7e756032-67d3-4bd4-8542-c12a42d122ca", "value": "384:0Fin4W7Cg+A7DfnflQuAcBsA1jaxZ0hh9EkrSeeaHqp2HnbYMQu:win4W+m7jnflBAu/1ja/0tEkVeTp2HPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618325476, "uuid": "d58ad8b1-56da-44c4-9e3d-fa76e0f14fb4", "value": 18720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618325476, "uuid": "b25fcd7d-9ba0-49ad-ba28-146bf48c8a55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325476, "uuid": "cbfe3935-37de-485c-8e1a-8b07fa5392cc", "value": "SecuriteInfo.com.Trojan.GenericKD.45946833.18899.20819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3ee36b-9c77-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1618332226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332226, "uuid": "475d73e9-1399-4c9c-9aed-3cb5187dafff", "comment": "Malware payload (FormBook)", "value": "a7219a323463614196acdadcdd711820", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332226, "uuid": "098bb6d7-98e7-4ae1-a058-d06ca1f70730", "comment": "Malware payload (FormBook)", "value": "8bd45a9230ff0839caa9c9ce4310ab5408a4b1eb67197cde5264481622c41019", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332226, "uuid": "33c49fc6-00b9-4dcf-982c-abc527dd9e6b", "comment": "Malware payload (FormBook)", "value": "6d82febdd244b0e82ebfc5c0d1bd7a8e6dce58e6", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618332226, "uuid": "f556860c-9d60-41bd-bb67-9ce8af191f54", "comment": "Malware payload (FormBook)", "value": "e72732956534b7f3552cf13750f28f543e6fd17600677cb973455037fef03533f8c5f0aa6b8a2e5852aff2800aa743d3", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332226, "uuid": "388ba3eb-cc2d-4c8f-8f73-1a9a5e171d4a", "value": "23B423BCD8E880C9E8D1518DA7058E71F61A543D441EF2B3EAEF213B4B495723A712F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332226, "uuid": "c82fc517-027d-4924-9407-f24b2d94d885", "value": "6144:V8lI5FcW9ggHrMt2ycdEecBrxkcQj9FXPoI9Ls8lrQn9Hu6q8Wo9sO/q6NEk7VX7:fcWZ4trZ5BrxYFRz9COb8WE5NE2V22hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618332226, "uuid": "bdb1da2b-1803-443e-aa21-eafb15866650", "value": 516058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618332226, "uuid": "58a8f11e-0621-43b3-ac95-dc7038af0ee3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618332226, "uuid": "642ed9be-a21a-4176-9f65-480790aea1e8", "value": "Product List.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1047ca5-9c3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618307541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307541, "uuid": "551c8ccc-9bae-4380-8ba2-62f0537b04cc", "comment": "Malware payload", "value": "30d905c22dd0b65bbe29d62ece72414c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307541, "uuid": "b05da424-bd74-42d9-a35d-cc1270d9e1bb", "comment": "Malware payload", "value": "8e0d2d66c5f8e493e9af8f3727ca955222356207f59d37692b67e7dc158418f4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307541, "uuid": "6bf3567f-d733-4b8f-aaea-467fa4ae54bb", "comment": "Malware payload", "value": "8c2c95006ae2df19fe26a7b49e26c893c0a6fa06", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618307541, "uuid": "3a73700e-883e-4bfb-b8b5-d44445fa0133", "comment": "Malware payload", "value": "2d0bef85a9c77ba7107f02b7cd3f1335a42bd513cdc6b909770a7b6ca3a3f7dd7bb07a5dff263ba417532cb495ebffd5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307541, "uuid": "0692f359-516b-4264-9a93-5ad8a4fbc917", "value": "69C5AC3B62D1D1018ADF41B39E736E67A7DF81E13BA8541CBB05611EC83C9F634AB942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307541, "uuid": "5d144e18-b794-4ac6-bd04-e4fc594bde17", "value": "768:YbP0OPgrhPuypUwzIyN/t57gsv3OfCFWeC4K+19hUIK9N6fya0UVuZGwQ9WBEvIx:AP0O6hPdIrhM+OHrUiQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618307541, "uuid": "9bb50d7e-eb27-49e5-bc16-9ec20ed1635b", "value": 2661056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618307541, "uuid": "d68bdfaa-32e1-4cc7-b42e-ce09ddf53ed1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618307541, "uuid": "b0ff944f-cea6-45b2-85ed-61d3a0510524", "value": "cobalt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22c1ec0-9c70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618329313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329313, "uuid": "aaab55d3-77d6-421a-a229-73895d52d973", "comment": "Malware payload (Vjw0rm)", "value": "4b66a4bb643b6ebe7ebefb7c82194c4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329313, "uuid": "d05e5547-dd99-408c-aab9-0291558a8823", "comment": "Malware payload (Vjw0rm)", "value": "8e9bac5d4376fe89b875a99867d6cfed70c5fdaed0eeaf1e0bcc275e7a7b4884", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329313, "uuid": "53197581-1504-4711-b78d-ac95991882a6", "comment": "Malware payload (Vjw0rm)", "value": "09c595bd8a28b78032322fd96680d6637cd2a5be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329313, "uuid": "8b9189a2-c916-4392-8184-ed73fb0f2d5f", "comment": "Malware payload (Vjw0rm)", "value": "1bd62bca2e088fb5d11547e6474ca8e904a6d554f862f19e90fe41af8c337bbf28de30df17762c4e6ac2e451116c22f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329313, "uuid": "f2cccbe7-e9ff-4bb8-91d7-1c54aa9a16b1", "value": "C422C9D1F74DA05F53F21268167F2C089CAEDA7152F821F5FA77A464E43892C42ADBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329313, "uuid": "3bb202a2-1da3-4f24-87ed-98846bcead68", "value": "192:Q8Q+lF9Hoztm67MLncGS6BOZwUN1lTTLOg4HA2DfGEc6:Q8Q+lF1jO3atN7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618329313, "uuid": "4a2c5acc-8365-4e6b-a0f1-773407bad3b9", "value": 9996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618329313, "uuid": "d02be919-6d9a-4a94-a143-d933842dac3e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329313, "uuid": "faed7367-c9a6-4336-8d8b-8f888ebb3226", "value": "ZNAW72GH9MQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5242271-9c23-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618296301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296301, "uuid": "bcfb283b-8fdf-4374-b32b-9a8f4259390b", "comment": "Malware payload (RemcosRAT)", "value": "a8686559e29cba6dbd3fb0c47cf2e4b3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296301, "uuid": "89972c2e-b405-4027-9f8d-e9176ab4a1df", "comment": "Malware payload (RemcosRAT)", "value": "9032e1d7736005bf062bce03ffe445815a306a25625b6c25d6c33725ae2d9324", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296301, "uuid": "fab594f5-4029-46d1-a66c-b03d39af0d4c", "comment": "Malware payload (RemcosRAT)", "value": "2c3dbdc987d098a64c247da0504b16fb3ee22dc0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296301, "uuid": "4f64c9f2-dd86-43d2-afb7-83cf50dc9cc3", "comment": "Malware payload (RemcosRAT)", "value": "0e5d61d2db4570d9696af4482b72e71d190454c120f725d5e6b2bc80a1494b855d962d4c13fe55cb5538fb0e6eb9a639", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296301, "uuid": "ef526619-a9c4-479c-ada5-3ce7fa909263", "value": "B6155A51B690D8B2C02E19749D0B42F929B6BD30F9345C4A76F8BD0C7FBE6503D2DA86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296301, "uuid": "8cc937d9-11b5-4d0c-8ce1-b81eca0d9340", "value": "12288:4QOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9i0KRmp:lrjqQRVeSOywSSx91vi5XDf6AsK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296301, "uuid": "f3dbde3e-9b67-4f51-8546-7289c3a498ba", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296301, "uuid": "e0d55105-2c4f-4d53-bb7b-d249754ad563", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296301, "uuid": "efbb1bb9-7a87-4a42-97f8-48ecda424162", "value": "Proforma1986534,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc8d28f-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618300528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300528, "uuid": "70fa0fcd-f882-4178-aa35-b9f0a84a40a8", "comment": "Malware payload (AgentTesla)", "value": "f47588652d18e1ebbdc247442a84de26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300528, "uuid": "08b32571-0bd2-443a-be09-ec068cc19658", "comment": "Malware payload (AgentTesla)", "value": "912e5a3811bc456afcc14ab4052fe67f47c0034a7f82d74d9b3f7616e1fea463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300528, "uuid": "d1c623c8-7282-422b-b2e1-2d595dc32cda", "comment": "Malware payload (AgentTesla)", "value": "99b5eb6e316051a7da490f6d0511b6e4abb1a0cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300528, "uuid": "8b722ce7-62ea-453c-a860-5905dcd8a239", "comment": "Malware payload (AgentTesla)", "value": "db1e414f60e27a542139eb87ebda9b47251fd2e00ab6d0c65101f91b97b0df590ddb5f4ff473d03d7b75f3f640308a2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300528, "uuid": "5e51d04b-5b62-492a-bd7b-4087a2e5eefc", "value": "A045272C71048AD7C5AB03F6E22C480097F19D4EAAFAF64DE8833C97B6BD741B525593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300528, "uuid": "37167acd-48d3-4bb4-9e78-cc3bde58c6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300528, "uuid": "76d687bd-40d8-4531-889e-e20824d2d489", "value": "12288:CUSj8xNzzzj+uYP/mbIsYCSHS+tt9uJkvpsPdYYrHNKhdh6a7omgS0Z:Cl8xYuKmbIzHSe9uJopOYYkPly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300528, "uuid": "5a3bd574-ab1a-4cef-9b7d-5f019b504aa0", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300528, "uuid": "caafeba8-3309-44a5-b960-c279aa4ca490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300528, "uuid": "54a83d48-2e86-49fb-8cba-c6a41098fcd9", "value": "f47588652d18e1ebbdc247442a84de26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb7459c-9c1d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618293629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293629, "uuid": "02aaab7a-8e68-4e6f-86b9-4a3c8336ba81", "comment": "Malware payload (AgentTesla)", "value": "f7707950c502064ed3babee717e3e7cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293629, "uuid": "8bec57fb-68b9-4302-9c15-918dc267928a", "comment": "Malware payload (AgentTesla)", "value": "91533f8d714214fec503753085886b8d647d2270ff42a1dd45e0f5e897b3f807", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293629, "uuid": "a8587505-e0b0-4a73-b685-1826c95fe234", "comment": "Malware payload (AgentTesla)", "value": "b2f87d5f163236780d43bae5b6ee27777acefd9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618293629, "uuid": "8135ae57-dc64-475c-b5e6-ccafd728c1c2", "comment": "Malware payload (AgentTesla)", "value": "7e6a27fd7d4f767356418dd77ab9dee18286e74ff5a58ba82d0f16c6e2211c32992e38d60a81c2baa883d9243c791c08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293629, "uuid": "e24d0bca-028d-472c-b9dc-b3d478c426d1", "value": "BBE4021067C8DB92D93A47F68526A00347F5F1DF7823DF694E44A0D6352AB0C8EEAD93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293629, "uuid": "83cbc17e-d979-4157-a37c-985dc12e837b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293629, "uuid": "d2d1ab5a-2b58-4ea1-b25a-9e819137fca6", "value": "12288:OFrVP3m542egQrW11cRRgA2U8r1xTOWRNRSOwVFq7lt8v1kqGWpp:21h2U2uRRg/fNC3qxBNWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618293629, "uuid": "36c2702b-d87e-4800-9257-50e963113b96", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618293629, "uuid": "ee9de829-13e2-4386-8bb2-85323d0888b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618293629, "uuid": "7db8419b-73fe-43d3-860d-0345ea6bf836", "value": "Our Requirement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa72406-9c22-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1618295639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295639, "uuid": "17c837b8-9c4b-4532-8b43-38201ed54c25", "comment": "Malware payload (TrickBot)", "value": "daf2c02818375467629e74406724d2fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295639, "uuid": "a6a65b62-7c76-43f8-aae6-f6cf15143688", "comment": "Malware payload (TrickBot)", "value": "939b88500154ca78e968d03640464d0db24b7a6debf1499007c8ae8ac16f8f98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295639, "uuid": "0ec0d427-8f92-4f7f-9a91-7b41472f4a4a", "comment": "Malware payload (TrickBot)", "value": "daabe3668d6df79cacd3222e99814b31d7b5f52d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295639, "uuid": "e6d9c445-6df2-4b26-9410-959c3abfc6ea", "comment": "Malware payload (TrickBot)", "value": "0a20ad46f8928058b652599388e2a2cc28a530b533cb5a12de646d6bf088036c83b0f539a9a5d61a2cd23acd16b63748", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295639, "uuid": "2b1acb5e-a900-45b5-a778-e7fd22c37b9c", "value": "5284F1113250C1B9E22B293D8D718B720A6EF8611761C0CF7FA58B6E1FA4BD1DEA4317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295639, "uuid": "be1b8a32-c45b-4f35-9f1d-2d0289389d0b", "value": "e946a1aeb0947a3f3ea0cce4f93345fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295639, "uuid": "71059146-1f48-49c7-8a9e-dc2ec8796e1f", "value": "12288:VHW9JyCWjXKXFaqCvd9NhqVinIo/q3tUy:VHWfWjXKXFaqCrNhqN/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618295639, "uuid": "7be3c5a0-6e7a-4c5d-8037-6ccde5a2ba99", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618295639, "uuid": "adb9e431-134a-4bf2-86df-7eba49ccfb4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295639, "uuid": "49672ac3-7184-41c0-8379-4743decb1a66", "value": "MTCC169.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf8c711-9c40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618308553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308553, "uuid": "00e460a2-3269-41a7-abed-d87c43c39da3", "comment": "Malware payload (Formbook)", "value": "9df8c14c50fe690ec73aba0f8a285aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308553, "uuid": "524f2258-ab81-472c-ac16-ae5adaa34673", "comment": "Malware payload (Formbook)", "value": "93d053f43313cccae2d3f9d00b4556429a63efb104b97e08967da8569fa2ff82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308553, "uuid": "926f13dc-c268-49de-92c4-8265d9e0c47e", "comment": "Malware payload (Formbook)", "value": "4a1e5eaab12b6da32eabc61f026b6286f43adef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308553, "uuid": "8a8647c7-9382-40be-b054-6d05627e2653", "comment": "Malware payload (Formbook)", "value": "bc0462e22903b53e5a4dc4ed105fe4042fbe8894405b8b1cce81cd83db168d8a8e789d0966467ef4b1e432c5ae90da19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308553, "uuid": "16385ae1-b554-4ae4-aeb9-d904dbe980e5", "value": "8824121276C1EDB3FFC29032187B6B57D3B692762023190707995FB6AB710835D173AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308553, "uuid": "6b6ac27d-141d-4a5e-a25e-24e97e7a22b8", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308553, "uuid": "1849553a-6201-498f-afde-8011c662b08f", "value": "3072:HyewmN4skJ61tIGFdtY8TaL/AwdURWEjt+3CNEymZtmuc5RVArfJAiIj8DL:HdBtRdSz9URWEjtaCiymZq5srhAiA4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618308553, "uuid": "69ba813e-77d8-4f60-ae2b-422e9c122859", "value": 227888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618308553, "uuid": "d0f88fb9-2962-4131-8ea7-719dbf4d867d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308553, "uuid": "7d20160a-4062-449b-a7b2-d1a60cebcc0b", "value": "PAYMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9709aaba-9c4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618314692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314692, "uuid": "856144d4-9cd4-45d4-a0bb-d2f732f21525", "comment": "Malware payload (Formbook)", "value": "36db874805a9af1c9dbe46b1cc10c2df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314692, "uuid": "652dbe38-94a2-402f-870f-28585102e5a9", "comment": "Malware payload (Formbook)", "value": "973607fca87f94587e74f9cae648c7cb45a29a58e47c11894ec38502454a28d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314692, "uuid": "8df05ebf-3222-48fd-8ac3-94645ed0fcd9", "comment": "Malware payload (Formbook)", "value": "7d7aa57946727e7f4ffc293dd98dde4f61fb7e74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314692, "uuid": "41c4c036-3d41-4af1-89a8-aecc2c68b9c6", "comment": "Malware payload (Formbook)", "value": "dd87c26a6ae1152c9264a15cd5dd15f5a97ff49851061fdd2107ad8982b3239395c1337e995422b4267222e89d30af71", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314692, "uuid": "e3aa9e64-38ad-4a81-9aa9-1c0ba7468392", "value": "F0353374ECFA9017AB332201155D0ECDA16CE950A4EE3DCA7A283135798E37D3B9EC95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314692, "uuid": "8f4371ad-1be2-4938-bac7-ee8da1bef434", "value": "24576:3lGbf43mbMvnanoxw2GYxYQPwW8k5XNGLbETi:Efcmgvaqwnuy/kOLbETi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618314692, "uuid": "1177b05f-e837-49fc-8c32-49f0dbf0054e", "value": 1068183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618314692, "uuid": "bb2d8662-1616-4ce7-afe1-1dfe75a8d653", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314692, "uuid": "537ea44b-0304-42ee-87c4-a8b8e920c11e", "value": "banka hesab\u0131 onay\u0131.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12632d7-9c27-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618298012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298012, "uuid": "8c7d6dd3-9461-4516-8bf1-8ab4f4c52f0f", "comment": "Malware payload (AgentTesla)", "value": "7d0d6255e703703db2ab27eeb1e84f3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298012, "uuid": "c5a4f62b-2ab3-4ec6-bef6-57431f0a8dc6", "comment": "Malware payload (AgentTesla)", "value": "998fceca06bd80958a2657e18c2a1029c292db623847332251a674023a3a1551", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298012, "uuid": "07131c79-257f-410a-89df-247887cb14d0", "comment": "Malware payload (AgentTesla)", "value": "c9d3a6b5998665b7bf81834e3240872cd9da6ef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298012, "uuid": "d1639175-efa3-430e-947c-6cc53e5a08db", "comment": "Malware payload (AgentTesla)", "value": "d42bca9e37fb18c42a98b3068172a61ed78dbd949fddde7773d3503ad26102b30a71a83817051f51e00ae9a811cf027c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298012, "uuid": "b313830d-ac0f-48cb-9c96-b3f250a6551a", "value": "EEF4233B5FE6FE05A7BE65880A391CA74EC4496FD8500874339BB6EA61D3C5A2D3403D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298012, "uuid": "2e087dec-54ec-4cc2-a1b5-18896037a853", "value": "12288:YWEYspB2hFUqu4aJ847p7rYI7vKVVqA86Vy8pUqt7jetax0zpm39V0Q2dDzgQRB4:YL1pB2hF24aJZJGVVqA86/pLn0yepm3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618298012, "uuid": "753d5434-f6e1-420d-b08f-a76dee4caab5", "value": 776595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618298012, "uuid": "67935547-abe3-4899-a2cc-1b92386db649", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298012, "uuid": "ec09bf51-589d-45bc-973e-50dcb21b3d23", "value": "20211304-008936_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4eaa473-9cb0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618356940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356940, "uuid": "53e9a164-8a9a-4386-adc9-3d6dbfcf9e99", "comment": "Malware payload (AZORult)", "value": "63abd3223757a3c4b40d52f01d274837", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356940, "uuid": "a805ca17-f10f-4fe2-9106-6055b0d63e6e", "comment": "Malware payload (AZORult)", "value": "99a0a4ce4a345e3729c6177c979011f01d2272541d94e284b4da18c6cd59fd9c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356940, "uuid": "ca36ad6a-28af-46b2-819b-bbf7decde0e6", "comment": "Malware payload (AZORult)", "value": "3cfc44783d590f0c0b19bffb205b43ed8579a0ca", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618356940, "uuid": "5e1bb22f-cc4a-4755-ad57-467707120373", "comment": "Malware payload (AZORult)", "value": "9589ee62658efe0d22a36b9d6de03b5a92efdc27bbc76fd35951a65fba5fe2d2eabb2835fbe9c356d4a83cce57f81571", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356940, "uuid": "12e976f1-99db-4cfb-b989-ede957d5162e", "value": "3E24F162BED0DC77DA466B384CA6E33583769E00282351533FE03F6F7E76562C11929A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356940, "uuid": "5da259c1-f130-465f-a4af-1328eec74285", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356940, "uuid": "8f6b1bc1-df73-4226-8072-cae7c64496a2", "value": "3072:wyewmN4skJxY/F84o82KAYSvV9BVj+AQY0bj4ILVtj47XqAAatO:wdKY//gKATyAQYmvVN47XlAatO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618356940, "uuid": "e41ed0ba-a6eb-44cc-a8a6-bd6d05884dcd", "value": 224478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618356940, "uuid": "9159a45e-a9a6-4126-b18a-3bebaf77dc5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618356940, "uuid": "180c422e-2df2-44ad-a1b2-6ed4c239b905", "value": "Proforma Invoice14042187605521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe09f2d-9c49-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618312452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312452, "uuid": "d3d1b96f-bf08-4547-acbd-9504e91dd843", "comment": "Malware payload (AgentTesla)", "value": "fc713d3cf4a53fcaa910ce73daa9474b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312452, "uuid": "5923f4c9-018b-444f-9d0c-92f6664b0990", "comment": "Malware payload (AgentTesla)", "value": "9b748165c79e8dfec8456c9d7ec72f157c4b970c49e9dcf335b2386a23c71feb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312452, "uuid": "bf7efda2-4f05-4687-88e0-c85399c3415a", "comment": "Malware payload (AgentTesla)", "value": "10cc5b09d02e8e6c8d9a6633c198d7187fd75b17", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312452, "uuid": "ce766cbc-5665-4641-a2c0-eec56296c1d3", "comment": "Malware payload (AgentTesla)", "value": "044786d2a406ba16d5594561ee9e450bd5a7ee0bb648a4fd28ee50860c4d68e9b3204c62a57ccfaef1751ca847cd28fa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312452, "uuid": "d52add46-2ac0-439b-b996-4ffe7b432d13", "value": "B86423AFDEBAC9A4B9B19BC696B70589711BBB83C4875CFF9A60DC3C88C441305454CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312452, "uuid": "901f62d2-4003-4a9a-aa54-73131cb0ed56", "value": "6144:Pd4t/ylKeWIbL8w9+hryNQctZF8d9WQ1uaFrTSWFfW5xxfFMkJTr2EdX7Crq14XO:F4t/AKbIP9+huNQOF8d9aaF3dWPxWkJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618312452, "uuid": "33a0dd79-2640-481e-bd4a-d2a15d616b44", "value": 325945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618312452, "uuid": "a64ba172-7368-43b9-ab4c-1f215da7e82b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312452, "uuid": "b981bf0f-92a8-475e-a8d4-987a742c9772", "value": "invoice (2).gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45d1a26-9c44-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618310473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310473, "uuid": "a1f8502a-a3c3-41cb-b801-076f6c20f35e", "comment": "Malware payload", "value": "6cf0200d66b943e0c41ce00807ffe6c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310473, "uuid": "ca05df91-47f9-4ae9-86fc-150bd819195e", "comment": "Malware payload", "value": "9d2688c35966c4ba68ca34f8274f34e6bc5e0e62e1d40ce4a3073149e841d8b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310473, "uuid": "850d94bb-7b13-4b9b-aef7-a19c8696c054", "comment": "Malware payload", "value": "a52555d85074c581e2af2154c490f9599b77f95a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618310473, "uuid": "b12b0a33-1802-475c-b85e-946664a3aad8", "comment": "Malware payload", "value": "df21c73bebb354b064a07d827b22b4890c6c2588f58e9370cad7734b5589f0f321be386db6c2bf9e93e7852277732b88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310473, "uuid": "83a21546-3b6f-4814-bfeb-3473691f2d95", "value": "D884CF1173D0C133C05325798526CBB68EBE74712A6A598FAFC50EBD2F297D1A72630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310473, "uuid": "75e3ace1-6cee-4377-a0c0-1e66c55ec03e", "value": "1c198acdc88e6433341d82c12cfad0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310473, "uuid": "a1fe27cd-4f3a-40a4-aca2-082f00b386c1", "value": "6144:43yAPECLO4dK/eNvPosSj3nBXDoA35F/hH6NCSfUEne2:43yAf8eNvrSTnVDoA35F/hYVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618310473, "uuid": "e8869b6b-ce6b-45d3-a44f-f90895e1fe1d", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618310473, "uuid": "73ea8dcb-eefa-44d6-ba2c-12e53a340ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618310473, "uuid": "9e893d18-75a7-4310-9ef8-8c005fa0c7fb", "value": "SecuriteInfo.com.Trojan.Siggen13.6179.19808.402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2dfbde-9c15-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618290328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290328, "uuid": "554f86b6-de11-4ce9-b758-4dae4d89f946", "comment": "Malware payload (Loki)", "value": "5e21354989e9bf9f2fade3558a4a5db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290328, "uuid": "380d5871-beb0-4db6-96a9-97049831b8da", "comment": "Malware payload (Loki)", "value": "9d60f9378c8efa66cd292e5f36a58fb38b0d7b86550f4ca4a6df6e853e3aba4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290328, "uuid": "cd46479c-bca4-4cee-acd8-54239faf0e0d", "comment": "Malware payload (Loki)", "value": "858e6bc7ed039ac148786ba9260153945e5d5644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290328, "uuid": "2df4172d-22e4-4976-9836-790fbbff1fa1", "comment": "Malware payload (Loki)", "value": "9cc04307e014e65f29484c9cc32aa58bbcecfecb1827a266f4bae865b84949c80189042637ca2a54e106c9275fb88e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290328, "uuid": "3108a48f-d958-4bc2-942d-60b40ebcf2ff", "value": "12A4D02A37A8CF24E17ED3742131110553F2F11AD722E64DBEE051DE0AA2ED59B27B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290328, "uuid": "642296ea-4089-4847-8b45-f55408ca24be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290328, "uuid": "3de1a453-1e3b-4635-8617-df668a02c8f3", "value": "12288:GzwGg8To3yZ8A/KtV7IBVgOv/MOzFkDT06mrSef5xdVK:ltVEBVgOvLuDT0jueu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618290328, "uuid": "07e719eb-cc74-47ea-8a66-64f8b61d8f6c", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618290328, "uuid": "21171373-d39e-4465-be4d-8cfa749f8e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290328, "uuid": "f138d71e-d81c-4771-81ab-3504b5cc1371", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e65b6da-9c6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1618328770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328770, "uuid": "6552dde3-405f-4e9c-860e-5a6e2f0a45fb", "comment": "Malware payload (Hancitor)", "value": "805ddee53e734ee936fce81165f3658d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328770, "uuid": "7dbae0ea-2fdb-4e1e-967f-c3c52aa58596", "comment": "Malware payload (Hancitor)", "value": "9d641176e49b22eb64c9bf6cc47929fb3a793b4af3bc0363b9c20a482ff787c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328770, "uuid": "1a324fa5-eb02-41a5-b48a-eb04309ac5e5", "comment": "Malware payload (Hancitor)", "value": "981851658c01cdf202fccca3c31e415e9b85201a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618328770, "uuid": "7555aca5-9097-4bb3-a4de-c8a6f6b6edbf", "comment": "Malware payload (Hancitor)", "value": "dcf18cbb06675a59b3e812889320b8e042ef03f484c010a13c2c04035cf850e017f30afe3cd7047e0341b533b81eec5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Mokalvzapoe", "colour": "#4F1EBE", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328770, "uuid": "3bf5de0e-d52a-47fc-b0f5-deca63802aa9", "value": "7DD47B023881C03AD4B315744E6ED5A645AE78210B32A5EBB3DC2A3E5F755F17E32673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328770, "uuid": "2aa774e7-ff08-4d09-9b81-42912b555f43", "value": "0659f693c48b767359151cccfed1ca5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328770, "uuid": "d4d05038-2f01-41c2-b154-3e648fdcc874", "value": "12288:h+mnllr77vf6NdmjA3PzGE4zXSUEPf6roF59Mu9kKceEo:cmnllrPf6NdmwPf6rCQKkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618328770, "uuid": "39d0aeba-b758-42ce-9ec9-52da17065ff7", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618328770, "uuid": "11275c91-32ef-4650-977b-6bd9b466503e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618328770, "uuid": "0c5e05cf-929f-48a0-8531-7683615b760f", "value": "wermgr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da61bc49-9c1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618292471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292471, "uuid": "48334cd5-b165-4389-9f11-58c36328974b", "comment": "Malware payload (AgentTesla)", "value": "f641d51a52e9b4b9f14d48eebde25bba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292471, "uuid": "3bfa6558-8619-4349-bc62-275cfc4a5bac", "comment": "Malware payload (AgentTesla)", "value": "9ed7d85bd51b7ce64067d7c515c2c06a9ce0b5104a6e0ded4eea1e98e14dcd6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292471, "uuid": "ad06cd14-abfc-4689-86ca-a1f5d4250985", "comment": "Malware payload (AgentTesla)", "value": "83bb8b833364748d5c598fc4ca70dc7fa3aa7452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292471, "uuid": "3fd32666-12fe-47cf-9e0b-e2f870a5000e", "comment": "Malware payload (AgentTesla)", "value": "6997d6a73651953654918fe51eb64f7cb8243c20b7a7f529affe96345f7dec49ff0fabe9a7469c6d1df47442c740e868", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292471, "uuid": "2aedec16-ab73-43b9-94e7-9500b2f4aa67", "value": "04A423D4CA1F7EF585043AA23BA6F04F6B9217B35EEF0014D3785FDA9A478502AE5903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292471, "uuid": "8399b0ca-1832-4a05-acac-c8be0d3cec38", "value": "12288:xe9yM0PxhmWVnZ0Y7G0AnplkLrXvvALVTgE0hl:xPxNf7C3+/4JTAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292471, "uuid": "a684f138-1fff-4565-8ee4-82e8cf3b2e99", "value": 485007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292471, "uuid": "f2be644e-98a9-4076-b732-8b8a3ba67f6a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292471, "uuid": "526c325d-132f-48e7-8c48-fb27bffce105", "value": "Docs.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba250cd-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618300338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300338, "uuid": "54fb3dea-f96d-4c12-aeab-07338c2722b1", "comment": "Malware payload (Loki)", "value": "4d04ee7d903d7a55b55d9ef6fbb00619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300338, "uuid": "6bf41e59-188f-4dde-bc65-cc0be54f183c", "comment": "Malware payload (Loki)", "value": "9f54ec8bc3a20410a4a0307c1e00e098e27c607963867cab80fc1766d69f97db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300338, "uuid": "777dda91-9e55-4a66-b822-0621f124d358", "comment": "Malware payload (Loki)", "value": "d54efd5cac93ae9c5c8a026f6e728458f58da44d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300338, "uuid": "9ee37aab-3caf-485d-b09b-005bf29aa1e8", "comment": "Malware payload (Loki)", "value": "7e769c1de8212e9471318f87fedcbd752fa2aee1dc1352384ac2e3d77e33b305e8b375cadca8a5db0121f4eb6e0b747c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300338, "uuid": "e4d09ce1-09e0-4597-8e56-11ca97c24543", "value": "9BE30223A3F18C3FE3615E740AABB371C7B3D34804647543474A9E6FBB32642957A289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300338, "uuid": "dc560ce3-0ce2-44a4-989e-6d702071251e", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300338, "uuid": "a79fb528-a726-46b1-8b38-98ce3b8e4e14", "value": "3072:HyewmN4skJ6EXXVXm+FCrcqG/t9mIX8vBk2kcargHu5NTBy2MTCS:HdKZFC7w9mI6BocJcTkJmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300338, "uuid": "e1a05410-356f-4d09-b5c2-a968772488a4", "value": 148563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300338, "uuid": "9b912b79-6190-4565-b93b-95843ef9054b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300338, "uuid": "05858ae0-817f-40d4-bfe1-69ef34847dc1", "value": "4d04ee7d903d7a55b55d9ef6fbb00619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b2cef7-9c2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618300086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300086, "uuid": "f373fc36-c84c-4248-9417-06443822d434", "comment": "Malware payload (AgentTesla)", "value": "408ffb4cf7a574287c0abf5e161dd597", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300086, "uuid": "99c4b037-5a7b-446a-a848-86280af7ef66", "comment": "Malware payload (AgentTesla)", "value": "9fa9d0cadab18d6486a9a45394a6588685769e6895dd533f40326f6d2f2dd639", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300086, "uuid": "9d110fb7-e110-4ec2-9028-9377ae806720", "comment": "Malware payload (AgentTesla)", "value": "7ac425ecba22e5b7ca2ab6655cf389394f795e9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300086, "uuid": "8fcb6c56-3ce3-4935-b19e-b84fd63dd22c", "comment": "Malware payload (AgentTesla)", "value": "218df00f26614bc74a5705ca97a5ea0e3aef7c312ed7dbf7500f929cec5fa31f098f9f1058c968ad6b952ce25159fd5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300086, "uuid": "bdb5fb50-e079-445e-86a3-f100db197c05", "value": "1EE4E0A63788CF20D57EA3B91530530013F1F94AD7A2E64DBDE431DA1EB2B854B26793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300086, "uuid": "e2535cb5-188a-47c6-b5f8-ce23d9296e62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300086, "uuid": "ddc01cf0-2975-40ca-9772-bf5b1231bd9d", "value": "12288:7s+Z1iJYg8To3oZQmA/0KnnJOUTg8UtLhcRobCj7EPBh0j8hlzVZ885UYkWzNP:IlkU8tLTbCEUjklzVyWBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300086, "uuid": "b40b838a-fdd4-4f85-8efe-c60f89938883", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300086, "uuid": "e19181c4-9d3f-4ecb-8f3e-7a8757fc9065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300086, "uuid": "0ea6f748-69b1-4b98-987b-a9f77ee08c75", "value": "INVOICE_No5WIXW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefdf6de-9c63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618323805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323805, "uuid": "cf573213-3c7b-4606-acb3-c1354c6a0d0b", "comment": "Malware payload", "value": "1ed265711902968537e2c653c1147b85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323805, "uuid": "075b0b0e-242b-44c2-ab73-78e6b002f0c0", "comment": "Malware payload", "value": "a278ff8f523defb69d6f818c6383a938d57b993b8b8ca27b0f22ba1d30e4c807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323805, "uuid": "e6326502-d7c0-47dd-88bb-c8785dc48ba3", "comment": "Malware payload", "value": "ef855ab0fcb5c452ec0f0ebbce25978963d0e12b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618323805, "uuid": "e6808321-2adf-4d53-ace7-e694ba01e9f4", "comment": "Malware payload", "value": "0d6d3ba647755870d80a0066618b8a911203c865eb7fa5f9ad2e3f34c357bde3491748e0516162da24ce90935306cf6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323805, "uuid": "a873ead1-7929-4192-9018-1eec85aba857", "value": "7FC2F29E52EC2F63C288DBB9503ED26558085FFCFB0A4612FA5E2E1435F801118A2975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323805, "uuid": "e1fa8656-4771-4ec3-9f9d-b9bc15996da1", "value": "768:wsLqKo91CVzb95hraMQgerEA3rEsm315hfgPQ/7nmmM:wsdM1SbFr3WxPuDIoTmmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618323805, "uuid": "811225c6-e646-4665-b69d-da95073d3c61", "value": 27428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618323805, "uuid": "7122454f-a86e-406e-a861-283f48b3a957", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618323805, "uuid": "e3267cb4-b4e7-42d9-87ef-0bcdedededc3", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c3b19b-9c3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618308077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308077, "uuid": "5334d3a8-292f-48c2-b83b-8cab70e7195e", "comment": "Malware payload (AgentTesla)", "value": "5b4e3776006492bc8b875ec985aaef61", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308077, "uuid": "bc2decc4-cff0-41ca-8fde-44a48db214c9", "comment": "Malware payload (AgentTesla)", "value": "a30d10b1377c33016df61636566a6a95c611f1fe44321eb29bfccc88e8516fca", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308077, "uuid": "596d97d6-a647-43b3-a1f6-e70d05c7f70c", "comment": "Malware payload (AgentTesla)", "value": "9f9299952f703c20cd0203958e41c7392cafe5e8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308077, "uuid": "3446bd75-436a-4b1d-8773-a5f766445aeb", "comment": "Malware payload (AgentTesla)", "value": "3523613d9ed55db86f2c58a990f3fbd8cb14c9a79635f42bc613bb99b5fe0137baf03700b4f6944bea55855c50cc1d49", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308077, "uuid": "0333f4ad-ed6c-4046-9acc-9c7c619bcd00", "value": "D0B42397BDF1C8467DB1072C68934A52FBB68F537FAFAA1991F59F91AE42888041C081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308077, "uuid": "9c635543-bdb7-4a7b-b1fb-7a6c2df2376e", "value": "6144:dzqhltFqlMSZ05iMmpRmKW2i2WF5nYjYRslCYFd8ohEMivhHRqgOEexSPk3j6Ey/:JSlLKtZsmpRRW2UKVdYjTOlYzEy7eTT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618308077, "uuid": "f161ed79-36a8-44dc-92e3-ae01ef7b5701", "value": 506230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618308077, "uuid": "e4f5d8d6-f02c-4b87-bd92-d2a1c5cfbf24", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308077, "uuid": "e3e8fd2c-92f9-40e2-81e9-52b500016025", "value": "Docs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538004d4-9bed-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618272917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272917, "uuid": "b853a83c-a95b-42f1-aacb-12487b9a194e", "comment": "Malware payload (AgentTesla)", "value": "241b41d588c78261d04efc1f919f7264", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272917, "uuid": "27f37b19-4544-4a4f-8fd0-970090da21db", "comment": "Malware payload (AgentTesla)", "value": "a3108604078299277887204e29de019c799442fd99ce0ad6f3cba2c1e9c6a34e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272917, "uuid": "db171b6d-bddc-4723-b94a-0d9f31900059", "comment": "Malware payload (AgentTesla)", "value": "8cae06cb67b90c1710e4777fa1030746dbf2dc9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272917, "uuid": "dbc8c7e7-d9b9-4fd2-8a80-940a8b0d0a77", "comment": "Malware payload (AgentTesla)", "value": "435b9365d4f914e7e49bc69829cdaaf7950242fd9dfafe3e12ec2e3293b813fea9fbd1bf8bbf38c9e12c2982d50abccc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272917, "uuid": "373f52f6-b8ef-4cc4-a8cf-5aeaa034c517", "value": "FED423CE74EA245ECB15E4D4A998C9385109A81F4A0FE702ED2E566B283DDFD201CFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272917, "uuid": "7c34a11f-52f6-4b71-814c-0743f1b8481a", "value": "12288:Fy4NXPqPvxXmMeeH83O5ibt53vRCXipptGHAiDkvAV:w4tqnxWGce5iRZJAktQAigvAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618272917, "uuid": "21027ca5-74a0-47d9-8704-f99fca4200df", "value": 631782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618272917, "uuid": "abd99d86-9d59-4c75-9da7-04ac5b6c4f99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272917, "uuid": "573c69c9-4ba1-4170-8087-3f3b269b3015", "value": "Quote request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3828d5b-9c4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618313558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313558, "uuid": "600af32b-5123-4da4-ad1a-8c556af6d27a", "comment": "Malware payload (Formbook)", "value": "2a6c1b04f137fcfc02e78d6f2a331f7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313558, "uuid": "2d4f8ebf-560f-4604-b06c-8480594ee3b9", "comment": "Malware payload (Formbook)", "value": "a43158b1d51499dc45809d462540c86885b524ae4414bebc2228c5484abebabb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313558, "uuid": "7b2a357c-c8da-4e8b-a42b-297706f56ce3", "comment": "Malware payload (Formbook)", "value": "93ff4f1b159d7a919ecd3bb5f2190abd5b9a2468", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313558, "uuid": "27912a91-b00c-4a32-bccb-30a17f6c01be", "comment": "Malware payload (Formbook)", "value": "336f0cc1780dac1d4b87c4c7b9035e145f9eecfddcb500eabbfe1469f2adb87c215295acd61cfdfc5d75d63dbc870552", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313558, "uuid": "cca4a722-5540-46fc-856e-0edd9a42fa5b", "value": "0B141234825574ACD0C9CF238EEEFADF85534572042825F72D7AB36370B5AAA877D980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313558, "uuid": "b71221a0-50a6-42fb-9721-8daf7ff95d8c", "value": "3072:BKLZ4r+OakKHAuIk5Yo/aM1UUdJwNmNkry7d/jtNQYewH3psPmXi2/kWdf:FaOadbzp3/dAmycd/zQxwH3sT2/TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618313558, "uuid": "348d8562-da26-4e34-8b35-14658040c156", "value": 194519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618313558, "uuid": "d6614898-2563-42ac-a283-3ae485b7f4c1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313558, "uuid": "f6ea2aa2-71b2-489d-975a-9a70bc186c4e", "value": "SWIFT COPY.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae750ec2-9c67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618325468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325468, "uuid": "d25c4e8b-cc80-408d-a37e-f74b41e2b23f", "comment": "Malware payload", "value": "08275ec5564c59164f9b843dd8b5b4f0", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325468, "uuid": "2bf03f01-fa60-44cd-8edc-8a1e6d041c7f", "comment": "Malware payload", "value": "a4d064335fb8f2bb8b29d0eda5116a88c6e14169be85796a91118336f2482190", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325468, "uuid": "3c56c6f4-adea-4c99-8e49-009a6bca91a5", "comment": "Malware payload", "value": "d4909b6963da1e5b22b7bde4afad93c873a6a367", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325468, "uuid": "0711cc89-917c-48ed-bb9c-dc3c306f6e8f", "comment": "Malware payload", "value": "141abe4a2e036deab21fe996fc68eb5e7b70d642cbbb0e792479f6be590345a23bfbd76972225ddc11e586b65403ebbe", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325468, "uuid": "123919e1-a43e-4714-a43f-0ccbb0c979f6", "value": "3C83027DF4B75579E102A174AE12C1F1F1EC06491BC06E372E85FB079DA82E2AB197C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325468, "uuid": "d10a7371-a2f9-420b-9dcc-5027c86eedb4", "value": "1536:O5khMFNtr4Mj8lQxLFYPEE3QhEZgLovPN0UkobOBXBw9U:OOhubr4MjEqZYctovPlbOBXBMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618325468, "uuid": "1f6c9e4f-2cdf-4f19-b6d2-3d0b3c72207b", "value": 85926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618325468, "uuid": "23c0bd3c-ab03-42b5-a41d-83c702a5339a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325468, "uuid": "f94df37b-5b5d-4f11-a827-54f483e6e1b1", "value": "Besonderheiten_04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649b1e80-9c2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618300004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300004, "uuid": "389439eb-3bba-46dc-ad43-daf013f576e3", "comment": "Malware payload (AgentTesla)", "value": "81171c87878db7a0a21cc56c95dfc1f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300004, "uuid": "c9d790fa-982d-45f8-9686-e0b7f8b5902f", "comment": "Malware payload (AgentTesla)", "value": "a6258b46adfb734f248d3aa3d0f7b57c0d1a5bbfde1e8eb665d6ee21548ec089", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300004, "uuid": "424eb586-697b-447d-997d-e9cf2fa8ba0d", "comment": "Malware payload (AgentTesla)", "value": "cce276d1f0983fe7534b7b0648e85cc9b51b4dbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300004, "uuid": "550c9b5f-e976-49a8-9a50-7b9f27b33a0a", "comment": "Malware payload (AgentTesla)", "value": "dc9e8e629feaf91fc85a9e97b92037cc62710e3c71e2ad5c775a09805e6883cd5f05e3c96db4bbd35e6bc0b0e2cc89dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300004, "uuid": "c332dff5-b50a-46f9-b568-124b4c9ad6fa", "value": "06A495ACC09747EC8FCDB7B46A1A1E891208B76DE385F5533638A7752B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300004, "uuid": "c1a6e638-f197-465f-8f85-256b704bfceb", "value": "12288:Tj5BZ4rlPhHkcg8rkfJVMJboLDehV8xqPe:Xi/Ecg8YfjHwVS2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300004, "uuid": "d1a71d25-06b3-47e4-8a60-c401db90930d", "value": 458863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300004, "uuid": "16394e80-792b-41e9-af41-93efe87e58fb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300004, "uuid": "6942148b-ec75-4025-b308-f30665509e06", "value": "damaino12 5.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd48ae9-9c22-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618295882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295882, "uuid": "b90d36af-fed1-4fb1-9cb9-dffe871d337a", "comment": "Malware payload", "value": "85d5aa8c85d346081da309a6b899a03b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295882, "uuid": "f5809300-b00f-4809-b86c-c0a03332f442", "comment": "Malware payload", "value": "a6281dfc2c005eaf8413858165a7152a1825693f34a67254c763f2db4f43faa7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295882, "uuid": "7dd50601-3125-4108-944f-bb8ecdab9a5e", "comment": "Malware payload", "value": "40d9b825fa73889b5f83b9bfe603474737675f5a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295882, "uuid": "fd3db0a7-45ce-4427-b69e-286445979faa", "comment": "Malware payload", "value": "fe4f1ecbf3214a6c5f59a9885ab09f1e1c112f94f56e5629edc3db4c666fe5a5e280101104eac43497890bdd1e2aa83a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295882, "uuid": "e61c24a1-c84d-4447-83a6-1dfa6fd7419b", "value": "52B423357DA7D7C81DDF16BCD9F032A8664F4708F9B125C122F58787C81AE43590A2B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295882, "uuid": "91039c33-b24d-4b35-9e05-cfee9320550b", "value": "12288:Ip6uysFVnNjb9kN3LbdsBmNJXzHIE/yi2SUh9DhDUEd:IFyqVnNjb9k8Bm7LIE/sSC9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618295882, "uuid": "6c07bd33-7d60-40e3-86af-8790eefd4e11", "value": 495642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618295882, "uuid": "d3fde1cf-24ff-4246-a201-f8df8d71d744", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295882, "uuid": "0aec05bf-9975-4710-9067-fc867e4f3b73", "value": "TAX INVOICE pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce7f32f-9c70-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618329063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329063, "uuid": "a8147f71-7df4-4fed-b285-d9982e9b5500", "comment": "Malware payload (AgentTesla)", "value": "4d85f23d2598038ae58df6357800d7a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329063, "uuid": "c1ff1db2-41a8-4810-b8bc-56499a7c7fb5", "comment": "Malware payload (AgentTesla)", "value": "a811716aef3813459592be47f52e95ef6a134cd08d31ea232b917ac3260bb177", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329063, "uuid": "c69e0a3e-7df5-42a5-96f2-9a25251b2cd7", "comment": "Malware payload (AgentTesla)", "value": "2f7d087031767594f6c84d5ccbcc6d71d7a475ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618329063, "uuid": "daa96fe4-ffd5-43cd-8a51-3515d2058b50", "comment": "Malware payload (AgentTesla)", "value": "f9234221169de93779f30673d0d7994560f7b22bff9ef3cbcaaafb9ce57c90545b0d9c5edb834b0aa777eb2a70c3218c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329063, "uuid": "d1e55eea-92dd-4545-b2bc-0366e17b05c9", "value": "C405CFAD765079DFC86BCD76CA581C64EA21B4BA830BD203A01716ED9D0DA9BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329063, "uuid": "4145c3be-98d4-4dc1-b17a-724db32f927d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329063, "uuid": "5a1ba433-59a8-4cdb-9753-5518ea719cf1", "value": "12288:cLkB0spOfEhLko9dOyY/l4s8HDRY/4GnzyZjF4PAZ92deFhAHFAr71PhJLrxuuqr:T7VZko3Ye9VYJiJ4P2meFGlArBPPP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618329063, "uuid": "adbcb314-fc77-4dc5-8832-546a5cd58e5a", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618329063, "uuid": "1f2583dc-d6a8-4e8d-add6-de694dcb03fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618329063, "uuid": "58bf9b5d-5dca-492f-8287-ba2a0be80643", "value": "Invoice For TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c28caee-9c4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618314485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314485, "uuid": "77df079a-bbf2-471b-9d62-6e9e6e8bb7ae", "comment": "Malware payload (Gozi)", "value": "014b043413b5135ee5609dffb5307224", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314485, "uuid": "2baa4ad6-3e5e-4556-a0d8-dd3277ab5d9e", "comment": "Malware payload (Gozi)", "value": "aa56916f2b2343a71ffbb8e8e28350d2cdd54ece785712703de5a703d58bb4df", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314485, "uuid": "5652f82c-2c3b-49fa-a18b-3228e34629eb", "comment": "Malware payload (Gozi)", "value": "3dc6e08404610a07047925d6867d5751212432a6", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314485, "uuid": "ddaa1d0d-e242-4f9c-ae68-8e6b11439583", "comment": "Malware payload (Gozi)", "value": "f04f78f130cbbd76ee07d78ec211b3205e18bc31767022886e9ae171da6ef23880029ae0dd71fd29bf7f1940e50b4918", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314485, "uuid": "1d41ad80-b2e8-45c2-a408-b520cf9c9be8", "value": "B9945B02F3D5C035E5726B384863C6F149EB7CA1DA35849B76C86B6F2B377805A3874A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314485, "uuid": "deb90d4f-10f5-49d0-a187-ad89331c7cd1", "value": "9b4dc3e1cb4f9e7f2e23ae54ceef7eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314485, "uuid": "54821cf5-395e-4b53-b796-e9b9f0bc192f", "value": "6144:5gFw1NthjlQTiHUjJzBpEKI+xnRzg/j+LIAWg5LtMoa3:5UK9jliiHeRndg/WcP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618314485, "uuid": "1fe93470-1a9b-4641-86da-29c95d707da2", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618314485, "uuid": "255a06e8-0dc9-4aa5-8572-7e896664c19d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314485, "uuid": "dcea0fcf-9d75-4319-b53a-a80f83ef6aa0", "value": "aa56916f2b2343a71ffbb8e8e28350d2cdd54ece785712703de5a703d58bb4df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a8b8ad-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618292807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292807, "uuid": "d97ef06a-ee74-4e44-bc17-f8fc23e02eec", "comment": "Malware payload", "value": "b64f230cf14b2ad0ecc0b0ae40cedf55", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292807, "uuid": "fc9cfc51-05df-456f-ae04-6d53dd7ceb88", "comment": "Malware payload", "value": "abef5ac903c9772566c7c9fd1f5e2dbfcad705c7b42ff8b7af0f3b614bf86973", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292807, "uuid": "75e57c3f-12b6-4a0e-b7b8-51b968e96218", "comment": "Malware payload", "value": "6a447e5a677a63753ea5bddb737493128ddb7f9a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292807, "uuid": "aa143990-929c-493c-93b2-650bf585ac62", "comment": "Malware payload", "value": "7b00efb55b842d84e212354fccd69f7312c2d49de57f8569dba18ff904f76c3a44822630fd3260805dfb2fb787a8afa0", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292807, "uuid": "5afa8369-1ebd-45d1-8466-ad2d47265217", "value": "ECB53315D50D92BBDD4EDECBD12AC8E0A5770A661C7C3363730A32ED45D43EA78898E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292807, "uuid": "e9b61155-4a8c-4d98-b10a-923cf212fd92", "value": "49152:/97nN+2fDiCKKAp9PPpjRrhlTpsAdXf1Vsms5ygks3Tdy+TE1:/97nN+2f1KtpXppsKN+m0yg1dFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292807, "uuid": "fc230060-b3b0-4f69-a8fc-9d15fa4792a9", "value": 2494113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292807, "uuid": "ae4c9809-0efc-44ca-bea9-95a2879d20cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292807, "uuid": "be740a20-d017-4e83-af41-4b510ec68f32", "value": "Invoice-SRP0047459188e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c142c1d9-9bf5-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1618276537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618276537, "uuid": "d8305c6d-43be-4566-96fb-b2da59d3b8c7", "comment": "Malware payload (BitRAT)", "value": "77aa9c588a675103663d29df97ca8141", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618276537, "uuid": "0c4021da-24dd-4de4-8e21-dd86c202231a", "comment": "Malware payload (BitRAT)", "value": "ad49dea56c095979c172d844522d5f97458e41d03e8e97e647b6ee35f244c6ae", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618276537, "uuid": "1c4be0bd-03b8-4fff-b820-e67319641c69", "comment": "Malware payload (BitRAT)", "value": "4324f11b6cbe8fedaa4b54f7b1f270427fd88702", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618276537, "uuid": "62280f9f-b390-409e-80d2-1be4a59cc211", "comment": "Malware payload (BitRAT)", "value": "a2c6faeef6d5d6435a6370d35a6bf80a8fede162454b2acb5dba91790c00ff6402b65f739087b5eac9cb68f700dc49d0", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618276537, "uuid": "f709f1c0-155b-4c64-aab2-820370293f8b", "value": "2795226926A8EF70E27ED3795630120143F1E54AD312DB0CBEE511DA0EA2FC25B27797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618276537, "uuid": "1186bbc5-b282-4f1d-b8c8-c3a20120ce37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618276537, "uuid": "7f2e3e6a-a8ec-4932-ac7f-23d6d534d82b", "value": "49152:qn8CF5hmXhlSLQVopgUM3mZArmoVEJy9V:s8G5ihz0gUMzrUy9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618276537, "uuid": "12f73aa4-dc03-4511-971a-a75a45a3a075", "value": 1974784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618276537, "uuid": "e72a9b3c-3c84-430c-8319-b97e5f914267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618276537, "uuid": "fc0e2b4d-ca99-45ea-a928-b2d8067b61ec", "value": "New Tender04,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ceb5e7-9c24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618296590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296590, "uuid": "bc009093-0e23-4b68-ac27-240ebca81874", "comment": "Malware payload (Formbook)", "value": "fe634f8ec63199234077861a06a358d5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296590, "uuid": "23c69de6-5ad7-40a7-b23e-fb5fc56b78a1", "comment": "Malware payload (Formbook)", "value": "ad960cd2aee4239f9899eabefa5819c568d89195cd81acc0dc175bc5888be5a1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296590, "uuid": "52202132-bc75-4e3f-a869-0d5dd3e51ff9", "comment": "Malware payload (Formbook)", "value": "fbedc019bf707804d305445574aba0891a1eaed3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296590, "uuid": "df7d14d6-f5f0-43e1-98eb-a2a195c441fa", "comment": "Malware payload (Formbook)", "value": "4d77110a074a5f56813d3595e7fd59132c85ea177c8047535870e6fffd26322ec55d9fa7d3a4e11ddb44008ca755e61f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296590, "uuid": "e725abf9-6a6a-4ab8-aba5-443921d610e8", "value": "8CC4E0353798DF15E17F9BB96820110113F5E10AD732E24DBCD8A1EE1A72EC18B2B796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296590, "uuid": "294af2a2-285d-4d67-b37f-1fe9dcc4c4ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296590, "uuid": "2ec69a99-b80f-44e2-a19b-766e6358bdf4", "value": "12288:Sqlf+9A/ixs3BW72jbEwAJZoz9p/HSCQbc0r87xYCRtK:/h+KW7WEwAJZoz9JHS20rCx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296590, "uuid": "12269ca3-58a6-4fea-8773-c4f7e0279660", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296590, "uuid": "265deb97-4aab-4108-9e08-60413ca6f186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296590, "uuid": "59a5a279-71a2-4dc1-b512-7caaa5b7c153", "value": "INV#609-005.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29349b4b-9c19-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618291744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291744, "uuid": "8fb2dd14-8f73-494b-ace7-477185fae17d", "comment": "Malware payload (AgentTesla)", "value": "b4eb47b75bedcf4e10946acc643a3a42", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291744, "uuid": "2bbd5f18-86ff-4f1e-ae34-6bacd839fb09", "comment": "Malware payload (AgentTesla)", "value": "ad9cece52c221918d26a3e2325ea01732f309e081ee8fee7639ee727ed01f895", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291744, "uuid": "ce7a371a-92aa-4bb1-99d6-ad857237b796", "comment": "Malware payload (AgentTesla)", "value": "039d26bd4d63709597366f1b7aaa4e6b4a700f2d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291744, "uuid": "b7c71c0f-8001-418a-b095-28d4088e01af", "comment": "Malware payload (AgentTesla)", "value": "807e2edd48dbf77d9c096f04b3aec207b33dbebd6886ece708f7e39d5d4b454e224eee71bd55f0081062a752ed229690", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291744, "uuid": "23028131-76aa-46f2-9269-e18d7a190877", "value": "41E423C6E2D96CD73A4551583AB1A40707B8C32BAAFDD0E4012FEBB14D1B88ED59F90D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291744, "uuid": "279ecbf4-567d-4ca1-b547-e250a15dd634", "value": "12288:+hhBxDuGl8kp+wsT5uYZRN/tVCfx1CoNW8o+rwge6nYRMxtxFPwUolN3cE:+zl8kMb7zI51CCWd0nYRMbxGUm3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618291744, "uuid": "46208640-ce1b-4ef2-8f59-5ced966c9d6f", "value": 718222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618291744, "uuid": "d9871b4a-cd0f-4833-b7b7-56716431985d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291744, "uuid": "fc2a4fbf-0d5a-41b2-999e-79e7315b31d7", "value": "Shipping Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3a0c82-9c22-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618295910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295910, "uuid": "11a0246b-164a-432a-a781-c3b5c5037c0f", "comment": "Malware payload (AgentTesla)", "value": "ba22b0c8e8c2ef534e3e05077fd9d163", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295910, "uuid": "22c1d736-16d6-4ee9-80cb-216aab04d968", "comment": "Malware payload (AgentTesla)", "value": "adde9a33b4e9a9c7d7808c2218edcbb012ec085843b758a7fab74e1d422cb743", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295910, "uuid": "05a30664-ea21-4c3e-8b74-a856a02bc6f7", "comment": "Malware payload (AgentTesla)", "value": "0d8eb573bc99d10da0d0d2e968e58a557ae310ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618295910, "uuid": "7e16e6a8-5133-4e32-b3e8-3e8dce138d3d", "comment": "Malware payload (AgentTesla)", "value": "6a3d82a0c790c1b2ec65323e03e9f3084fbe4e3e33e28f7bb327b0b6edc57aba2ccbc2b347b424ad6b632976d3d4bfd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295910, "uuid": "4dca96d5-8ab5-4e35-a2f1-6738dec496b8", "value": "2773A2D4AB980AFAC06DF63653A4284D12237DB74931CA2F78CD20139BE77841BD1B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295910, "uuid": "b5283479-0c1a-46ff-be0f-f10f840b7974", "value": "768:eaYHDgzSdWIvK+ZcFSsdTTT+lLrGfliQ7:TYHDA+CFSITf+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618295910, "uuid": "5df03b7f-7e28-4ed4-9572-ea07f3249407", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618295910, "uuid": "ee0ef8dc-3854-41f0-8422-8d1c875613f5", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618295910, "uuid": "3b246354-b5c9-4e1f-bdde-86d18d13e66f", "value": "Order List.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd33ff1-9c40-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618308479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308479, "uuid": "ce8efeb5-8b69-49f9-9acd-5636eb8dfb9e", "comment": "Malware payload (AgentTesla)", "value": "2111f4f21cd0bd297eb555c3a2af66ad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308479, "uuid": "efed4090-92ba-413c-beb3-9cbe60cb259d", "comment": "Malware payload (AgentTesla)", "value": "ae2bc33c34e8b0f727538c55c64a1b316b477bf9ea27b29ab56ae18c75b7221e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308479, "uuid": "6e90a6a4-59da-4c67-b68e-33f0d3b31445", "comment": "Malware payload (AgentTesla)", "value": "482f8d6b359324af47ec8e4078fbfcb9ff1e9b70", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618308479, "uuid": "f4d9f917-bbdd-48ec-899d-0f8f235dfc3a", "comment": "Malware payload (AgentTesla)", "value": "bea63ead4300ed9725e68b9f3b4923af2449e0858b41e5f4b529e4923cf6c7b630249bb66c71b3773a730557bd838620", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308479, "uuid": "5dc9280f-f518-4415-a498-fef2234acd8a", "value": "5EA4234059D766CA4458AFA0C6EE1A5730ACC04F6EB815DE2B0F75AB778338E3D43D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308479, "uuid": "0370bd87-02fe-44ac-8a0a-609ae59b6238", "value": "12288:IMSyCyWV1rCEvwHRBl21r7nnpPO0ldwEU6:ItDL1nvgRzELZ3A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618308479, "uuid": "231179e6-d0a6-4ce3-ab07-1ae043b8e8a7", "value": 486724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618308479, "uuid": "0579ab95-10fb-46ea-864a-89484d9016e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618308479, "uuid": "49829ac0-fd05-4f89-8163-554276fbae6a", "value": "GS_ PO NO.1862021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e0ae7b-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618300404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300404, "uuid": "434c140f-120f-467f-98ba-1eb21f7eb74f", "comment": "Malware payload (Smoke Loader)", "value": "3cf58ec9de521b32015552ca3024d1cd", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300404, "uuid": "f130c7b9-1258-4f74-a17a-6b46e77e12fc", "comment": "Malware payload (Smoke Loader)", "value": "ae3e0639c29e82ba61932616457bae4100c939c281643dacfaa1bd5ba2dc9ace", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300404, "uuid": "18bf1a5d-2e6e-4f1d-9697-34d4b57d2b56", "comment": "Malware payload (Smoke Loader)", "value": "539236ecd9d859f82f89311bfd564906aa98451e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300404, "uuid": "e5fd9db0-ee05-44c5-94af-f3fa6f9eb495", "comment": "Malware payload (Smoke Loader)", "value": "2ad7a278c599b3b95261a8841998cdc89ac3e6003d9d79ab9bc6bd9346b71d09e7c5a94cc19ad46ff6d9e7e158b93882", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300404, "uuid": "bb93218b-3d1e-40d1-bad2-0560970136b4", "value": "A7E2E12EA9A43DB4D1735E34CBCE8DF989F8858A2430C36D5FB474DEBE474882952187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300404, "uuid": "561e81b9-b7d7-468c-aa5b-996da2ac0885", "value": "768:FrqQ7AmV3rjBkyo1b2kP8K9RWTmUAiPatwTxS+IASDO39UYlyaQPZZl:F33kKZTxP3FS3AXDuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300404, "uuid": "38331c6a-31f7-4ee0-b743-efd4d9551a18", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300404, "uuid": "ca1c0e9f-74dc-4453-b183-3dd861f3f40b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300404, "uuid": "4858770d-a5b3-42f6-8c17-49697365b174", "value": "3cf58ec9de521b32015552ca3024d1cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1f8db2-9c8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618340844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618340844, "uuid": "89a464ef-c142-4461-b5bd-f8a1be2a1341", "comment": "Malware payload (Formbook)", "value": "427dbf71c997148da73fa4cfef1cf284", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618340844, "uuid": "e0d67520-6528-4cf4-97c1-b7a4e2f07cee", "comment": "Malware payload (Formbook)", "value": "ae80c3c9ddf62e5b9b70e173c55b946db7a41aafee9bd645621157e05e9f95f4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618340844, "uuid": "40aa9a4c-2100-4808-af79-3ac2b7d63ccb", "comment": "Malware payload (Formbook)", "value": "5a5e2a09acc7689d75bb89f38d3014ff1df16d48", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618340844, "uuid": "23313996-0341-41f3-b5a0-dfe3d29703b0", "comment": "Malware payload (Formbook)", "value": "6d7e3b5ed8b0686aa8f28d70215c9731d1e535a2764a4a2c7be39f05a18b432179bd4f1600a1cb63d7f17f3ccc8d9be7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618340844, "uuid": "c1ad7d63-f100-418e-bb37-c0dcb3527eaa", "value": "830512AE72945B67C53F45B105C0F88403B19249BA62DFECAC61F3E95AF6FE068411E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618340844, "uuid": "b15facd9-6392-4946-90e2-57836db48d81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618340844, "uuid": "329f8fd1-87b5-47c6-b25d-539df78d6bb6", "value": "24576:IY1XFht3NEpAgIK3bNhZfjpCXA1hGLEX/:fNEpAO3bNhZtClE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618340844, "uuid": "d691b2dc-c275-470e-8bf6-a1d90b9fea4e", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618340844, "uuid": "618df96d-9a19-4009-842a-c107a0569ee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618340844, "uuid": "ffad5f2b-e91c-4f8a-bf72-1e22a235ac42", "value": "PO#EIMG_501_367_089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c142de98-9c35-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618304025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304025, "uuid": "6f8b88ab-1883-4be4-91e3-e08a80a34d4f", "comment": "Malware payload (SnakeKeylogger)", "value": "16176fe8391dc2c993e6bf67b9072932", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304025, "uuid": "21a068f3-d0c1-4868-8f96-5f7f1b04d412", "comment": "Malware payload (SnakeKeylogger)", "value": "afdcebc3df2ce9bad93a195ef695d2a3f260c823c91cd85589c886859b2bfd87", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304025, "uuid": "5464d3f4-78eb-46a4-bb6b-91a81b6ee6dc", "comment": "Malware payload (SnakeKeylogger)", "value": "06f86c67548be515e676db73dd1e718922ae5df2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618304025, "uuid": "ebd13b6f-43fe-42b1-a01d-0f344edea886", "comment": "Malware payload (SnakeKeylogger)", "value": "ff4c582d433d8a90a11d1a4bd7ad0c5c190cc908abe71176fd8373df8e452600658dc3d129d161547928bf6a52a5d019", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304025, "uuid": "0c008288-7389-4296-a6ab-30b75ceb41fb", "value": "5805E06CA6BCBDDACC2903B6F1B1A44023B0F214A1BDCE9DE89163AD047778375C595B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304025, "uuid": "1f6bf426-e20c-4438-88d7-fafa82d7513c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304025, "uuid": "0605153e-beed-45d3-a253-3ad79a4a733e", "value": "12288:pnVa8Cym56iR22iNZFhRwLQEUmmkc8hYi3FP8y+zwmAfyaQjNGC0DS3YYslBz4qp:prl1XFhRwimm+Ki1SSMECv3Sz16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618304025, "uuid": "b2d0ccad-f56a-4fcb-bd1d-ca05b91fbc85", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618304025, "uuid": "27bb371d-4bfb-42a8-a598-ddfe3a59077b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618304025, "uuid": "7810618b-8ecb-4c09-9703-ff409b8d3161", "value": "TC-1 G TWO TECH ENGINEERING SDN BHD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef119c3-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618300397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300397, "uuid": "bdcb25af-ce86-4437-968a-c31655d8d1df", "comment": "Malware payload (Loki)", "value": "196192ae86384d7ffa0ea7e43ec7d640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300397, "uuid": "66f2afc5-4edf-4ef7-87fd-07c2d8e41bc2", "comment": "Malware payload (Loki)", "value": "b30a4fd92717a14fde969110f3113859a9c9f4e0995b9779a4464abf1c818cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300397, "uuid": "4f06fa77-d4f3-4842-aae0-98236687c34f", "comment": "Malware payload (Loki)", "value": "3cd19040f22dfa27dd242afe75d6b05b09778718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300397, "uuid": "0bdcfdae-0c1d-41d2-9776-7f43025ca016", "comment": "Malware payload (Loki)", "value": "e4a0ac221f9e5aab72582a4c81fd2410d94d308fb2d79e813ddfd404d9845a4f04876e3156b310878cafc2fe8c213055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300397, "uuid": "16604279-10ae-452d-95b5-a1803059ac59", "value": "2F241266B6C1DCB3DE17823198B78369D771C264604463630F9C9AEEFE77643462C272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300397, "uuid": "12124fff-4bb8-4a2d-ae1b-291b7da92cb1", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300397, "uuid": "acb60728-67f6-44a4-9b45-4d1a6ddc86c0", "value": "3072:HyewmN4skJ6+gqilK4oOpbpBmiaHrY1+Q/x3qDgpP1Rnk6Gzk7Fo3N0bEJweOznC:Hdg54o+pB04+Q/xFHNwk7y3NXgjQpc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300397, "uuid": "6e24c397-85cb-4c9b-afae-41572e2cc3bb", "value": 225739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300397, "uuid": "db7a88e2-3dd2-4fab-8878-04fb25115865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300397, "uuid": "88b19873-0086-4dcb-93ee-08e9e9755b2a", "value": "196192ae86384d7ffa0ea7e43ec7d640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9a5c30-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618300605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "0c3665b4-9e11-4207-9556-fc432f9780c8", "comment": "Malware payload (AgentTesla)", "value": "2d756f01b73abefabe75278d95196ef7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "830afa5d-318a-4938-b904-fdc80c049203", "comment": "Malware payload (AgentTesla)", "value": "b5805e39212764c862be2a08240645a996b89526ab2fbbb3bb541864de2d04ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "4dd86910-6263-434c-8a77-a27152bae1f5", "comment": "Malware payload (AgentTesla)", "value": "d1eb98a95a8d43d0eea373a52db6e4ebc0981b48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300605, "uuid": "cfa31f76-9fe6-4353-a826-f25d62ea4150", "comment": "Malware payload (AgentTesla)", "value": "e06d45eec0694760ff7141c350f0ef179fac9f17c8674313ab6902b03d9788aba3135a29d4eb6b5c7b0eea7e8fc52e97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300605, "uuid": "83667fea-3f0a-4f59-b55b-d3bb17980c86", "value": "FE539116B767C9A3D1596A358EE2D6CB3331BC22BD81970F318A331F2E375508D42B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300605, "uuid": "8ad418d3-3955-4621-93f1-eb98e5bb7043", "value": "192:7BKzolzjBDkQ9DTEzLTAcjydISgXruCvjAnl5C0Ij4RaHR05wrpQu:tbXDkQ1ELAcwIpXrLvjAls0I3xuw1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300605, "uuid": "8dc29870-86c1-46ce-bd6f-e9f0140fe7ad", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300605, "uuid": "046fc0d6-1582-47bb-893a-18ad0e4e24c8", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300605, "uuid": "71907df3-6f4f-4986-b537-d13d566f8ed4", "value": "Order 100920-0087.pps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ab2f94-9c5d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618321123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321123, "uuid": "bbf2f7c5-d1ee-459f-8075-ed473a52b34b", "comment": "Malware payload (AveMariaRAT)", "value": "4832512b0139507f1a4d1a9bcb9858ee", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321123, "uuid": "379079eb-6ba5-4efa-952c-c473c494b4cb", "comment": "Malware payload (AveMariaRAT)", "value": "b59b27b89189fc7fd98bc8f8a70d7d500907439cba4303c1eb812532fa2bc96f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321123, "uuid": "bb459541-1f3e-48f1-8894-1101abf14d2a", "comment": "Malware payload (AveMariaRAT)", "value": "386eac6f001a27066eb01bc5dd89930572b72a95", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321123, "uuid": "2a21b0cb-eadb-49fb-b854-d0fd664c53fb", "comment": "Malware payload (AveMariaRAT)", "value": "56db96290e905e1697392394a6d0400756f58f08594fb4f7fa10f128b5471df859111123878f815dcc504cb9b9ffa6a9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321123, "uuid": "4ab437e9-ab04-4997-ad8f-b5e7b7ca1df3", "value": "AF055C12B650C8B2C06E19749D0B52F869A5BE30FD348C8A36F5BD0C7EBE6503D6D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321123, "uuid": "c221758f-1366-47c2-8370-3605213066bf", "value": "5460111dfb820e05d52b9be905fc0229", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321123, "uuid": "b0f8658d-4aa8-40a1-95a5-c6b497b3c38d", "value": "12288:VQOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9iSKRmpW:mrjqQRVeSOywSSx91vi5XDf6AKK8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618321123, "uuid": "1426d3c0-a35a-4c91-8838-8d1d524b023e", "value": 858768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618321123, "uuid": "bbf20eac-bc0a-49a4-bd3e-2f0d656a54f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321123, "uuid": "5fc6b1ca-391b-4981-a069-176a98685aff", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e589a28d-9c54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618317400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317400, "uuid": "32b0365f-0bd4-48bb-be7d-0f028784ec5a", "comment": "Malware payload (AgentTesla)", "value": "efdeabfdfc9c9ac59cbc53c9b36d133b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317400, "uuid": "7a9a98cb-bb2d-4409-a544-8d1683e75758", "comment": "Malware payload (AgentTesla)", "value": "b698e126fc9a1cb9c697e36d5334e00c6fa84bd5390752bc88940cdf8c31e7c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317400, "uuid": "012ba3b6-0691-44e2-87bb-18abc238f1a3", "comment": "Malware payload (AgentTesla)", "value": "609c3648a6c1e81d95cd8b47dbe95f96c8aa7ea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317400, "uuid": "35143eda-f0a4-45eb-a384-704d759c502d", "comment": "Malware payload (AgentTesla)", "value": "73cf1b6f2c65478f7d536e0d12733269a599d065e8a5b6b440631669aa98594f6da539d16023433e6503a3721ada8ccf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317400, "uuid": "245bb3ec-98a6-4eea-bb89-c98c55f6525b", "value": "03D4233013794AE0680BB4D6D5CE575AEC956EC79C1CF6B5C6E6218FBABC0B28D00277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317400, "uuid": "283c0367-7858-44ae-87e0-393a632a1a69", "value": "12288:CeROW1u941U/RUV1US5c2qYSvy22ql/40yA6gtZTa1uCuuEHxIiOMX31p7/t:CeR7iFS5c+TE6gttwCPOMX3HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317400, "uuid": "5bd1e94e-d36c-4193-8f00-861c561fdc36", "value": 646248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317400, "uuid": "07bc4eab-df27-4c25-95ab-27fc1a40c03d", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317400, "uuid": "4785240d-1aec-49b7-9cfc-9c25f46478dc", "value": "BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT 709447464231.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6426166a-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618292702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292702, "uuid": "57e29b30-5fd8-4169-997e-ca7fa244b453", "comment": "Malware payload (Loki)", "value": "682ec9f08a8eb5cc82c853e7918fbd2e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292702, "uuid": "3e429921-cd3d-4c22-b1a4-1c9683215e91", "comment": "Malware payload (Loki)", "value": "b8d03f6a71e98f8676bed369dae74648dc3e9708e8f34ed7d95dc56ce202bf89", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292702, "uuid": "04f7e5c7-9f26-4973-8c85-9c9bb0bdd1d4", "comment": "Malware payload (Loki)", "value": "36d138deabf9b690a53a9b653ab8bd844dd72c6a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292702, "uuid": "698f3dc2-379c-4492-9bb9-e217f18a4481", "comment": "Malware payload (Loki)", "value": "0809a488056d9649ef6f24187a4d99688d36e7bb202d8e12c5ea10c8b7bd9afc04e32e46eb7355479773a3d1c6f612c2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292702, "uuid": "c3d8296c-6d4a-4112-9179-d1e0405cd59d", "value": "48C5332AF1CB9B45C28E2EF19C1691A437A51C017B941C63B71D3B9AB13673267C23A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292702, "uuid": "cf07bd9a-4462-4761-8313-2032cb33baa8", "value": "49152:rrkY2knaL1brlYoUd4FDtO/Qh3zGVqdb2NU3ifE4HX:fkY2kn611YoUdikYhCVqg6wEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292702, "uuid": "57a256b4-7cc7-427f-ac52-be32d6535bb8", "value": 2612224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292702, "uuid": "88b8e0dd-9d99-4545-baa9-9e222aa822a8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292702, "uuid": "16f55094-3fb3-4934-bb3a-469ff6de425e", "value": "shipping documents. CI PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8341f4f-9c56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618318210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318210, "uuid": "80acb23c-3f92-458f-8167-2ca1b407f4a5", "comment": "Malware payload (Gozi)", "value": "bd9b023171da7b5a8b1d798043a41d32", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318210, "uuid": "03a9e8dd-de73-4be4-839e-86b822429eda", "comment": "Malware payload (Gozi)", "value": "b9871f825034194cde293d56401ce6ddfba60ba57e95dd14bab2565bfce5c087", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318210, "uuid": "8d816d78-9c42-4986-8a1e-58fdd945d28c", "comment": "Malware payload (Gozi)", "value": "6944eca04eefaa55c596764469ba72038521e68a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318210, "uuid": "9112b92b-5c66-4073-84bc-8b49a7abf777", "comment": "Malware payload (Gozi)", "value": "e0cc609552cd42d084762eab0eeebd055ca727ba1ad3e9e07e8d09dc0b86b50715be06b1f4ae933e331e1906de7d2175", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318210, "uuid": "71341988-f38e-4531-933c-21a7e0383f62", "value": "6024BE113AD1C072E597063A88F4C5F9463ABDA58FB089CB77D87B4F6E712C14636B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318210, "uuid": "e31fa52f-6ea5-4180-a25b-bca294d1256d", "value": "ebc536e497c338b5abee5455de5bead2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318210, "uuid": "2b18499b-af87-4632-9fb8-bf03c57c4994", "value": "3072:9B1ji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBcF+uTqNc6o:9bdp4uPZzGonqXGXh0bluBcFGe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618318210, "uuid": "961fea9e-e2dc-4494-8e8f-03ba88a1d9bf", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618318210, "uuid": "4b88cec4-3b37-4d43-b52c-0b065b9e1ae2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318210, "uuid": "56c515c0-a944-4524-b3a5-edfe99044118", "value": "bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59724807-9c55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618317595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317595, "uuid": "de0de195-d046-4140-a40a-0a74bde5c1b4", "comment": "Malware payload (AgentTesla)", "value": "78d72ded9161b1b7c48787a6c6b063de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317595, "uuid": "946f5d72-52f5-4bdb-99a4-cbf01c1c9f0c", "comment": "Malware payload (AgentTesla)", "value": "ba6a8cfe5808ec3de39a37dae0402b57cb3d4044e58bfdaad84e5139d96e91c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317595, "uuid": "9e6076a3-3b65-4055-8453-12442af8f5c6", "comment": "Malware payload (AgentTesla)", "value": "6cda49a7938ac7b1611063af4ef30128f633c040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317595, "uuid": "5c679658-dd05-4ce5-b79a-6d4c4b90f878", "comment": "Malware payload (AgentTesla)", "value": "9b1892e9f237bf75bd05927ab1536d808c2d56647f0bc2e9f089fa1a189c5cb3d1df62db9326969c9269ba1ea4890104", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317595, "uuid": "3aea9581-8518-4819-9758-c433d15d456d", "value": "86850A5C3510B2DFC4978BF2D62C4C14A6A06C6E56FBF20ED0533D9AB67D646FA240A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317595, "uuid": "2741b9f9-648d-4105-970e-192ad3681aee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317595, "uuid": "e6b8cf24-5173-46d6-af89-e6315ef010dd", "value": "24576:IOPBUMhQDqvE462VtfkcZRvfpkXcwtSdPldmgtr:IOPBU2QDqM462VhvZRvfpqKdmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317595, "uuid": "40b9593f-fbe0-4843-a4ca-b8d81e9d3564", "value": 1724928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317595, "uuid": "b168e32d-8dc5-44a0-9f2c-d7d3b8f68b1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317595, "uuid": "e0d4a73e-05a2-4159-b2b0-1bdeb5677e00", "value": "Due Invoices APR 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4462b0cd-9c5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618320995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320995, "uuid": "394107b6-a12d-464f-97ab-e194952548da", "comment": "Malware payload", "value": "0c51ba22838215457793c2f20bd771f1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320995, "uuid": "fa729ca7-c76a-4f72-b02b-878837f37aa8", "comment": "Malware payload", "value": "ba7f3d7d509dfa67da53912fec3e29499eafea76a9143dc979178c154e73f7b0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320995, "uuid": "d42fb760-49d8-4209-b15f-c9d0941a7ddd", "comment": "Malware payload", "value": "30330074ff41e39a9de8fb95b926c62344db3d6c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618320995, "uuid": "4fa85942-141e-4715-8009-5531956f983f", "comment": "Malware payload", "value": "6f706d617b80658c1ef3cb0b68842f77dbd62cad64e27ebf9aaf3372e41190b4e1b49b366d9ddd3a242567961618b4b8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320995, "uuid": "c7e45164-e9fd-41e7-99c8-e380621d6cf9", "value": "80C53397ABA08F92C27F4CB8088ED5AC5329DE04290A8DE6765837797472774F7C13D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320995, "uuid": "2d62540c-2a13-4d90-bf54-7736a5456709", "value": "49152:HystX4ZMPa4cjJ7bnE+jPZvTVll5JwZOsSs+05oqeSrUMtSu:Hyst3Pa4SJ74iPpBo3JR5ohSrUc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618320995, "uuid": "af37b91d-f40a-42bc-9af7-43b1714b3c8b", "value": 2568192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618320995, "uuid": "8c84af87-447b-414a-afa2-921486a4dd1b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618320995, "uuid": "431a12fb-97c2-423c-9541-45223c844c97", "value": "DHL Shipment Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9a0f97-9c94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618344930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344930, "uuid": "80ae1a02-9f9a-47b2-b57b-60ebe065f0e0", "comment": "Malware payload (AgentTesla)", "value": "b9c0cb41a5f2529d3691976fcea79dd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344930, "uuid": "03fb54cc-c5e2-420c-916a-b9bc06aceae5", "comment": "Malware payload (AgentTesla)", "value": "bef73939d8d5403278f79dfd485d78d78a7ffd71e3171a1b0e6a1a492173ff47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344930, "uuid": "474f92e6-b033-4541-bb81-412057ec5318", "comment": "Malware payload (AgentTesla)", "value": "f041f1aa3bcae19757f1bf053a01e9a02330e835", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618344930, "uuid": "2c499c7d-65c8-496a-8382-485d9a00d7e0", "comment": "Malware payload (AgentTesla)", "value": "547a7d3f49bf3fe1a4996dc0f4bf4ca21caa457d9778751e2f7bc4728b77e2d14af4884ab9b093a25dfd450a7f70ab7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344930, "uuid": "663a784e-ec31-49e5-b680-e51fa34b8193", "value": "BF05126D3559CE2FD83D81F281A17580133A82462A61EF5D1C81B7ED09FAFD129E93E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344930, "uuid": "395d3650-d8ac-4915-99bf-d7cceaf0275d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344930, "uuid": "d65d5c3e-f36c-41a5-8fbe-808f171a121f", "value": "12288:ga8Cym56JxK2iNZFhH3yT7wCsu/9aGggZy9Q5SP3FSB64WFku8j8mX5cx+Ki7nyO:021XFhX0mkV50F14WtjmZWseagw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618344930, "uuid": "fe323007-0feb-4ae5-b03d-ac08b8f8a37e", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618344930, "uuid": "826c91b3-42e5-417c-881f-4e57e9f0ecf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618344930, "uuid": "884698de-74a8-44eb-a43b-e5db61321279", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8712d22-9ca6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618352570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352570, "uuid": "75f86b22-3ab8-414a-9f8a-1c8732783e45", "comment": "Malware payload", "value": "f42b479cf497c9d460cc3e262917f0b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352570, "uuid": "cf4b00ac-098e-4e41-95f7-993f0fa721d2", "comment": "Malware payload", "value": "bfb3507b104400e8dd2b12e476adbfe4cbbf6191dfd36e672f2b5ead4756bfd1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352570, "uuid": "5209287e-af65-4a99-9431-8bc2fb9b7741", "comment": "Malware payload", "value": "cd3f604da08362696f473148543f8c6907c7e1b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352570, "uuid": "0d09d0cd-d70e-4f81-aa90-00a30374a86e", "comment": "Malware payload", "value": "efacdf8e912a45603a624f2f4b05270cfb3ec4c3dad455dfb8ad045aefecc8359968173f1a776e2a1f604581b8c5481d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352570, "uuid": "d0823bbb-2f06-43a7-954a-9ddf10269e20", "value": "1465330A645AA0A7E35F4F3AB76076E1A2EBBE05DEE4D84E9350BC1C1ADCF44D16C710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352570, "uuid": "fc1d6b42-5928-4b56-b02c-065a3f35ab76", "value": "c33643f78abe5f97df673a03ea61f3da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352570, "uuid": "5e72ed7e-b1ee-4c02-bae0-473fdf55be67", "value": "24576:jSTpLwci9v5xJtfHBVlmtDr7GdoqsOvsxBu0HNFrQkXucB9XVaVM3qgZrAqvkH0g:jS1sdBVlUDf8vj0LXXucB9XVaVM6g93q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618352570, "uuid": "097c29cb-c68a-4abb-9ca8-a8b7b71705f2", "value": 1478187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618352570, "uuid": "692a35f1-fa3e-4172-8e5e-31fdfbdb324d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352570, "uuid": "cae3a334-5e20-46d0-9903-69dfa3036e85", "value": "sevenzip-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d430601-9c30-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618301575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301575, "uuid": "514199ff-e474-4e52-9137-e4d97ca0301f", "comment": "Malware payload", "value": "e0ff265c6f6ce8fbb4fcb0d80d0a5ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301575, "uuid": "f4288e59-970f-4ae6-803a-a6c8df2d1235", "comment": "Malware payload", "value": "c0214ad4dc284bdfa2f5fb4f64412dc047542f1e24625001a490538f63c91a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301575, "uuid": "93262704-7ed4-4d98-9665-45fb9aab6c3a", "comment": "Malware payload", "value": "799760bf391fd1f8a7ad81e2d3cfe58decd3d487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301575, "uuid": "7af30052-14b5-4f5e-a737-1ba55b66c085", "comment": "Malware payload", "value": "c4fe469fbf293a9039ae790a7c0e6d3b2b0b9fa0ee340a0507d45db21a0560c820b82a7ea815f7f5f8f3023a9bdce022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301575, "uuid": "127f3d4f-c037-46f3-9c28-fc23eebd2b77", "value": "4D040DC3C3A32C86DAA3237498D97374BE626ED6946F0A0E252DF1C91532542B794F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301575, "uuid": "31cdc43b-0417-471c-a2aa-d22b133fdf62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301575, "uuid": "6b893315-c082-4cb3-b4a6-2d4b1358edd7", "value": "768:XVBGVm8+FuB4OXsSj3YrnAj6oCMQFSi67wzgxDo7XAR70K8EIIIIIIIIIIIIIIIq:XOQLFjdSj3N6oBQFSiH8YbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301575, "uuid": "9cf0f651-37aa-4c3b-8446-a3c6edfa0dfa", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301575, "uuid": "ef0bf211-d1de-4470-968a-ce4e13f89fa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301575, "uuid": "95c0b1b4-1d09-487e-95a4-244f57a86118", "value": "e0ff265c6f6ce8fbb4fcb0d80d0a5ce9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b7b13d-9c47-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618311493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311493, "uuid": "7432ac8a-9baa-4d0b-8ce5-a02ea84bea33", "comment": "Malware payload (SnakeKeylogger)", "value": "8c850b452586fcaf821549d5ebc0ddb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311493, "uuid": "f6c00400-3203-46a9-9e2a-92ef022f18dc", "comment": "Malware payload (SnakeKeylogger)", "value": "c19e7797614e7fc0f2847adb4d23b6b1c5b854c635897ea4153ed4f63ada9f81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311493, "uuid": "8f88d24d-1b3a-472f-bb57-5bc04fae8ce0", "comment": "Malware payload (SnakeKeylogger)", "value": "6a106794561fe8d6d173b503a601a4ea726fa6d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311493, "uuid": "2d2ccb4c-d8d0-42d5-9594-01cf221cabd4", "comment": "Malware payload (SnakeKeylogger)", "value": "22088a3f7d9d7004e38ccfaf3ad64a4864234c95e90cb55697d33b52b3aca2b0667c1019cf95ce024ef5f381baf0bb7d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311493, "uuid": "c4848aed-dd1b-4db2-9806-6d815227119c", "value": "B8D43393DCF23326B7B95C6F21E81AB49BC0F4941D50E27C2786A90A3BD58D56412F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311493, "uuid": "c48b29ce-e88b-4a4b-b942-ecd4ebedace9", "value": "12288:BVjxKu8gbx314KMuh3TrLYLk0V6pyiAKeOk3RbzE4:B7L84rL0khpyiAfbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311493, "uuid": "3465cd81-2e46-4153-95da-3f6257e929ed", "value": 656153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311493, "uuid": "94ca7940-f17d-4067-8f16-0f418d8a664c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311493, "uuid": "9bbfac3c-6be1-44c3-84fb-c9af221698dd", "value": "PO#HD512-6 5700)12.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ecbbd8-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618292869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292869, "uuid": "604baf51-c2a3-4301-ae6e-c15b1923185b", "comment": "Malware payload (GuLoader)", "value": "f50bc676c142d6f660ad63d8748192ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292869, "uuid": "1a0fb912-6bc7-44d2-969e-ddc6c28ffbad", "comment": "Malware payload (GuLoader)", "value": "c2c1253d4a7c1f69561044a12333f93b9a5219b9ee4555491085d978814ae0de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292869, "uuid": "db0ec034-3b06-41ec-bbfa-74f6b10a4169", "comment": "Malware payload (GuLoader)", "value": "b505d889461afa0d7b2904f9f934d62bc2c51b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292869, "uuid": "bfc6f34f-cfe3-4494-9a9b-c1bca69a005f", "comment": "Malware payload (GuLoader)", "value": "c9100d196cde24910aa07a42f32489bb96e752abf6b2a6909711ac124c952519b135fb20a6ad4b876dfaad9a84968961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292869, "uuid": "aa998513-9f1b-41ab-af47-0480cda3c0c5", "value": "E2E30AA0FB73A523D091C2B5560B51688295FE329ED421A3EEC1BF2E39301D1D462F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292869, "uuid": "057cd820-1273-4100-8b3b-f354b5824948", "value": "879f5bbda1e2f48716a0325e5b7fa215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292869, "uuid": "655a2960-6fd8-4086-aab5-e77996cf81f6", "value": "1536:1v0qlccS5y2h2vL2M/FPVm9vR4kIXvBAUwLN6IxOEcacLSPVm9vDd2Mf2v:Sqyjy2x8VmvI/BAUC6rEcacLOVmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292869, "uuid": "0fc311b4-d067-43c8-9723-134e965ae29d", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292869, "uuid": "58b0c65d-49c4-4e0a-bfa9-877e60ca96cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292869, "uuid": "dd798133-d62b-472d-bf1e-17aff02de6d6", "value": "Tykhuder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1135cddb-9c2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618301153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301153, "uuid": "22cd0c86-2633-42a6-a5b0-f742a99dc00d", "comment": "Malware payload (RaccoonStealer)", "value": "51f9ec34c7094e6baaf3ee4a0d1bf9f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301153, "uuid": "aa17afa6-0164-45f2-b2e0-437746efe2e7", "comment": "Malware payload (RaccoonStealer)", "value": "c30de5a8c243dcee3ad3f971985ac2608c6678dd0e0869296f64243c5178f85e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301153, "uuid": "130138bc-bff3-4270-adc8-eb4fa96937a0", "comment": "Malware payload (RaccoonStealer)", "value": "b94cf497d51f6bcd3b26640514a9ecea2e72ad5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301153, "uuid": "fca7a370-6c79-4184-8c49-ef04b4ad38af", "comment": "Malware payload (RaccoonStealer)", "value": "f61ffadfae6450ab5715df9fcf2fd9279ca8b8b72d343eb4c637c68919bdcc9c77a932a9174bbc75ecc68c00ab920000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301153, "uuid": "3f4d6fc7-af6f-4ea2-8571-87e272517544", "value": "F4B4F11032E0C137E06320B289A5C7F55A6BBCB1A76659CF7BC91B7E4F356E1962130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301153, "uuid": "9587c38a-30df-4a3a-b0d2-592c79298c92", "value": "8dce77acb977cc1bedeb9bca8c54be00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301153, "uuid": "4c01eca0-a79d-47b8-b6d4-a5f8d9e85874", "value": "12288:QOGnXjSFtAGxl5mss9LsHCVZmxdmjNA1XkK:uuvussCUZWmjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301153, "uuid": "a12bb541-f4da-4c85-bcc8-ec17bec21c1a", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301153, "uuid": "0599317e-f057-4955-ab85-7a0c92b2bef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301153, "uuid": "4db39ed3-6068-4e12-8ebf-1ef5912e8af0", "value": "51f9ec34c7094e6baaf3ee4a0d1bf9f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a869e8-9c26-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618297313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297313, "uuid": "44f5c566-e754-42f9-837c-f56906ab8056", "comment": "Malware payload (RemcosRAT)", "value": "042596a85ae67d962ce6ca8036e076f9", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297313, "uuid": "5846741e-bf46-4f55-a195-92a95ea8e2bc", "comment": "Malware payload (RemcosRAT)", "value": "c351dac370d0364b1ef303338408a568d877eef020539818f09214adb338bf5c", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297313, "uuid": "186b0db2-e53a-45f1-9750-b06a0c0423b9", "comment": "Malware payload (RemcosRAT)", "value": "ae126206ce1e515c9a5cc70bbd79ab7924ee416e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618297313, "uuid": "78b578bb-4c5c-48dd-adf2-eb6cb2c717f4", "comment": "Malware payload (RemcosRAT)", "value": "0ef302d2f410f6743ee8e8c8f7694f0b94436a97acb67cc7f5d10289ae4cbe50cde92bb6eba8fdeb3a58310e25668d1b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618297313, "uuid": "7cc01790-8350-4ca2-befb-7931baa9d68c", "value": "3A155B22B651C4B6C02E1978890746F859AABD30FC344C4A76F8BD583FBFA503D1DB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618297313, "uuid": "5abd7213-f9e8-441e-b2d0-93ec43e6d82f", "value": "12288:SQOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9iAKRmp:XrjqQRVeSOywSSx91vi5XDf6AYK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618297313, "uuid": "4f042577-a75f-419c-a679-4cb22f11db70", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618297313, "uuid": "dac57f78-c0cf-4003-a97b-fc42d9ef2fb0", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618297313, "uuid": "ba587f5b-67da-4cc2-92b4-112f18ab6ea3", "value": "Dringende Bestellung Zitat SDX88467638,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b790484e-9cac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618355119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355119, "uuid": "31e0bb03-39fe-4d25-a230-94725803a6e5", "comment": "Malware payload (AgentTesla)", "value": "0fee40db6b3f27865316a06549dd96b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355119, "uuid": "1beebb06-1b1e-474d-9336-f24316b602f6", "comment": "Malware payload (AgentTesla)", "value": "c3ccb5a810da4cb19a71c1fa9edf8096263cc55c00341287b8c8203b8da1e939", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355119, "uuid": "d5b18ada-b6ce-4c17-b178-128aaca387fb", "comment": "Malware payload (AgentTesla)", "value": "217d155f1a0358e7a5ea87b21cf7e510f988d7c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618355119, "uuid": "6fa22a4b-2910-44d4-8908-102d380aadac", "comment": "Malware payload (AgentTesla)", "value": "5f334b9c9bb20d1db1f0cbf120df1e12bdbcad34e44a2b99aea5e73307df3eeeec78575b7f9c391dd0352019bb5755bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355119, "uuid": "33564bce-29f6-44a7-944e-4d9d3ae585de", "value": "0ED4E0E1261AD72CD868EBB9044041B133F37C0166D9DAC57ED03E5F786B642C6DF2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355119, "uuid": "ec8c641a-671d-4287-8c69-43da154ebdbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355119, "uuid": "5bdc8490-aedd-433a-8d45-9f37b086875b", "value": "12288:JEpn+KBEIvGFBswN1k+uR5+tHq8ds1UoekRSxNNXvULEaPg:Wx1BOBV0P+t5ZocdXcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618355119, "uuid": "5023ad71-f832-404f-bba8-740ce6728636", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618355119, "uuid": "51c34949-d9b5-49ec-872f-075e55f12df8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618355119, "uuid": "ce73c449-ac5d-4339-b4a0-88112a6c8b26", "value": "BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT 709447464231.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd68117-9c0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618287323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618287323, "uuid": "a3ccc864-5ec8-4405-9176-4b32a785e67b", "comment": "Malware payload (Loki)", "value": "b0c35ca871941afd40128ba9bbd924b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618287323, "uuid": "b67d9e8a-ac99-420e-920e-914a1d329bf4", "comment": "Malware payload (Loki)", "value": "c4039980d8050f9deeba61533e38ffff74571e48f7304940825852c2cf8f0932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618287323, "uuid": "655bbb3b-5129-4e34-ac6f-838b65107597", "comment": "Malware payload (Loki)", "value": "fc3af42bf116c25bb66327720ab2fdb60c87d98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618287323, "uuid": "c86e5c5b-3aa9-4aaf-83cb-f3248820be5a", "comment": "Malware payload (Loki)", "value": "bf366f41169b1cb0c0dc78cc5494181619cfb67c03b3df35540298479dd1081b69e8af0eed22a30748ac95c73d499879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618287323, "uuid": "ecb70a33-e408-4162-94bf-4f085a22144d", "value": "CE255CA2A2B0FC36D132167F8D5B72775D2E7D426928F90A7AF4B84C4E395403F25293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618287323, "uuid": "4a377db6-e15c-4f1a-8ce7-572db4f663ad", "value": "b5e2f1cd1b2c806b5c16bbe16172ec3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618287323, "uuid": "22096b43-36f7-4ed5-80f4-519d37ef1070", "value": "12288:NAs8PmmVUXLBugvnML2Td2Jbk1TTwz3/HzRRVxIhAiUa9PVKXc5BFJIS:2PsBuD+cWw/9iqiFpEXWFJIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618287323, "uuid": "238f141b-2a76-4363-88ba-72d2126d34f2", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618287323, "uuid": "0c714985-a86e-44ce-ac63-a6f7439bb2a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618287323, "uuid": "50c42201-c336-4d45-96a1-e5a08c1c83d7", "value": "b0c35ca871941afd40128ba9bbd924b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d755dc4-9c4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618312931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312931, "uuid": "7173c2ec-674c-4800-be05-1a28e5704405", "comment": "Malware payload (AgentTesla)", "value": "3399b659cb59d5df69128012aa69344d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312931, "uuid": "c1ad2343-21aa-422c-9939-bf0f20c2fba7", "comment": "Malware payload (AgentTesla)", "value": "c49bb23f37cf897dc5edb5f2dfeeea0621ea7ab0ff6130a9300ce9377c1b23e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312931, "uuid": "f8b5e995-c422-4707-9c3b-6099c287ccc3", "comment": "Malware payload (AgentTesla)", "value": "ad67ab055337e6039dd570b8fc91843386922f5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312931, "uuid": "c3031700-8215-4c06-bacc-de60734fa0b9", "comment": "Malware payload (AgentTesla)", "value": "58a48092ce57d6079a227c55ea889dfc0d897cb7140f4061ae822859821c4ed291ef1eefa098a9518bdc3b6880f8f28f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312931, "uuid": "f3914435-1ac4-4daf-bfce-311b82361666", "value": "C6E4238A45A2EF94708C47DE468D440D82E58F0974B2CF939A80BB55DFDFAD20F98772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312931, "uuid": "5efe1f6f-1000-47df-a6c2-e80a56c5061c", "value": "12288:vIEnPC05dKTH8TwrE11PcROrKDmCC4XvTBfvQ3zoJf4rmS2pAfsg76+zCfLN/3vd:vIEnPC0LFHlKDZvTRIMyS/8O+zCfLFvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618312931, "uuid": "2424f3c2-c700-46a3-a0f0-56dc56e583be", "value": 712246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618312931, "uuid": "1f21b9d4-92e3-4126-a655-f3535f6c3af3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312931, "uuid": "2dec65c0-c1ee-45f1-b1f1-9dc0fed3b21f", "value": "PO NGSM .rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6860081d-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618300440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300440, "uuid": "895b4fa3-f89e-4120-aea5-017eeaa8ffad", "comment": "Malware payload (Smoke Loader)", "value": "2c2cb2aa0782874d3c14cdd6f063f979", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300440, "uuid": "5dc308a6-f0de-4141-8894-4b856f07ce94", "comment": "Malware payload (Smoke Loader)", "value": "c508cefc2d6430d8be028c7224aac6641e0da4f072e503261b32b950e0ef21da", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300440, "uuid": "700a80d5-ac4e-4cf7-a349-461e315eaeba", "comment": "Malware payload (Smoke Loader)", "value": "583c43ca939f9d8a4eea53a7d71157ac3571a350", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300440, "uuid": "98f47cf0-70ae-4c7e-8565-491fc4624ccc", "comment": "Malware payload (Smoke Loader)", "value": "72a11b470a8c3998865c3aff1ad7ea8573f3972c4eff60b3873be760ac8773ac9fc0b54b82e428f8077696163b8d486a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300440, "uuid": "76e9065d-15d3-40eb-8403-706e7770513d", "value": "B3058B0273D1C036FFABA2739B6AF60156BD79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300440, "uuid": "6eee5d5a-f35a-43e6-94b6-97a04a4e1195", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300440, "uuid": "448498d6-2d98-4966-9acd-a5e08a824cc9", "value": "24576:YAHnh+eWsN3skA4RV1Hom2KXMmHa05C5:fh+ZkldoPK8Ya0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300440, "uuid": "1fb368e2-fbcc-455b-baed-8658d9dbb95e", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300440, "uuid": "4b9b3f11-bf45-432f-83a5-260505754183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300440, "uuid": "68252e14-0d42-4681-8ceb-5e048b0574e8", "value": "2c2cb2aa0782874d3c14cdd6f063f979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a5770c-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618300616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300616, "uuid": "badb878d-a465-41a0-b3b1-2f6a7e5b4d08", "comment": "Malware payload (Formbook)", "value": "6c9b4f70f1700c53179ccb0c58574b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300616, "uuid": "750a59da-e42f-4f78-a543-a5798f46d67f", "comment": "Malware payload (Formbook)", "value": "c56fa56033b598809c8eb5ce1dbb42fb152baad33c70dadaab164da3bdc7df33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300616, "uuid": "20884a3a-a927-4986-a22f-2a34346772a2", "comment": "Malware payload (Formbook)", "value": "6c0df905f89206c8644f3af8388e678c694d36b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300616, "uuid": "713c4204-257b-4181-bf4c-6c7dfba48ccf", "comment": "Malware payload (Formbook)", "value": "ad67f082d30a2728d1313fc83597d9eb37bfd54edccd695bf8b981812b7af33bf79771bf284ea08333437dc69be5bd22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300616, "uuid": "1f5a1998-f9d1-45a7-bf7f-600ffe858d97", "value": "4955152C31049AD7C5AB43F6A32C4C0096F19D4EA6FBFA4DE8833CA6B6BD741B521553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300616, "uuid": "50293c21-7217-42ad-813d-063d05bb1938", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300616, "uuid": "3c64bedd-9347-4fc0-97f6-9f519fd7fed3", "value": "12288:7sx2VNzzzdFNfddNqQcpp3jIaeMfoRSC/dlt1oxHyKhdh6a7omgSwmgS:7O2VVldHCppTIfMuPTteHJPl5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300616, "uuid": "c83392ae-bce9-460b-b56d-e2a08bf45938", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300616, "uuid": "d34f020d-efa6-4346-857a-dbd7365fdc5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300616, "uuid": "c9beffe9-0865-4af7-ab6d-7a7e96f5784c", "value": "po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14549bb-9c5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618319997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618319997, "uuid": "4ceb17b2-b5e4-49e0-b6ec-d3aa94bccd4b", "comment": "Malware payload (Quakbot)", "value": "58c2d8657b4b23755ab2572f2e85df1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618319997, "uuid": "e0c44b74-d3de-4a7f-901d-d39484ed8d4f", "comment": "Malware payload (Quakbot)", "value": "c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618319997, "uuid": "0175e37d-8f88-4359-a1e6-6753ff55ec58", "comment": "Malware payload (Quakbot)", "value": "276869c5e9d8070dc30204bd12b87125031ffc98", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618319997, "uuid": "ec02617d-0040-438d-9b45-439bea2df0b6", "comment": "Malware payload (Quakbot)", "value": "65d19a9c801ea870ee8743a3c2a4ce6312c36698a8f3c03a3e102216154f58bab96f3f4be0cd3c2ecdf65f337e45bb31", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618319997, "uuid": "7fe80872-3cb7-422c-bc7b-59fe74bd14bf", "value": "0B657C31B1D2C437D4732A7C9D7AA29D942A7D111E28985B7AE40F4CDF3A6803E2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618319997, "uuid": "5f5c6fd7-8bb2-457a-9e15-f495b724e0e6", "value": "413398ffac649594b2b53c025e6614ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618319997, "uuid": "c87fb536-04d5-4d20-b689-c5ace54e750b", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGCw5:sbeeGRuPPu/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618319997, "uuid": "628a0da7-461e-4ab7-82e1-dc5f973c285c", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618319997, "uuid": "ed6b2090-adfa-4a73-a2b2-70f4916e0b02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618319997, "uuid": "8bd84be3-e6c3-4a25-a9fc-f5d00545746b", "value": "44285,5327891204.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a76236e-9c24-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618296417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296417, "uuid": "05e722f5-21a6-493a-9805-f7459ac1251e", "comment": "Malware payload (AgentTesla)", "value": "c40074930370713d364260ce88553e6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296417, "uuid": "45d53992-c588-4fc9-9686-e576cc53b5ee", "comment": "Malware payload (AgentTesla)", "value": "c696af920c0adaa08f104d0958151cb239c62e3f95b2590cf5ad824049c7e8be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296417, "uuid": "4cca54de-c32d-47d4-a831-78f6ee9cab10", "comment": "Malware payload (AgentTesla)", "value": "ffa71854eb4f1fbb55db11704e54f477d57b722b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296417, "uuid": "b4607744-c9a4-468b-90e5-daabe48b949c", "comment": "Malware payload (AgentTesla)", "value": "76a474f09495920ccddf17925c0497ff5594d8ec827243aaa72036a275ab4b13fc84357b0372dd69976fc4949e4141ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296417, "uuid": "124cae4b-af0f-4b03-915d-4b92320284b2", "value": "2D22AEF221D36F9CDCA14C063D5A19EAB464B3958F0671ADBE260C7804745963F70FB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296417, "uuid": "8da0ff67-559e-4465-b0d9-ba28b42565d1", "value": "192:nfD9YPxHeSbA3khak0uHQ86HZTE2+MnA5AFaa2DOQtsWjz:nZ0wSoPd8uXTnsA6OQttz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296417, "uuid": "8e6374d7-7eec-49ae-9526-3a22c4c1f0b8", "value": 10300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296417, "uuid": "3522af59-b2c4-4a95-8f41-0228c6b12021", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296417, "uuid": "b5607f66-3570-48d9-be2e-587904cb6a1f", "value": "REEVISED DOCUMENTORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d423a0-9c6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618326585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326585, "uuid": "efa86eba-0f7f-4ad8-9ce8-267d8dea4068", "comment": "Malware payload", "value": "08d47d3b5832d3446f4feab417d9e13a", "object_relation": "md5", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326585, "uuid": "9a3e85f0-33d2-4416-9bae-92e94b7cfc29", "comment": "Malware payload", "value": "c6d7ef9411539a18c9975d76c100ff2234f1a170086a0b2a5f5fcb5c9265232c", "object_relation": "sha256", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326585, "uuid": "e83e7731-076f-4563-ac87-be944748210f", "comment": "Malware payload", "value": "ade37c49e062f19e450d40b98d46d2c01c61d633", "object_relation": "sha1", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326585, "uuid": "eeb44c13-42b4-403c-9409-b9583117c201", "comment": "Malware payload", "value": "e044abd75e5e89f30b5da388e147c6e6aaf701d8787b43b87acea71bad53e4bc3591e25ecdb3871ec85e0b550abfe6ad", "object_relation": "sha3-384", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618326585, "uuid": "f14965bc-d863-4aad-b318-3c5feab3bc93", "value": "3B93F299D7974819DB72D036FA6689E26A0B35032252B00E308191D52EDB5FB0FE5EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618326585, "uuid": "d1b3fe27-8e00-42a0-ae46-489b02a3b3cd", "value": "1536:ltf9gwtr3JfMCMHeh5AS+9SvyCbXwOHGE8feeTE0hJMcPmaDpdSu19ihY:lJF7Jk3rUvyCjws58Gf6JMcuaNB19oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618326585, "uuid": "fe099fec-ce97-4619-8b1a-252d74c390f5", "value": 96834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618326585, "uuid": "d3a68dc3-5567-473c-9ae2-a3b905f04e4d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618326585, "uuid": "a0eeef2f-5ca9-470d-b75c-1546d4364dd1", "value": "documents-697794031.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d50f3f2-9c4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618312769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312769, "uuid": "14fc40db-c45f-43cd-9a12-3996b5b4aded", "comment": "Malware payload (Formbook)", "value": "bc4562ba312b98d67df7c8eca97dd774", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312769, "uuid": "bf45c121-fc37-4ddf-a3c5-60133c249e6b", "comment": "Malware payload (Formbook)", "value": "c7ba3f5d85d8511734193907158175e97797ac405ec0769b3a3eab2ca04902d8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312769, "uuid": "0b88b94d-b00a-40fa-801f-be3c81a70969", "comment": "Malware payload (Formbook)", "value": "7fa0af9596342861cd629b17bb6089dea5b0f836", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618312769, "uuid": "84554ee0-c8ef-4dec-a122-ff389f4a963f", "comment": "Malware payload (Formbook)", "value": "7cff092d401952fe7fbcee44ac8223417e09bcabd934bc751b301d3692d5eef3d5d016ab2be5817d65319dc90395ba3b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312769, "uuid": "525f144f-f2be-4c04-bd7a-5a10201eba1c", "value": "7EC423CFAA06F6A5D629ACC30047139FC0318E7D4DA24F999E0557C3DFD99AAAD43432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312769, "uuid": "8a1886f4-e21e-4379-aa4e-1711fff78326", "value": "12288:Su/JInnNvQtdjS/Jd7RT1C4rTUAJKhugzPNEKCwp+lnc:Su/6nncS/Jd1U4rTUvRCfwUZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618312769, "uuid": "e336352b-ea9c-49b7-b36d-8192643b1f0b", "value": 587502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618312769, "uuid": "caf42c60-1ecb-457a-b679-e9a84af3f2ff", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618312769, "uuid": "754a28ab-766f-4ab6-8443-e155834cbbc1", "value": "PO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687bd4f8-9c29-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618298722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298722, "uuid": "4c0464ac-25c4-4882-9004-aaf640537d1f", "comment": "Malware payload (Dridex)", "value": "db16a14a0fe47030218ac4aa80670139", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298722, "uuid": "82db86a9-f5df-4e96-b742-c34e81d878db", "comment": "Malware payload (Dridex)", "value": "c80a67e06086a3a09b926bef2f557f1e0f9fba7fb9291a030de257f1cff18882", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298722, "uuid": "8b0833c8-bbce-4f32-ab6a-5aaee8cb638e", "comment": "Malware payload (Dridex)", "value": "556bfe14c2a952366b2e488e47cf095cda47e43d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298722, "uuid": "43143e4d-ca1f-4394-a33b-aa45f670c90d", "comment": "Malware payload (Dridex)", "value": "4e5d75d40ed470cb5d9a8b5dcd3e9aab281d369b330c2e16880b78c19180b76fdffebcb970cc04d0cf52b01abb34e2ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298722, "uuid": "8e647dd5-054b-404b-bf3f-27762dd03f05", "value": "FB44231F165B69BEEEE05176C90458864D30648F2EC0A7239B19FF05EC4F2932DED9E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298722, "uuid": "1def7cc3-88da-45b7-9814-d41cb845ac96", "value": "6144:VrqzrC53c19XUurxBqQ8yAOghLvMBHNKLVWwm2FMOOHktWI6qIn95+G6:xq4c3Eurx58n/L0tXwxMOOHk4nqI9oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618298722, "uuid": "f59512c3-54e4-4e23-a620-b835f8cfb016", "value": 270052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618298722, "uuid": "0d760826-1794-45c9-9133-742ca7b5cc8f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298722, "uuid": "317b9329-593c-4b99-81ac-ca4c2291ed77", "value": "Invoice 1143.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40607b9-9bf8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618277857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277857, "uuid": "d42b00dc-0f1e-444d-b26d-1aa111e5a9f4", "comment": "Malware payload (AgentTesla)", "value": "deef625653c265eb5856bfda9cfb16ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277857, "uuid": "bee4fbbd-9555-4f9c-8509-42fbf58d4e63", "comment": "Malware payload (AgentTesla)", "value": "c8f677200350950551b48eee6dd779956747d64139134fb5f54d60e5e8eda36d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277857, "uuid": "6b611d7c-fe33-4808-a166-8d15d303e1bd", "comment": "Malware payload (AgentTesla)", "value": "667986deb4fd2e8be3379cf4e1554a8f16daaef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618277857, "uuid": "7b1a8e5d-d67b-4a91-8628-64d66f2c6963", "comment": "Malware payload (AgentTesla)", "value": "8863381462207ecb0787b592665a2c8a7ad572852a7940bf54ffa17d3d03bdd2bfa8cbe00f45f3157ea61f134af183d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277857, "uuid": "21f1a3ba-8663-48cb-9b09-259974a0dc60", "value": "BAF4235926310BF0E595A372E5CECFF35318382C4630CC7D2A1265AE6B7A9769DCB281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277857, "uuid": "311a2dea-0bf0-4b3a-8543-d3aae5adfec4", "value": "12288:sBCxRcHvRYxTRbk2gK+VUiZ2ICV7nnvrrczyY54/1dBH1S47pW:2HYxlbk2g4Frrc9549H5pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618277857, "uuid": "d9ba0ae4-5157-4309-90a2-bdbc62bca262", "value": 743829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618277857, "uuid": "178a6c82-ead1-4ec2-9b0c-afcc504fd3ab", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618277857, "uuid": "9e10eb19-95a0-4666-b6e2-bfb4db47c73e", "value": "Scan Document.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b151c2-9c5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618321107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321107, "uuid": "976d2e86-ec51-4976-bc14-da12e7d4ecf8", "comment": "Malware payload", "value": "b3a7284818d7cc4e934357174dbfc711", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321107, "uuid": "be5bc742-8da2-4c9b-bcf3-7abc1b3f8755", "comment": "Malware payload", "value": "c906dfd2288acf0564533684d0c0831b8d566d921ff24d5d988032c5f9344ca6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321107, "uuid": "64321380-f0b7-4916-92dc-2433647be0aa", "comment": "Malware payload", "value": "080c4ff05b14ccf9d4b2156a948ebb0fdd686892", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618321107, "uuid": "b879abc7-ed37-4cf8-a9c1-f82031752fbc", "comment": "Malware payload", "value": "2021773097a5dad0ceb00bc461ad3860518510d3e9f9dd947717102d347a612018e130409cb88932e0b85cdc67f1a515", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321107, "uuid": "90fe5a22-a98c-40d9-9b30-103096173b2c", "value": "0B45152C35048AD7C5AB03F6A32C4C00A6F19D4EA6FBF64DE8833CA6B6BD741B525547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321107, "uuid": "9b1e7be8-01de-4616-93c0-bf19f84d13f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321107, "uuid": "1a1d415b-a6fd-4971-9298-fefb069537cf", "value": "12288:SztZqNzzzPUZqmJ0cJyO9tQYdOrcVJHA2v1Khdh6a7omgSDmge:SZZqRzmPPTOQM2vIPl2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618321107, "uuid": "e4dd27d2-61b0-415a-8762-d2d408d3b372", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618321107, "uuid": "aa7773a1-0b28-4f76-8e5f-97d74c43ff41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618321107, "uuid": "afb60877-85b7-47e6-b0f8-97a142c2d5f9", "value": "New Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196b25ae-9c4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618314051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314051, "uuid": "b22b94d1-44b8-424c-a72b-393d813f545a", "comment": "Malware payload (AgentTesla)", "value": "39509f8b2b62ff055f52f31e12213bad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314051, "uuid": "a9f31a03-c50e-4420-98dc-4a940e800539", "comment": "Malware payload (AgentTesla)", "value": "c9a3e77e8e9ff07ccc2fdcbbb28b2c48190843c662a4341cca384a4aa171e2b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314051, "uuid": "f1d111bb-0bb2-4571-b028-b7c32fe7189e", "comment": "Malware payload (AgentTesla)", "value": "8588998d8c89c15f4149ef70146d06efcfc3980c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314051, "uuid": "31534b03-a46d-4bd1-aef5-2a813d9319ac", "comment": "Malware payload (AgentTesla)", "value": "37a29396fdde1adb37f1d63e77ff2f627156c6c88ff3e18ff431869af192710149f71333ba6fab0864ef4f08877b8879", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314051, "uuid": "6cfa48f1-ae6e-47c8-bf0a-e1fadf06a269", "value": "F7E423FD5B9F944A7D6A058E8BC466C7E2C29E740C091A328BF2B5E528D70194FC81F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314051, "uuid": "fcb4ae1d-e046-4203-aa7d-90e2e6f96d74", "value": "12288:dXXc2nW5FOvDMAmlTTbboxxyZqU82Oy/4f4zMkS/JUAn6hVRT8z99e:VXboObMAkTfboiqULB/4gzcxx6hVcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618314051, "uuid": "c211714b-aa5d-4b76-9310-79152784768b", "value": 693663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618314051, "uuid": "ec8c60e2-7a3b-4418-b13c-75f8fedaf275", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314051, "uuid": "ccf5be11-d4cd-46c5-93e6-21fe9a2346a6", "value": "factura y datos bancarios...PDF..gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e4e318-9c76-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618331789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618331789, "uuid": "67e10912-d85c-4f69-b436-2658072bf5d5", "comment": "Malware payload (AsyncRAT)", "value": "e891577b2d323d94f32ccc6bc52eadd9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618331789, "uuid": "78b4d84d-4bea-4277-963c-f6ec80b69de4", "comment": "Malware payload (AsyncRAT)", "value": "cf42db8a9fd6c9c806cd2d1dccc54228babd51121f29ff928dc095d7f337aac9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618331789, "uuid": "53c68784-91ff-4730-aa26-efdb0573d494", "comment": "Malware payload (AsyncRAT)", "value": "d5910e46a9dc40d9dff83703b396ec4415f16d47", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618331789, "uuid": "dc3bc27f-7d8f-4443-b119-6ab355931f67", "comment": "Malware payload (AsyncRAT)", "value": "60b04516ef5c7d02c1f1ff370e85eaf6ba5d217a962dce8794db656f245536679a9eefb2ad0f056a9496420c400e2696", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618331789, "uuid": "7679adf8-4c63-4be0-9411-efb00092b0fe", "value": "82F533723628C394D418F472D102E0FB12389EBAED29651B71F5BE9B733B1D4648BC66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618331789, "uuid": "78f7116b-daf0-4bca-aabd-f74f60a87abd", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618331789, "uuid": "fe5d4e42-16fd-4640-a2d5-69742d56bc51", "value": "49152:yVbgW+uTTZfEX3H36GodbHYBbZalIrzwkvl+fsJI+SJNrBmVEXkUGHlWA3HylLvi:4JcHqFbHS/zRt+f+INrBmV0GHRHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618331789, "uuid": "8dd2367e-6d62-43aa-92c7-fa7c44836ccb", "value": 3486720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618331789, "uuid": "74f42220-4dfc-4ebc-87f2-f61303dec57b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618331789, "uuid": "ce03849b-97cc-4952-b68b-1ecf9f650a17", "value": "data.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d48d96-9c29-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618298805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298805, "uuid": "fa49493d-fffa-48cb-883e-0e28ce6d2a7b", "comment": "Malware payload", "value": "6e4312dcc3d7df234c23b2390fd4b648", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298805, "uuid": "3e559d97-0893-4690-9284-614bc0af5dfe", "comment": "Malware payload", "value": "d1b1d59fb600eff487f29ee1e0f2776b0bd1fa127c7a2f949b6f50f9319ac2fb", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298805, "uuid": "5005b468-a160-4ae5-877a-67e46872e5f8", "comment": "Malware payload", "value": "047ec5601eadc675c01ca773e5cbed315028a9aa", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298805, "uuid": "718d47b2-2600-4903-91aa-f8631b1bf166", "comment": "Malware payload", "value": "c0e3deba7560349c0eb5abd4be7f85e89cd1467706b69f481115688fcf373e9b5de392876889051051f9195806801684", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298805, "uuid": "5daf8a07-1517-4e0f-9fbd-aa8668587c20", "value": "E3156C11B251D8B6D02E19788C0B46F8A9A5BD30F8349C4B76F87D0C3EBE6507D6DAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298805, "uuid": "eea05819-feab-45eb-ab40-d2b78c4c0927", "value": "12288:bQOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9izKRmp:ErjqQRVeSOywSSx91vi5XDf6ALK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618298805, "uuid": "b0255377-fc0a-4fcd-a022-0271488abb85", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618298805, "uuid": "0a60e37b-1b7d-45ac-9a48-c2c7a074a2f7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298805, "uuid": "d4d6e061-ba54-4354-8c14-490e482118a8", "value": "Urgent RFQ_AP65425652_032421,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ec9782-9ca7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618352995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352995, "uuid": "ff19c230-8169-41e8-a104-11079d5df8ea", "comment": "Malware payload", "value": "ab6a98269f6e15509b622d539b7c85fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352995, "uuid": "69ecc272-eefc-4cb3-9fef-70fae33de02c", "comment": "Malware payload", "value": "d2d09b7b7bf100d1a2e878f66275aecc6cac9cf581161c107a6d25f8778b6fc2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352995, "uuid": "2d592dff-de08-401b-90eb-ba98b6f75ded", "comment": "Malware payload", "value": "ae65e7fb7b4e57968177e86a513c0d7acceaccde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618352995, "uuid": "4c27c4bc-e7e7-42f6-95b3-658e099b05b7", "comment": "Malware payload", "value": "0895ddd24d77e97379324dcd20fd3f0895b817a678c1411b1efec2ff72a7bb0f9ceada53fa5fbb2c147fc185a7179e1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352995, "uuid": "e10c9f3e-2bd8-4073-8bd8-835b60464404", "value": "FAC5232B34C385A5D325BD7A10CBE2F9E9E05FB34F29222163906B579CB6EC41D47227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352995, "uuid": "c91bed87-bc9a-4431-a649-978f5666178f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352995, "uuid": "db5e0f49-9bf7-469e-b98f-219d463af516", "value": "49152:gG0w5DfEcseDhoMKlJmuw6JYl5QFF7UjJb74wy/P5mYKo1umjtA:gw6cseDaMQ06JAGzQjl0wYPMo7pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618352995, "uuid": "c90a888a-aff9-473f-bc5b-bdae7b3757f6", "value": 2582568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618352995, "uuid": "efe2162c-7f16-44d1-aa7c-06195993c76d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618352995, "uuid": "09672145-e872-43e8-841c-98065095b584", "value": "openfile-setup_35736540.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa981727-9c23-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618296390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296390, "uuid": "9056a0db-76fc-4077-affd-3ad95d4d4b98", "comment": "Malware payload (AgentTesla)", "value": "deac7d4d553df73a607e63d1fedd4672", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296390, "uuid": "485d2431-36de-46dd-8bb1-7b126a93d6e3", "comment": "Malware payload (AgentTesla)", "value": "d2da50fc1ec949499663cf5f7f9c3803362abdc0c3aba27870997d0cb20e9c54", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296390, "uuid": "58fe0df4-03da-4f1e-b107-a99ee55b4907", "comment": "Malware payload (AgentTesla)", "value": "e92b325d6d9556f382a5fecb5d62e6401a4e1356", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296390, "uuid": "17f98c86-893e-42e1-b514-988e2403af81", "comment": "Malware payload (AgentTesla)", "value": "7fc255a7c9c876005c4f0c207a9b18ae5a408a221fc733a844b38177fb1ba04df1983c324146165c8e968fdcf11f58d5", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296390, "uuid": "61bec6e1-edcd-4559-956c-f6c3c572a4b5", "value": "8CD42324EBE4F168D0112D1F7D1A7710AFA165D4BD43AB1B3EBF531122C2EED206A52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296390, "uuid": "1be7a2d4-a8d2-4471-b01b-bb2922bc18e1", "value": "12288:qSNezGdMq2GK9d7QXCppwZMHooVWw1tsD7k8uT2vdrwFzZ:NsyMxd7Q0KgWwg/kUvN+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296390, "uuid": "ab995b0c-c502-4caa-8437-f110e233a831", "value": 644722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296390, "uuid": "be8a6da0-a0d3-45ec-966e-f12ed65b359a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296390, "uuid": "617ebfee-98c5-4bbd-9821-4364d4c811b5", "value": "Payment advice.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c310de0-9c2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618300768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300768, "uuid": "7786f7ae-4d8e-4bd1-997e-84a6236d0d9e", "comment": "Malware payload (Quakbot)", "value": "838abbe46d14ed4e23335ad4aa51a6d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300768, "uuid": "a6933863-49ed-4f8b-9fe5-9f70a9abb6d8", "comment": "Malware payload (Quakbot)", "value": "d34a8790bafa9607cdd0c2edcf4d9ca35d23335d5dab867f4b1135c074606861", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300768, "uuid": "d7e8ad7a-ecf0-4e07-9afd-d5e6e5ffcd5d", "comment": "Malware payload (Quakbot)", "value": "d80d4623c33825d98395529a28883139296f9b77", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300768, "uuid": "e54314c0-93d3-4e76-9915-6f2ce169b58d", "comment": "Malware payload (Quakbot)", "value": "2ff6f089973b9ee4cd75e84f5723ad253b2342e930dec2b0521a4321ee4feb9d2dcdd724c827b85ddf8856c837041b97", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300768, "uuid": "65d13c4f-c7e3-4749-a514-4a4a1463d299", "value": "0AC46B36F1D3C437C5337A7CCD5F5199A82ABE612D28A8577BE40C089F3A681392D2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300768, "uuid": "46da297f-c877-4955-8f60-2473be2e3713", "value": "12288:LAlF6Uoww/SY6TB0bbg3dW3JHrvVDPjjqXtBIV0Q5a:LAboz/I6budWhdq97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300768, "uuid": "5c2ee080-84a5-4306-ad88-11bfa04ee5fe", "value": 591204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300768, "uuid": "53f6f9f1-1e7d-4452-bf58-8ce951c2aba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300768, "uuid": "e09ecc73-a070-4d15-ac64-81259fbc4115", "value": "838abbe46d14ed4e23335ad4aa51a6d2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f91fb0-9c4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618314371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314371, "uuid": "5c31cbc8-02e7-4e11-bff9-518832a8dc14", "comment": "Malware payload (Formbook)", "value": "62dca72222c2be78cd3c2bcfb3b38566", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314371, "uuid": "b4bc3d14-ad7d-42ae-85b6-451728eb255c", "comment": "Malware payload (Formbook)", "value": "d4fb2d8e452906ba9a906087d7e608fb00525084946657ee8ff116a8b5de901f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314371, "uuid": "225ad216-8e98-4500-a9bb-85b4b7d0b65d", "comment": "Malware payload (Formbook)", "value": "48b613a27284b9f47d5fef9b0e7c898c54afba21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618314371, "uuid": "fa70dcbc-b1e5-494b-8da1-34c5b92bac19", "comment": "Malware payload (Formbook)", "value": "3fa18c91e7a5d3751c9824a5a1611cbc9ca496d9a8ae9e95815713039738e37cde6306c3fdc5e38ba3cac9fe9684609c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314371, "uuid": "35626b63-088c-4270-8688-a145c20abff3", "value": "A4F4231492C2E8E2615DC110AF3FC9A8DE845E2D7B71BDB0249A06540C9FF6EFD67784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314371, "uuid": "30ce1fa9-2795-41f9-adbb-26d207cf62a7", "value": "12288:+izUMXvyWO0ZmqVr8FVad6EHhg2UAyeY5zLVEod1rjDEw0eiIf6xR4PUOVP:9zucDxewo9fR2odpjDEw5i/xm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618314371, "uuid": "865a2388-2ccf-4b3b-948c-a6fb988a292c", "value": 726159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618314371, "uuid": "a43517d2-dd13-4d36-9423-357eac5ebe1c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618314371, "uuid": "59a3fa8d-9bbf-4bc6-b2d0-76a93f82c3b1", "value": "Statement Of Account (1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0b9f96-9c73-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618330511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618330511, "uuid": "5f968c0e-2832-4078-be60-2a91f0ed01c1", "comment": "Malware payload (AsyncRAT)", "value": "68b4409d8bf2f189faafd55c0540f6e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618330511, "uuid": "21e966a9-9365-4cc6-8f9e-770a572816b8", "comment": "Malware payload (AsyncRAT)", "value": "d5437f5813e7d08b6f3ff1e18c6a53c2974b452aa0c42f43981553fd9aad411d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618330511, "uuid": "5f5228fd-3823-42b8-92c5-cebe2fa22af5", "comment": "Malware payload (AsyncRAT)", "value": "6b95d8c879e25f210bc93925876d5542c177ca3e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618330511, "uuid": "e7aae57e-84e8-4038-8cf5-2dd4c31219ff", "comment": "Malware payload (AsyncRAT)", "value": "f155c28d8d02af0cb73283e61ba72e62d6313b6d2d8dcb8034ae38d50be737d8da25b9660b246d399746cd02dc7331aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618330511, "uuid": "9f3725b2-f4a7-4a86-9d12-121cd54ba0b0", "value": "DE623B98A3C486ACD9BB5B34DCB156344BF769532513C72E6DD824A2082B3318FD1B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618330511, "uuid": "eb811931-1919-4496-9784-7f197adca2ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618330511, "uuid": "acda4bbb-c415-40dc-bb1e-19907de888cc", "value": "384:/JBb+8niZJrIvr4DtUzLIwGstGGU52k8e09RoXjeUGhC:RBb+giZB8EDGSpGU52ZemRoSUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618330511, "uuid": "67f39ed4-0430-4ce4-a3be-5836a713eb39", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618330511, "uuid": "117c6c88-bc0f-49fe-926c-56012815d6fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618330511, "uuid": "17f3d4cf-a2d1-452f-972c-18ee9772438d", "value": "Check Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b2d5dd-9beb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618272323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272323, "uuid": "90a6cc50-5e9f-4b2b-a04f-1454e920d1ad", "comment": "Malware payload (Loki)", "value": "99fc954709f8771523445860cc267157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272323, "uuid": "7cebcf5e-84fb-4095-8caf-b2d2f814fb88", "comment": "Malware payload (Loki)", "value": "d5b84485647b5207f7f5dab1568f1b7ede5be09b16cfab955b57784f4b8e06d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272323, "uuid": "483d06d9-798f-4a25-bffa-142d8dd5f950", "comment": "Malware payload (Loki)", "value": "0dd551aeaaf55f0a5446b3bc1e46d491c022bea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618272323, "uuid": "10fa0367-a845-45d9-996c-844c17a7bd0e", "comment": "Malware payload (Loki)", "value": "d38c2f2dd858f7a284ba74bd8b7a6a3d6a2af301d49d8d4e3addda4fd96cc86fed976403327aaa5cb7b6f6b689392b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272323, "uuid": "fe2a8140-f9be-4692-b3a4-dc4a32f4da8e", "value": "13B4D0793698CF25E5BFD3782131120557F1F10AD722EB4DBEE450DA1EA2B819B22393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272323, "uuid": "bf99d17a-4058-42dd-8769-4b626065690f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272323, "uuid": "6be795c6-cd9a-400d-a10b-21215e9ee6be", "value": "12288:5+dXg8To3MZKlA/FcciZ1LIOFMZc1sQlFTXRDxXFzEXTcpK:GccO1NbzNHEXT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618272323, "uuid": "ec0a6a44-49f1-43db-b075-1a27695713c1", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618272323, "uuid": "dbbf4e57-d7c6-47f7-9d11-457502004e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618272323, "uuid": "d0966101-0101-4659-b6a8-abf3dc846769", "value": "99fc954709f8771523445860cc267157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f32f17-9c47-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618311814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311814, "uuid": "4135c500-7962-4ee5-b17d-e4dd616fd7cb", "comment": "Malware payload (NanoCore)", "value": "b23dae1ad2d2409f84a7e51c897e167b", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311814, "uuid": "0c85693f-74e2-4445-8bfd-9c5fb52f3331", "comment": "Malware payload (NanoCore)", "value": "d81c94b9e843b9484e0e6ef5449a6ae33cf268d1168a98d41e2211f9e6358f9e", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311814, "uuid": "ba680bfa-54c7-4f62-9840-96cca64c781e", "comment": "Malware payload (NanoCore)", "value": "4d1bbbc8ea2189d2897971a4a99ec6d0789d512d", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618311814, "uuid": "93c82380-0800-46df-8cd0-e5faec0d4e3b", "comment": "Malware payload (NanoCore)", "value": "73bed6aeacdb70628203ef77e0263ed42b4b87dc2fb85f8eaf0b69930f4c842ce02f64cec262d92af87e4b866c5803f4", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311814, "uuid": "de56e3da-be31-4f63-8259-5da21e7aff4d", "value": "E9C4E0792698CF24E17FE3791131121143F2F14AD722E35CBEE411DA5EA2A864B277E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311814, "uuid": "c8347c2a-a26d-4086-90c7-2c43fb67f888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311814, "uuid": "454af514-11ce-44e3-bd56-67f33e0cd735", "value": "12288:HJok2g8To3eZrA/WkLcQiB2TQKCgKTFTE8MTtq3yOoEIt5RD6AKK1K:HIxE7dKTtbMTVtvHKKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618311814, "uuid": "f500decd-f6f8-4c35-88bb-2d1ff08d4023", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618311814, "uuid": "002cd08c-e945-414f-8770-abe5a3ac8763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618311814, "uuid": "aaecab28-7a41-4d80-8011-eb9c9a60a20e", "value": "New_Quotation_Request.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe71f6b-9c51-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618316149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316149, "uuid": "dc3fc949-0bbe-47a7-b052-19c4db16845b", "comment": "Malware payload", "value": "646779120efc366e99baa0192686792c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316149, "uuid": "5cc200fc-fa2b-4191-89b1-fac435cb6193", "comment": "Malware payload", "value": "dc3c1973fe3b70968950859dfeb566fd92b3a7eb50dcd3517fcb193202c3022b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316149, "uuid": "2070664c-16ce-4ce4-9def-cbde2568de78", "comment": "Malware payload", "value": "e21d0d024da6b35e54eac701c90b842e7eee03fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618316149, "uuid": "19de7246-0c6a-4dd8-b671-c22bb5ad57b3", "comment": "Malware payload", "value": "e03a345066bca05b1abb1a3f142b32ecb3fc325c8287daf03a51d497c5d4f04dd5f905354675c30784d74b9ab09394b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316149, "uuid": "7f11fc9d-7c70-4f7a-8725-9fee208aa902", "value": "29D4DFE52B06D72CD978A779084542F133F3BD0166C9DAC57AD03D5F682B602C2EF2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316149, "uuid": "52abcff2-22d8-4140-a3bf-31a0e0f03847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316149, "uuid": "629afb3c-1453-48dc-8020-6589c1f75181", "value": "12288:JPEpoavD/WbWpVfv5pywi4ONqn+BmBJEb1yHqW4UXK:GOoWCpVfv5cwiLstJEx8qW4Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618316149, "uuid": "516620c6-6786-4dbf-aa70-dce235a068e6", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618316149, "uuid": "ec3fecf2-ea1b-4274-a8cd-ea908c460c93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618316149, "uuid": "7ad03d9a-4eb2-4649-9359-57bac77bf46a", "value": "ohms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759c9e00-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618292731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292731, "uuid": "74c30468-51ee-4fd7-8a33-871108534fea", "comment": "Malware payload (Loki)", "value": "66cd456ec5d2b4fb683bef3f0bdc244b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292731, "uuid": "9970b658-fece-42a3-bafb-333d3d9db2b9", "comment": "Malware payload (Loki)", "value": "dc72ab50d5511e8ef0723cc3beb6faf4ddf30d8c1fbd21b7f4d7808b827e37d5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292731, "uuid": "d0666430-9b27-4fca-b6e8-192fa607e44e", "comment": "Malware payload (Loki)", "value": "3839f0f7a1aba6904c371c40933a5e410216e51d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292731, "uuid": "bd7cfe56-fbdc-4209-acbf-4d452257a94a", "comment": "Malware payload (Loki)", "value": "006d95dda443ec4b40dbd6a4caa6252ec239dd4d27afe9a893ff87809227204d4763e639a68d3e967a583098238b371c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292731, "uuid": "8a90e07a-da4b-41b2-b595-f76def0c8ca7", "value": "CAB523666CCADB26FDD523B4C46DCB45CD50EDA8623CCC235F16394AA07F9242BD8E48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292731, "uuid": "13c188f8-0ed0-43d1-962d-625003beda62", "value": "49152:TjSz0MQHbwiWr/dpPNSyaEflXAgOgOvR4dGy89BNQwBUpbttvJvkNcjekMS:SzQjWr/fP8ya19gOvR4gy8pYJUpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292731, "uuid": "b88c02e8-648b-460a-9c20-171dfa11a374", "value": 2491904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292731, "uuid": "1fed6b52-6c5e-4864-96a6-d52ec1c00da1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292731, "uuid": "1122bf98-36be-4295-9937-59cdd3c0ccde", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f693b91e-9c54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618317429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "95bd5018-edad-43a3-9f4d-7ac12a4d07d3", "comment": "Malware payload", "value": "215967ae8e734a9bfb8388f5e344c089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "4472e63b-e406-48c3-aeca-9535dd1af82b", "comment": "Malware payload", "value": "dd7d3cad1f509caedc2ea7a255a74cdc75498eeca31b67a5fa581ca67ba8b761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "2cc7cae8-f6f8-4981-9550-4eef81c67c48", "comment": "Malware payload", "value": "d1d8409ad9293bf3ea01f608d834ff8bd4a02b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317429, "uuid": "2f554e90-a095-49e5-b976-b330fffcf0e0", "comment": "Malware payload", "value": "34c69f9427618daebf199ad627cd11a963ba20900faf196a6aa62a487a3ac2ba6513f2e8b1fc57290f030095c30ef23b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "f29e89d4-0f68-479a-b0ee-226116a0a255", "value": "96C4CFE42A06D32CD978A779145141F233E37C0155E9DAC57ED03E6F386B642C2EF2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "7f1d9253-167b-49e3-91e1-9cf73536e0db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "5859bac4-833a-41b9-948f-a036dbefd86b", "value": "12288:aOrpHYReQ6MXTWU0fWYsyikP5wnZeDelGfTK:hr9YRe3MXTrHkiZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317429, "uuid": "4c1cdcd5-f29e-4b3f-8658-46ccd7a2250d", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317429, "uuid": "e7862ae6-d7c2-4ba8-9b40-f8f203a7eaf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317429, "uuid": "f2ba2bf4-6bce-4b47-b59a-df875edc7950", "value": "l7TWxkOB9UYFqsH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09719bc2-9c56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618317890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317890, "uuid": "116f6615-e44d-49f5-80f3-7b6ba3cc5d9c", "comment": "Malware payload", "value": "f00ffaeabd21162b932ee541d469adff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317890, "uuid": "d4176a34-b581-4099-852c-828d7bd6d5af", "comment": "Malware payload", "value": "de607fb8b4dc61028b5bb86238d052922f2758a42bcaf9b4a3e27ffe3bee6142", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317890, "uuid": "2b0e146d-bb91-4bea-86a3-2ebb415fa6c4", "comment": "Malware payload", "value": "5573f5dde326c18ab397637b4e2d950ff9c33536", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618317890, "uuid": "c473a983-8d87-4384-94e1-232ec17aefcf", "comment": "Malware payload", "value": "c652848325556c0a626005f448593e4173722a94c4b2b7291086eb7ea2af29951d570947ceb5f9a47a7d310e2fd205ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317890, "uuid": "8d09dd1b-e3d9-437f-9b82-378ca83c1e5f", "value": "3752F956A3D49B3AF67902FA7CB1A9602334F5896803CB5E599421482E3338957F2F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317890, "uuid": "9c65535a-5af4-47ca-a390-27284742fbdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317890, "uuid": "523bf0d7-2392-4087-8448-c1ab008c1960", "value": "384:686d6WQ06BLrLCNyKef2q+XfdJqDRFXnXGXYRcNMJ:686kWT6xDV2qeu1FX2oRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618317890, "uuid": "c5a1ecfd-f560-4c9f-a6fb-f6c4dc6ff57a", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618317890, "uuid": "099db78d-4397-4a44-8e69-07fbf440b1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618317890, "uuid": "b5c758c7-0a5e-48cf-a069-a259f176d8e9", "value": "SecuriteInfo.com.Trojan.DownLoader38.30149.2715.27256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95770c8-9c96-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618345780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618345780, "uuid": "74eb4947-a3db-414e-9bfa-f47460900f86", "comment": "Malware payload (AgentTesla)", "value": "3534cff2da4426a7b51d85b1296f0490", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618345780, "uuid": "b1dde9d2-d10a-423e-a8dd-5647f2999bc9", "comment": "Malware payload (AgentTesla)", "value": "e010bf9f74b274d6370a889265f97093b84662809605c0a862e36733c3d06be8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618345780, "uuid": "509ff35d-baf6-4026-905c-585b88719473", "comment": "Malware payload (AgentTesla)", "value": "2b888570c5f7af0ea4691e341d9445fd9630eec4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618345780, "uuid": "1a1a0a63-4f35-49c7-83a2-f6f9f2fdd4fe", "comment": "Malware payload (AgentTesla)", "value": "aa888915e37460ce6baa6d34f4bdeeecfa4706f47e90c79321d45aae362bbebfc71871a3d4e2c21fe8f26441ce11b14d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618345780, "uuid": "89819955-6d7b-4cb5-b12d-fc2c75ec3bf3", "value": "380512AD3A86464FC07F48F506D0F8804335558DB250DF9C6EEAE3DA69B6FE129812C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618345780, "uuid": "e0c20cc3-94ae-42f8-a1e3-3354e3f6f619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618345780, "uuid": "c6f694d5-a96b-4ba6-8c6f-f5500c642cdb", "value": "24576:Da1XFhDlW38+FsvsojeINBWnaKjspxnbFc1Mlp:uwzsU1QB+a+s/nJc1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618345780, "uuid": "3d160e45-eb79-4d96-af77-297a2532e02f", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618345780, "uuid": "f7af32cc-092e-4a43-85f2-78d89fb26bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618345780, "uuid": "dad5e19d-42c1-4783-9f38-1156e9e68c70", "value": "Copy of Bank Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6db475-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618300339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300339, "uuid": "cf83c35b-b830-464e-960b-5126f472315f", "comment": "Malware payload (Formbook)", "value": "c36a3651ef04581af4045653f06112f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300339, "uuid": "a6c55373-d401-40d9-931e-2a09e4028e00", "comment": "Malware payload (Formbook)", "value": "e07b53897e282a020b5f62e4ae4b78b0517e7cf5797ceb7ecf8ef90a52fff6e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300339, "uuid": "14c1422e-de23-4894-aa13-5a2becabacea", "comment": "Malware payload (Formbook)", "value": "521bfd83035a776e20c1b36bb575511eb7244c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300339, "uuid": "4cfd32ed-0de8-4ef5-8a2c-610650790cb6", "comment": "Malware payload (Formbook)", "value": "fc570bc1f7b72f1107f66c8f16526ba36dfd7d0da4aefd867cf20e8687a7382f40fa866ebb67da32e50315e94edffacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300339, "uuid": "45f7bbbc-9954-430d-9ffb-c1a521f66c15", "value": "8BC4E0BF5329BF67E2BD19B98243674501F080C3B6C3E7D87CD051D956C2B8A4B523AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300339, "uuid": "8c2424a0-4beb-475a-917c-7a5786dd1eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300339, "uuid": "e14a90a6-0304-47d8-8abe-4b2b0f4d6f6a", "value": "12288:D/9QW9e575dFXCIIMPwMHCXPCwGB7D4/D1KHG4+F:BhAjdFXaMP9HzfBf4/DIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300339, "uuid": "0287dab1-6a75-49e6-809d-f220787bea55", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300339, "uuid": "52b52418-5c98-48fc-9160-cae0a763f282", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300339, "uuid": "8e68b96b-a0eb-47b1-b318-870532e1a998", "value": "c36a3651ef04581af4045653f06112f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbef3dae-9c15-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618290326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290326, "uuid": "e4a8fbe4-110f-4b1d-9a0a-9bb91c6a624d", "comment": "Malware payload (AsyncRAT)", "value": "86989084f57609ac3ba1ad7985894288", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290326, "uuid": "5f0472bd-550f-4f44-9abc-cc80143d750d", "comment": "Malware payload (AsyncRAT)", "value": "e0fc6a4a632bef1c79b0201bbc8b8a3c807f64852c397d1180fcaefc6f6003c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290326, "uuid": "3bff600d-4384-4045-b04f-574aa148dbc9", "comment": "Malware payload (AsyncRAT)", "value": "efea765ceb29c310c31cb11fbb5287dff4b5e4a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618290326, "uuid": "73de6714-5cf3-4b50-943b-abe703f9b682", "comment": "Malware payload (AsyncRAT)", "value": "183869bf15eb2adb027ca7bcc38b3fec9accd3c6361277c9dbeeee40a1c7eac5a7246dc1c78fc5332db8537b4e012762", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290326, "uuid": "fe5f4b54-7236-4773-878d-ea2960bd01dd", "value": "4554D5D56190EEF2D84DA27C1BF1E4A242362FB65F13CA11E84EB2B1037C3BE4579952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290326, "uuid": "072cf91a-afb9-497c-b344-9d9798c56d84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290326, "uuid": "08c4ec83-f36b-49c6-8136-627d6ac575b2", "value": "6144:7qpJ/jRjqzrAUtbb3OIEODcpetIjLye/+XfCg:7EJ7kzcUlrOXYcpewzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618290326, "uuid": "fd1ce433-a802-4b2c-8509-3197fb878aff", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618290326, "uuid": "1ce8a02c-892f-4d45-bc6c-d45ab4be0415", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618290326, "uuid": "53136169-5630-4148-ab47-c5b54fab849a", "value": "P0000RFQ2004894980404.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3083d07-9c1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618294525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294525, "uuid": "08f05adb-04e3-4019-9257-50515df7f161", "comment": "Malware payload (AgentTesla)", "value": "afd69ce4b356c8f4cdb3aee44a712d26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294525, "uuid": "814281d0-493e-4556-8053-e33495b60760", "comment": "Malware payload (AgentTesla)", "value": "e25fcb89147e0727dc09b73b88d47ae051e5ff20fde5589b8ace6ee1068c2cb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294525, "uuid": "86096d91-7530-4d25-9642-43848261e075", "comment": "Malware payload (AgentTesla)", "value": "0132baa6e00dbeb4e599099213c2314cfc076c9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618294525, "uuid": "b26c00cd-5a6b-41e7-bf22-0ce919ae3558", "comment": "Malware payload (AgentTesla)", "value": "942bc18eb007449339353519213d2c6b8955f9d5d35c18efe33630b0ae21a6020649d6440adfcd5c9af2b02e5031f194", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294525, "uuid": "b3bf6386-8942-460e-a586-c43139f9dff3", "value": "1CD4125931B0C216D8689EB98CDDDAE81376BC16DC43E79B38C0B38D3FB66184529F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294525, "uuid": "06532dcd-b900-45e8-906d-3b8e2d2a260c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294525, "uuid": "75f39d97-29ce-47f7-85cd-5ca48cab34f7", "value": "12288:H6zL+AE4MARJ2ocwi17L8ozlcEUs/BDowon8teR:HwSz4DJpY7Ltzl6s/lowon8te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618294525, "uuid": "b4ea9a6d-d846-4282-8997-1220501b19b8", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618294525, "uuid": "069396b3-6fe7-4e72-99eb-0a884ac46369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618294525, "uuid": "a592f19e-4e7c-4db1-984e-823728e442b5", "value": "MV. MCL - 21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56445513-9c4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618313724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313724, "uuid": "6517cdee-1c26-43ab-971a-a9b70af551c3", "comment": "Malware payload (Formbook)", "value": "3aa397bd5d4cbc4f1afe85c71aece963", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313724, "uuid": "67df2eb7-d9d1-4025-a28a-bd882985c0a6", "comment": "Malware payload (Formbook)", "value": "e8a4cc49b020857e24a8259bd7f5c444d83e7d8b025f9cee7794e368a9acb3bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313724, "uuid": "db17c041-6a43-49aa-afa7-c2d50f5debcf", "comment": "Malware payload (Formbook)", "value": "6c4521a6c23df5cc5f919f57a58bf28e3653e77d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313724, "uuid": "db5a3243-e10a-4930-aa9d-7365611ee706", "comment": "Malware payload (Formbook)", "value": "5c512a506a1d2cc5f33a1d14aa7da08c36163f84e888dae705fd68490cd751f11a561363c505d2180e93a7151ef48ab3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313724, "uuid": "c58c1113-4836-4b81-9e35-91a3005d545b", "value": "252423185258EDECEB585A7084BFB2AB72B5C40739254EF8035ED9EE8831081DD7AF47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313724, "uuid": "134d9240-df54-4d10-9d05-9e1cef593f88", "value": "6144:cN/pZvdpLGV99LpiqOJZ2l35wwaxqo5UjJx0IYI:cdHbLGf9LfOJgww8ze9YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618313724, "uuid": "dbd2b318-deb2-446d-9617-b2826e149917", "value": 215440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618313724, "uuid": "74fb3d68-9104-48ee-9b18-27d670dd0232", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313724, "uuid": "d3d6a5ca-39c2-46d3-9697-c9108d30d16f", "value": "CATALOG.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365abb39-9c4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618313241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313241, "uuid": "d67b0aeb-d78b-46c7-ad9e-dcdfa4a3c6b1", "comment": "Malware payload (GuLoader)", "value": "48f40ef461892c01632aefba21586f7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313241, "uuid": "751024d2-61dd-4df0-9ae4-3f3f75d4ae90", "comment": "Malware payload (GuLoader)", "value": "e8cce7b64fdf7d3e4d191671b45ee1014f2cbd68be4ea0afe36b1b4ce67e6136", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313241, "uuid": "46b3415f-6f02-4c46-a43e-84171f0bb670", "comment": "Malware payload (GuLoader)", "value": "83ce2d396252828acf345a7122ad39c6d43b9210", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618313241, "uuid": "2fe92423-a3ed-40c7-8676-302a45c5b715", "comment": "Malware payload (GuLoader)", "value": "b043d9caa9dccce4189e12cab787ab53d5711aa2595bbdef74ea961f8ec00efd3235788a2ec4ae3010f8b2b0b49ca81f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313241, "uuid": "0d702ea8-aba0-4e2a-8fa8-9813671d6e08", "value": "81D2E1D6B7EAA64183E74B133144F51F7F4027D6D97A62B6811B33C07643223841EEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313241, "uuid": "ad2c8220-2b63-4d65-8a20-419709abcdc9", "value": "768:LtpM7BBOGH4/lyBwr/h69wrGXNuCHxqfcbjKtP:LtKrd4/cwr5cwrGXNjHof9tP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618313241, "uuid": "9f996fae-6280-422b-b253-19ec14efa223", "value": 30503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618313241, "uuid": "b04b3f55-d772-4c32-87c6-91ba6561f6ef", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618313241, "uuid": "6c9b8778-a671-4ced-abfe-e4ffd245e284", "value": "documento de pedido 042021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93605975-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618292781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292781, "uuid": "257c03b3-6cd6-475e-80fe-ddee70313dd6", "comment": "Malware payload (Formbook)", "value": "8bb0642ff1a8ccce0e9e1692b461910a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292781, "uuid": "3cdd5dc8-39c5-4c92-88b1-c4f3d2423738", "comment": "Malware payload (Formbook)", "value": "e9a91b045168b7062b5108954ef57cf2929439b1de98e8a418ee6f0e76643d88", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292781, "uuid": "53df94fc-edc7-4976-b319-a5bc306c28b2", "comment": "Malware payload (Formbook)", "value": "694bc959a5ecbbe440b7725a1d9f73d133b33eb7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292781, "uuid": "9d614169-c10f-4be9-941c-432f676bbef2", "comment": "Malware payload (Formbook)", "value": "a8d0b302de31c2bd2b321cafb5c16cd2eb26a223d80726454b25b0f51bc4676c45439005d8ddd1a34096f6bb588f7cbb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292781, "uuid": "9cd84ce0-6d13-4fd4-8519-776bc13de040", "value": "87C5337969C7DB1BD2AFD8310D4EA11D10D89C202E952D90330EBFB8B63197526D2B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292781, "uuid": "0a54ae91-fb81-4949-a4cf-6213c1645cde", "value": "49152:yMJWwTfqNdOgntR0e9oDsZ7V3CnjXwoBJ2jaBmZA9xw/iWUhl8Qz:yMWNs2R0eWoZByXB2oxCi/hll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292781, "uuid": "71b4cddd-b9a0-4a95-9e9a-e5a58342e2cc", "value": 2541056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292781, "uuid": "4aeaefb8-f064-4f64-bd6d-695df14a947b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292781, "uuid": "6126d693-4b90-4033-a9ec-0b626dd307ae", "value": "swift note.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af8f8e9-9c24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618296606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296606, "uuid": "1f9ccbf7-3b3d-4bea-ae44-36349b81a6b6", "comment": "Malware payload (Formbook)", "value": "b2aac2b83d017472d778634b82166afe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296606, "uuid": "7bdbddab-d312-4a1b-b497-7f99ca98cfae", "comment": "Malware payload (Formbook)", "value": "eb0adb30cdcfbbaf49e107c6fb93b5546d408f48fd940d66c88e231bcd223c07", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296606, "uuid": "4682dca4-e08e-4230-aa7c-2a340d9df399", "comment": "Malware payload (Formbook)", "value": "eb565d7cb4a59ae19ee9b727723647e444ee9140", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296606, "uuid": "11b602c0-788e-4f06-8032-57fde6a106d4", "comment": "Malware payload (Formbook)", "value": "d60f7a9cf490ec8243e4bf24ba189f1f8a79031a9a8707dec38ed64994d37de50a3a85b8e32f18bbd1aa288c62127da5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296606, "uuid": "a2166745-0598-4f7b-acb3-a98f45584047", "value": "F8C4E0792788CF25D17ED3781530521543F1F24AC722D39DBEE411EE1AA2B818B27BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296606, "uuid": "fc16fd7c-bc4e-4c2d-a136-3643638a80c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296606, "uuid": "a4265cf6-972c-4d1e-af5b-2ce503880c67", "value": "12288:FKh3g8To3MZuA/ifafwQqVESYgALhXLy8/hBNrg8ocBrFK:9iFqVh+xLyYvg8oE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296606, "uuid": "4c9d826f-4fa9-468a-894d-1dbd5c2e8836", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296606, "uuid": "decbc731-6c94-4e73-b14a-7e4f2ffc6b62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296606, "uuid": "6f881a3c-abd3-4ec4-bbe3-cfebe4e8400a", "value": "PaymentBNK#2.PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02888993-9c2d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618300269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300269, "uuid": "77c8ea23-06b7-4efa-b4b2-f5abc7e0a129", "comment": "Malware payload", "value": "40cb6b76be39f40f5c70338e6f50688a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300269, "uuid": "7b7ed804-fb9d-4e08-97a8-0abe249edc6b", "comment": "Malware payload", "value": "eb202b65c0941537fd3dcc8d6eb09999212e9a8224f225b3a9a03681c54785d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300269, "uuid": "b7a441e9-4a62-445f-9366-555ab20a79b7", "comment": "Malware payload", "value": "cc893f7f28a69d408ad0dc8203da5f21fb409458", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618300269, "uuid": "07afd76e-e5af-4a54-99dd-1d6fdbb0d542", "comment": "Malware payload", "value": "1fb9da31e831aa8a52bcd24f32dbd058a6b7e256ae67993ceb00e008fda039bd2120435a938c9d30984887edf0530b36", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300269, "uuid": "97ba1fd7-3812-4532-8b10-551d4247890f", "value": "215633E5F2005977F9FBBEF526F3E41232258163DB015B5B895334322EA66A5FB1E200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300269, "uuid": "fdd3daa0-d5e1-41a9-9ddd-f5f55efb2859", "value": "98304:KK7nPZsYsadZjyEfMLw5fJGwVX23Z6yRnH5UlQVgLkyrMdVjBe6iqz2nC+J+:XNRDvfzyJ6Y5hIkyodVjriT9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618300269, "uuid": "796e2ea9-2ad9-4f70-a096-e65f0864f57c", "value": 6192576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618300269, "uuid": "0621e80c-09a5-4be4-a7db-42b8f91ceb21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618300269, "uuid": "3c227d08-2d59-465d-aa1d-21db17979d72", "value": "SecuriteInfo.com.Python.IRCBot.AA.13326.11959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956a2a89-9c67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1618325426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325426, "uuid": "0fed197b-9804-4ff5-95ac-2f43a23e9c90", "comment": "Malware payload (Hancitor)", "value": "d8d3b5f21c6c318b4b21d9ec3552b121", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325426, "uuid": "f2eed497-c4c7-4747-8f14-211d05231902", "comment": "Malware payload (Hancitor)", "value": "ebbf4d9db7ed40ad6af798ddf22120b8a18d903d5a8a88a830be88ccfa7f4994", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325426, "uuid": "cb37220e-be16-41fc-a804-be96aafcc906", "comment": "Malware payload (Hancitor)", "value": "18c6c12b997057d9947ff1f5412a5742aa21ae22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618325426, "uuid": "f9d59561-fa7a-4849-8e15-b346d9d1017f", "comment": "Malware payload (Hancitor)", "value": "7772de6b10107ebe6382265b43e4be4adbf001c0c61d56c6da79d70d70d30629c3171a6d9d7d32f110d589e523804ebd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325426, "uuid": "8a81cad3-7db8-4499-ae1a-7c0071648d05", "value": "38D47B023881C03AD4B315744E6ED5A645AEB8210B32A5EBB3DC2A3E5F755F17E32673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325426, "uuid": "00d304ae-a20d-4846-960c-64c0011e1a65", "value": "0659f693c48b767359151cccfed1ca5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325426, "uuid": "eb80b293-d1cb-4da2-ba36-5408c31e316c", "value": "12288:h+mnllr77vf6NdmjA3PzGE4zXSUEPf6r9F59Mu9kKceEo:cmnllrPf6NdmwPf6r7QKkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618325426, "uuid": "06217802-e65c-4e9d-b83b-1058066c9054", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618325426, "uuid": "1baa26ff-24dd-45be-9d97-37d19296c5d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618325426, "uuid": "3734432a-77aa-40c9-b161-705516554d2d", "value": "plumbus.rik.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6512b6-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618292694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292694, "uuid": "3e01c82b-bcb1-4e47-a17e-a548de56d3c0", "comment": "Malware payload (Loki)", "value": "f3a4ac316750587869f17defd11440e8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292694, "uuid": "89ba1e39-743b-4fb2-be44-744d98623474", "comment": "Malware payload (Loki)", "value": "ebcba9a758682adeafb825ba6bba961750cd023f55d069d4e3c17b951d0991d2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292694, "uuid": "53131ac7-64d9-4abd-874e-b5ad177353fc", "comment": "Malware payload (Loki)", "value": "9b14523017a0f9461e9efad1fcae2806c6b87161", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292694, "uuid": "3d4bb14f-ad0d-4ef1-b8c1-a41e32d98f1c", "comment": "Malware payload (Loki)", "value": "38eb7587bcd19876f3f4c9a255bb5a394ff729c32fe364bc26a69427c0bdb9d40eb5f980335a8bc35aea1f8e2b075abd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292694, "uuid": "acca1ea8-4b29-454f-aa50-766eaf7c5584", "value": "5BB533B0EAD54B83D5AF99F42B9EC614002EFC35EE114F03332A75963D375216ECA629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292694, "uuid": "6e0701d6-6117-4464-879c-90b0b0019bc9", "value": "49152:T28wCZjLC+nGlLMBva7rTH6pH9ZN0uiQZl/NEo9AG9P:TJwmnHGeBwX6pHB0uGoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292694, "uuid": "1cd742ce-ff2a-4886-8b43-436b3be1b3e1", "value": 2398208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292694, "uuid": "326c3373-dd46-4e81-805f-481780d6e398", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292694, "uuid": "7ac3d7f9-fc62-4c49-8b63-1c98a612174b", "value": "Shipping-Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be68d54f-9c30-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618301873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301873, "uuid": "dd53e1f5-b356-4e02-b099-a22409edbd86", "comment": "Malware payload (AgentTesla)", "value": "b87347166f407de0961f00cec0c6eb4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301873, "uuid": "c91f6daa-a992-4041-9159-e0ce9d57d97f", "comment": "Malware payload (AgentTesla)", "value": "ecc97de2ca2b66d84eac101021be281c26115c238a0bebcddfa5ded03a0ecdb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301873, "uuid": "0206a68e-3125-4a87-accc-0670f883d3c5", "comment": "Malware payload (AgentTesla)", "value": "f268a17fc1b6797e60c3144a5c767eafd99217fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301873, "uuid": "8c88997a-6f1e-438b-8710-a21b9e82e48f", "comment": "Malware payload (AgentTesla)", "value": "c2ed524b2c3c1ec21bdbd753413707d8be0508d82bc20edfd8350a09b44350b7592e31540e6711699d1575ced4089093", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301873, "uuid": "03dc2824-ca38-4ada-9124-7cd8de1dd015", "value": "55455BD97100B4DFC85BCDB2DD281C3065927DAE431AC20B905B365D6ABE343DE1E9AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301873, "uuid": "5a3aca00-f21f-4c5a-ad62-d99adc0b1093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301873, "uuid": "075e86e2-7d50-4530-860b-848552c120de", "value": "12288:YXsREJGSPTAWB1NCsfaEtxksZMe7Hml1X1w+zQLnOcp83k4MwkEhFSyoayeknMKR:YX4KAU1NxflxLZRi0LOCXEjPoeEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301873, "uuid": "786c14a0-1f1b-4fa6-a850-ea544fbbe93e", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301873, "uuid": "6fd3430f-106f-4c62-9c81-138a53942403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301873, "uuid": "5b670957-ce2c-4e08-bc5c-306553fc88a1", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7c2d96-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618292716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292716, "uuid": "c99a40b5-2aee-427f-98fa-1ac940b4ec88", "comment": "Malware payload", "value": "a949b10d9f3fe0538ed34f2ec5c73900", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292716, "uuid": "6f63a9d7-3c84-4e97-a7f9-b3e4b9aa076d", "comment": "Malware payload", "value": "ee4f639d7498fc65393c39aa90225798554fe217987d8c9fe38e5e8a1f0ed50c", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292716, "uuid": "890e85b8-08dd-41fe-947e-74cdcb6cc983", "comment": "Malware payload", "value": "1abaf4f9e754ef1cd0f856a26c1c08bef3ddb9b8", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292716, "uuid": "c82c9fd9-ac2f-4b2a-a3d7-88aff3920104", "comment": "Malware payload", "value": "17ca2a48bd06af28aa08b00e78fde651168ee3e36edb1357d02a2b1bcc788aa4fa2a890db6011a172274f27decf34ea4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292716, "uuid": "deb16e09-1055-430a-b59e-8ed0371d76bf", "value": "17B533107CCE3F69DA18B9FA10EB9B5581BCDC833F0198353B477A66F87B82046D165A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292716, "uuid": "9dab67c4-865d-484b-84ab-91d494ca98fe", "value": "49152:JKbAvHoGKqyqMpXWb9kpckqUDOx2w9GVPLuE6aPOtefijVu:88nyFpXG9kpXK2w0JOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292716, "uuid": "2515c578-86dc-47d4-97bf-35d69dcab960", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292716, "uuid": "2cf1cdbe-445c-46ce-81bd-cd3626e03f46", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292716, "uuid": "7d101773-8987-43ca-a051-ea62a90a3ea2", "value": "Original Invoice-COAU7229898130.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465d2ff1-9c02-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618281914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618281914, "uuid": "51aff9d9-b8b3-4aaa-824c-a881bdf86b94", "comment": "Malware payload (AgentTesla)", "value": "588d39b13803a8698c852d31b6ffc4e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618281914, "uuid": "87b6f7eb-7761-4412-bc17-4fe67a19d872", "comment": "Malware payload (AgentTesla)", "value": "efd4dbbcc8ae1e5f560cea0672a5a46388ae2863444cef2fd7a3bb188d1edaaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618281914, "uuid": "8b91f5b4-a9d5-4838-bc76-e3a2bec76d25", "comment": "Malware payload (AgentTesla)", "value": "d06ac6ea4ec86de87ca28dc386fd40e2207d1b62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618281914, "uuid": "7cc7a172-685c-49bc-952c-dfe0701f2883", "comment": "Malware payload (AgentTesla)", "value": "5e3df19382edf5781c03ef3d1fb45fbe0f4d12094b65d4cf502ab458bacea84af92f7eb069304ab4177734a3a427182a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618281914, "uuid": "387b9ecd-908d-4d00-8d6f-9e0b87a4a0e3", "value": "8CD42329DC964247770CE18E96564DF2DC4271B80B6B6DCE2CD094587C20E68FE71FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618281914, "uuid": "1b5842f3-cfb9-4565-b670-347eb18d8714", "value": "12288:3UjrYvwhtDhxK4n7DYF7wUEew8Um6ekqHTQYPu9JMuP04:3WrOwhtDDK4n7DYhTEe396ekquTT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618281914, "uuid": "13e1ab93-8782-40e7-a2c7-b7d0905eb948", "value": 624701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618281914, "uuid": "e65d373e-7112-4840-a428-8cfd1cbff927", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618281914, "uuid": "974a8fdf-4062-4510-a5aa-84200768614f", "value": "SOA 4-12-2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aff3976-9c57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618318322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318322, "uuid": "5e09579a-8d5e-4fe1-bab2-55f3682d522b", "comment": "Malware payload (Gozi)", "value": "cefc4dd7bf8bcf9a34ddaedee3462b67", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318322, "uuid": "abea8881-95e3-466b-93d8-dea47c0573a5", "comment": "Malware payload (Gozi)", "value": "f0545e28605332394dfb571a8de0c8252764150a87fbf49b108bf0eace139b37", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318322, "uuid": "94e64993-55f9-4799-8fc6-183ad6460f47", "comment": "Malware payload (Gozi)", "value": "b2c1eefde47cfe0d4a9ec66dc38c838272b3e948", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618318322, "uuid": "947ce0ed-2d64-4356-811a-778a9a63953b", "comment": "Malware payload (Gozi)", "value": "be00ec0c66375b2a7b4920037b1df51e08d73ac669ceba334434d072e53fc6512310f9297786d1a236bd22d13f59fd02", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318322, "uuid": "1f2b832b-df3e-45e1-abcd-5d7224ca4cb0", "value": "9FE49D1135C1C07AD5731A318E69D2E5059EBC220F3196CB73CA6B2F5BBA4D12E36B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318322, "uuid": "dde6e6c7-b75d-40ee-87df-94bfd221afc8", "value": "280f6bee6b47f33229400f9b2c1bb70e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318322, "uuid": "1de8c828-2946-430f-8d86-4e177855aae1", "value": "12288:wFdCFEURvc2mBAkB/tcB/gRzqPClvPMQimj6ylrOFqvz0xQLXPiCB:wFdChvc2mBAXEimj6ylaFqwa7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618318322, "uuid": "e0e09b3d-dd9e-442b-bd94-439f60257540", "value": 679425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618318322, "uuid": "bf72e128-723d-448f-b174-431fc229a6ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618318322, "uuid": "719ae5a7-7b17-41aa-b965-65bf699860fe", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94d7bcb-9c34-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618303636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303636, "uuid": "d0f58d92-c45c-453e-902b-36ec90db614b", "comment": "Malware payload (AgentTesla)", "value": "b834bb1ea10ec46c5fd96f24cb125d52", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303636, "uuid": "8f7e9976-8a4e-4d6f-b569-018ce328ba35", "comment": "Malware payload (AgentTesla)", "value": "f0823ac5b74a2f260479c25330c57cbc9a4e9a8ee6986c38e5ff59392a248b22", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303636, "uuid": "a6809748-d4af-4082-a00f-417c4569a97f", "comment": "Malware payload (AgentTesla)", "value": "940d7d1b3117d56de8066b1b493e7343a4ca8ed5", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618303636, "uuid": "04a7e89a-3752-4318-aeb4-cdf6e3686809", "comment": "Malware payload (AgentTesla)", "value": "1b6a350e2da53bbf93162d5a1c2a21481d7b2a77f5b6071b895f6e5d45b88edf243a2ed5882404ac5289390d8a375d56", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303636, "uuid": "4bb8a84d-f7bf-456c-baa8-2e230da27e45", "value": "FDB42380C6A6B128C08D96210C5E7A772E10ACC8D620B17555B0FF76B3FE7EDD169E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303636, "uuid": "47c19d44-8090-4697-a4b7-23539fe440aa", "value": "12288:OX+LMV59TI95hNLwX0m/RxnWBcrOJBqY7r1zdtEyYOLKJ1P:OXBH9TI7wX00/jr4P1fYKKJ1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618303636, "uuid": "e1e0ae95-ef23-42e2-8bdc-610506a47aa1", "value": 512739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618303636, "uuid": "d83b17c3-841f-4d32-9c51-0b570098420c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618303636, "uuid": "b87cb68a-6e74-4589-aff5-ecbac1e73322", "value": "PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467bcd8e-9c6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618326582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326582, "uuid": "f421e7e7-ba2f-44c8-b488-9f6e1f3349c5", "comment": "Malware payload", "value": "c16ad2cdcb6a4531fdde6e36b75a5556", "object_relation": "md5", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326582, "uuid": "f9ac7da4-2a76-442e-97b2-ba3d4b5f713a", "comment": "Malware payload", "value": "f0a40375c476f2b3fd3cb57d4598e91be334392e9ac640104724c46d714a500c", "object_relation": "sha256", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326582, "uuid": "0c008c22-2cba-4066-be3c-ae13266b800a", "comment": "Malware payload", "value": "c3af0c692bfd8757e9c2b06e7974193da4ad6593", "object_relation": "sha1", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618326582, "uuid": "ef5e5576-dbb9-471a-afc6-81826a6a25fe", "comment": "Malware payload", "value": "00a0d16b0aaa5e4ad112d81e7052e232c69538a0fd91ef58353e21b80d0853f18cbdc005bf34f1fdb258ce715f897af0", "object_relation": "sha3-384", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618326582, "uuid": "cbfde88f-64cd-4f63-a3d6-356e294f58e6", "value": "3283127A501D50F636CD3EB60FCC570AC7EAE36AA5A11FA273CC1FB44A019289855C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618326582, "uuid": "0af4b1be-168c-4c4b-8994-b873ce4f0e1c", "value": "1536:uEDbdGLKOWLQd7YmkCTkXP2bqVlBPzJwJHcf3d/VVK0hJMcPc7lM681R124ZbOIk:uGbAKOWL/mkvPxVrPz3f3dt46JMcESRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618326582, "uuid": "3e760697-e3ce-423e-9a07-eb74fadfa0fd", "value": 88202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618326582, "uuid": "25ec170e-04d5-4868-afd6-93770c5f48b1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618326582, "uuid": "04479ce4-4022-47f3-9300-b8b93f41438c", "value": "catalogue-96.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee93b2df-9c2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618299377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299377, "uuid": "e4878e0f-ab5c-4845-a8cf-7e20b545add8", "comment": "Malware payload (GuLoader)", "value": "151d732b9f85df31c367302c01d95ddd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299377, "uuid": "9aa14190-4105-4bd0-8250-4182f98ec0a6", "comment": "Malware payload (GuLoader)", "value": "f0d8c6ce081c68659bdc6c686b92fb95b3957a3b2acb1d13d96faf1e22fa597f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299377, "uuid": "b1fe22ff-ad12-479c-971a-f2f0406806a5", "comment": "Malware payload (GuLoader)", "value": "cc310356dfb1731e0ca612c51c68f3d331e15355", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618299377, "uuid": "58f01faf-f3b1-48fa-8d8b-d128fd4a5014", "comment": "Malware payload (GuLoader)", "value": "d03b9e236a94db600d10df5cf98d834620de6288458780d88dbd52baaef690884c1f3b817e4ce94b3b85ec2b2acc3a29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299377, "uuid": "0c9eb540-3984-44dd-885f-3244af0140ce", "value": "05934A1ABA90AE71E93947BD6A3543B8010B7C306D1C8A43E5C7331C3675ADACEA57C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299377, "uuid": "a6f209fd-c2e3-4a65-aa79-efb2cfc36e5e", "value": "281390d21b787569ccc2303fd6dad5ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299377, "uuid": "f5fbb647-6ff3-4b3d-b226-8d061d5ab76d", "value": "768:wMS/9ZOa7yFPOfyOCdOPIk4Pk9lNNwzZFVMyQUF5RanwyudmaSxvKVNXOOyV7iHH:M9ZO7Ofy9vkE3Gybr5yuovKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618299377, "uuid": "973ed796-0e33-4182-ada7-dbd0c7e3f1a0", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618299377, "uuid": "88f51b20-c7b0-4911-90fb-d65432b805dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618299377, "uuid": "2ac92443-dc93-4b66-9a0e-6559f42c1df3", "value": "BANKINV28032021VBNSINO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff53b7a2-9c39-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618305847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305847, "uuid": "a36bcb88-1f61-4ea8-93fe-7efd8b0c91ec", "comment": "Malware payload", "value": "3c9770f3a4da1ff3bc43e9d883332441", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305847, "uuid": "5b63dcd9-1d27-4ccb-a96b-99899674f586", "comment": "Malware payload", "value": "f2151588f65d2c67edef42954eab24f6812012fd88b8cf155e12c4b991c4a3fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305847, "uuid": "8ddf76a0-2178-45fd-a9fb-71f2a3fcd706", "comment": "Malware payload", "value": "1c58120f2c27e993ebbbad9cabd618d0e093d287", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618305847, "uuid": "34b7e894-5bc5-48cc-861d-bd45ebfe1566", "comment": "Malware payload", "value": "3c71cadf5d08f5e51e0037ea3fa31e233975807b434bdf6a0adddbe645f3724146325bd5fc5f76b474deb5cd8eb7b6ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618305847, "uuid": "7cd2eea9-4792-4f4c-9c98-b0f2383cf2c2", "value": "52A423611E49DDF15C120EAE804FE8542948EC01C582CB9D0BE64DBE5EAF998FC15EBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618305847, "uuid": "91df7fc0-eb16-4806-92b0-8f4af939e17d", "value": "12288:QvZZHZvvJQXgGkGa2Jxe3ohLlUuWdh+4UgpNywYBLYuBs8emhd:QvZhZxQXgXqceLl0Mx2QXBfBsUhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618305847, "uuid": "3bc02c4e-5971-4f39-bed1-958f7db22537", "value": 483476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618305847, "uuid": "4e23a491-9077-4786-ad40-02752bf695d5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618305847, "uuid": "6f825f97-56bb-44fd-98a7-3b9adaec6cf8", "value": "Purchase order PO1908516.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618da902-9c23-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618296133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296133, "uuid": "676f45d9-69fa-40f7-808f-ce653747c648", "comment": "Malware payload (AgentTesla)", "value": "80ebac6f20f1086d32c1780ac76f24bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296133, "uuid": "78111d67-a39a-4592-83d8-ae6e8889a083", "comment": "Malware payload (AgentTesla)", "value": "f2d48d18a5965b72e7868c2f58d7b32cf83225223fb1e528489c10a20db04358", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296133, "uuid": "f760844f-286e-4bb8-ba93-92cc5a8c3530", "comment": "Malware payload (AgentTesla)", "value": "32e8f48bfddc6bb5c559dbccfab15933f120cc8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296133, "uuid": "050cabd0-60ae-4310-9141-51e8fdcafdd8", "comment": "Malware payload (AgentTesla)", "value": "320d2c853272c7ef719b8e64888a38fc88715247f312d154fb97ebea8bf36644e5ad29ed23b5aaf42b31f89a1f2a8d80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296133, "uuid": "71280a18-1395-4189-984a-b5bdf86afebb", "value": "D705333E99F5B8C88D2C201E06150A2CC79329D2AB53A491F9DF5C493FDD722CB695E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296133, "uuid": "30cad360-506f-4ab5-9d34-d40f2bb21c78", "value": "12288:5ihlw3/pqEn/4GZkq1Gk8bnzesWSn/MEUGMhnGnmhYau3ai6a9GIauJ8PdLufFH:EYpz/euGjaS/olXJu3aieIXJ4dLufFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296133, "uuid": "999d2f03-db75-472e-9e2c-f55215af3fc9", "value": 818780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296133, "uuid": "0c42a0cc-055b-4e7d-9780-0fabe36a6185", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296133, "uuid": "7f685049-499b-4b30-ba17-346f75d4d6ef", "value": "REQUEST FOR PRICE QUOTATION.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd23e4e6-9c99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618347021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347021, "uuid": "c2f27671-4590-49d3-aab0-08d85a3c3ff0", "comment": "Malware payload (Loki)", "value": "17d478e0e01580f0f59b7181214303e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347021, "uuid": "b46dbc77-527f-4221-be07-68608280b4e3", "comment": "Malware payload (Loki)", "value": "f7c2e289b6099dee7d1601fc15303013f35d4b5bac17a90ed3bcb076d5b5d026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347021, "uuid": "d425c192-56ae-4edb-9d6e-a9ce25d6986e", "comment": "Malware payload (Loki)", "value": "7535e331f67c2b62ce14434ae2fa4bef83ad1f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618347021, "uuid": "4c222514-35f9-4d55-932b-132635cfcecf", "comment": "Malware payload (Loki)", "value": "a0f02c75e42347a4b2dee3fcb453aa48b351edfb59c8d86619eff1a3f8eab665f4df8dadc6d31ad6ebf902e388f84656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347021, "uuid": "46d28e8e-2dcd-4588-ab4a-7020af0a6249", "value": "013518A933503ADFC827CE36C9685C14EBE0746B470FD203A45712EDAA5DAA7DF150E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347021, "uuid": "83604b54-484c-4bce-ae75-70ef8c064192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347021, "uuid": "a0cf16da-3880-4ba5-96f7-983eea2ff0ec", "value": "12288:u5ez6J04OBRTIbyhKt3iV2Qys9mAs22d8/MYWyvBC19jt5SIPWBEK9wNXUTRO6EV:weeJTWRhK522w/s/nyvBK9jt5SN9wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618347021, "uuid": "72a0dbef-eaff-4d43-ba20-a7f769c4f214", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618347021, "uuid": "cb570180-c72f-4ffa-a8d2-cca6feea4155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618347021, "uuid": "e00d47fa-1b6c-4a46-a15c-fa1263a5aff4", "value": "VT-154-21-KHI ( 14-4-2021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca08d51-9c23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618296340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296340, "uuid": "db2c6a6e-389b-4919-8856-901023a2e4e8", "comment": "Malware payload (Loki)", "value": "22a2d9c8b8e67c230d196726dd4de85a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296340, "uuid": "1cf7f4d1-a2ff-4451-836c-b6f1dd57ca12", "comment": "Malware payload (Loki)", "value": "faf16250056c3158d73ad15af969d5de9349f0076b80c56193a86d2fcbec5501", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296340, "uuid": "0458763d-b82c-4798-9a95-c5464a3f6d2a", "comment": "Malware payload (Loki)", "value": "ce14fbc195d4fdced778ab283598577ff260a753", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618296340, "uuid": "df52f71d-4073-4751-8ff1-add44b85a9a9", "comment": "Malware payload (Loki)", "value": "f002857a377537e62318b1b0ec5fab4d9831f4eca5d8b9e64441fc9aa7426896bf47903c7d7685004b27bc9f5a9a9e39", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296340, "uuid": "c0ee180b-2b48-422b-a656-05c1e39f94c3", "value": "73842300F293670DD17E81C0BDCEAA05167FF75E658B4A55AC80F6DB602E9E374632C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296340, "uuid": "66a20d40-5380-4308-a66c-1ce5a153abe1", "value": "6144:K8yFqMkGoXJjYBWP4/Y6ieaSxbIGKMTehTQwffDoIIGmlimCusSSTzyXANTB8:KIMcXGBWupbxIGv6hTQmf8pflPSTB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618296340, "uuid": "312c37fb-38f3-4592-9c43-096b17ea3190", "value": 398329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618296340, "uuid": "caa0d395-a8a9-456e-96ee-c00edde1858a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618296340, "uuid": "62c6acfe-6d10-41d5-9dc3-8db14276cfbb", "value": "7995441.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727f0ed0-9c19-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618291867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291867, "uuid": "c14bfcb8-12ca-4800-a21c-8fee944c735c", "comment": "Malware payload (Dridex)", "value": "38b75824d3dba0e92d48260468ba4609", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291867, "uuid": "f31f5130-7117-4b26-8ff1-a8c3bd62aa88", "comment": "Malware payload (Dridex)", "value": "fb3980d5c6bc616daaa12221221e38c74f098d28bd666fe9b2251758ff017d6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291867, "uuid": "d6615f48-2f38-4f83-ba04-248b55aac3f6", "comment": "Malware payload (Dridex)", "value": "abbf9426797c5e0bd37bb962e4d2d80fbc8128d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618291867, "uuid": "f33f333b-a134-4866-8316-f61ced3903f6", "comment": "Malware payload (Dridex)", "value": "16b64b295e56c3b7ee8d22e12d3a74deeff178a89236f5c83afb7635587c20f97f0f6fa409e032bd6ff44b11b3dd778b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291867, "uuid": "76afd1ff-df5f-4149-9c53-ad74f78171c3", "value": "3544124F63F0BD30C525C27BC28954EA3A620AE3C1D518EC3E8DF0697C59262DA1996F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291867, "uuid": "58040b18-502b-46cb-93fa-cd8021e9e6a7", "value": "6144:zJw1DpJ3B8IUT4vfKds26/dAYI+q3szKHa6LGo06+Rlsm:zJEFBtUT4XKyOQ0z6Om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618291867, "uuid": "cdc3a792-6bd4-4e79-be95-5471cb4dbca2", "value": 258298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618291867, "uuid": "237c9171-00d3-48a0-a7bb-acafdaf37692", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618291867, "uuid": "b658b195-4644-4071-a123-75f8016ba79f", "value": "Invoice 66829.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875eaf6f-9c1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618292761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292761, "uuid": "c21dd93f-f684-4545-b6c9-b4afb0b5da2a", "comment": "Malware payload (AgentTesla)", "value": "d36cd9d335cdb5a8c3cf4c80cff14182", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292761, "uuid": "2397c032-edc2-4e7a-9f0a-d01b26965bb1", "comment": "Malware payload (AgentTesla)", "value": "fbb62d968bdefed10ac329bd93420d9acd82434a2be2f654959071ac85307932", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292761, "uuid": "91977f50-e0ff-4aa5-9540-ad6af9364757", "comment": "Malware payload (AgentTesla)", "value": "3d488b42c620dd42a10178744c7046485fa800fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618292761, "uuid": "fec07cb4-0526-47fa-b31c-4c6eb8bd9bef", "comment": "Malware payload (AgentTesla)", "value": "b7487e1d5df2399b5cd4f1f7a9002af2d1a22bb6bb97ef2fbc01f01517037d218a328712eeac7c84d0cdf6032f9858e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292761, "uuid": "715c1ad8-53b7-41e5-9838-90c66d7c204b", "value": "0CE40282741056D9F86C4A71546B887506273CBE4CB2E8BF709EB36D47B3242463FB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292761, "uuid": "ced9766a-e025-4dd6-81cd-78b4be99d4a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292761, "uuid": "d08937c1-80c0-4d11-8f8c-f59697a4abfc", "value": "12288:piS7tryJ2ocwi17L8ozlcEUs/BDowon8bfDv+CXo0kyt:pz7t2JpY7Ltzl6s/lowon82Ao0kyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618292761, "uuid": "33c5cbb2-7ae5-4522-b992-a06dd3beb0d0", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618292761, "uuid": "d4ccccd6-7b01-4609-bacb-0f93fd2b49ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618292761, "uuid": "a09f0053-70f5-4648-80df-b5685b66865d", "value": "MV. WINTER SUMMER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18333658-9c2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618301164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301164, "uuid": "eaa0c395-4836-44b7-8bdc-0900dc4a8e3a", "comment": "Malware payload (Loki)", "value": "53af710fcff7b184f8ac68eb1fd2af38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301164, "uuid": "46e49d04-d53c-4360-9e18-d7706e9e3785", "comment": "Malware payload (Loki)", "value": "fd578808fbbd44d564598d6c46f512b9511531402f720afc67bcbf6d4d42f59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301164, "uuid": "86b6a359-4973-4186-82ea-e0f953f59934", "comment": "Malware payload (Loki)", "value": "f880751eae816cd341b2cbc9723a9ed5daa50cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618301164, "uuid": "87dc4acd-0af6-42d8-bec8-f5de95d80826", "comment": "Malware payload (Loki)", "value": "5c5b85a864a4cc89ed5577044660259978108f68a4bddad682f3c5a08ea4ce13c72545dc616d9924e33e356c267d9200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301164, "uuid": "49ecc60b-096f-47bb-87f3-6cc53e2f3671", "value": "B0C4E0693798CF39D17ED3791131120503F1F10AE722D65CBEE850DE5EA2B858B267A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301164, "uuid": "16abae0a-aa97-41e9-ae4f-ed4622d4fbf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301164, "uuid": "6d8a5313-4cb1-4c2b-b127-a592d248a97a", "value": "12288:FLYbg8To3qZcA/WA4Od6r9T/9I4POB28M1oJJkZ20V0uTQFeHOsWLEK:Nyd+T/9I4POB2bzQFeuswL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618301164, "uuid": "86311996-0b3c-4f1d-8fd1-2d210557359e", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618301164, "uuid": "d1445a4e-b14f-4fc2-8b2f-6835e05941fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618301164, "uuid": "d3299e4a-8d14-4a30-80bf-0e1ac6d014e6", "value": "53af710fcff7b184f8ac68eb1fd2af38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd00d24-9c28-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618298251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298251, "uuid": "588fade3-1cd7-42ec-aa6a-ed1f879824a5", "comment": "Malware payload (AgentTesla)", "value": "07bb95126c9abbdd2511aaf17d22280b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298251, "uuid": "c9215c18-bee4-4eff-a83d-3debd7e980a4", "comment": "Malware payload (AgentTesla)", "value": "fe6f3bf6e1e7dd2aee0ed41bba93ac380f3f355831e70b39cf7e18663ff0618a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298251, "uuid": "8ca1d19b-b7eb-463f-92a8-f5097add4202", "comment": "Malware payload (AgentTesla)", "value": "6538719a04cb2bcf252690c341f98a42a77ae942", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618298251, "uuid": "4d2a1b1e-4da6-4ea0-9a3e-7eb30a15a8a9", "comment": "Malware payload (AgentTesla)", "value": "182914fd1dca9cf222a0d5601580bd858def6edf20825e972e7bdfd2263b2b68292001587d3b05f12ea9fea18dd75180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298251, "uuid": "dc97a171-dec5-4e5f-8e80-32a2a5c3287d", "value": "64F423175CB386C57169E18DAC6303CF9DD4760BB64A3FA76C8B0368AE430089DB5DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298251, "uuid": "b1b1617e-2d55-4172-bee2-cbb6d4645178", "value": "12288:BmEdeutu0IZPLg0h5nLzc5Erfe9JF/vGngB9Cv5uitZ13FFYKHtY5NOa4uYy+DmP:BmceFpLg0h5nsEQJF/egB9Cvz7fFvHtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618298251, "uuid": "19541f80-52f6-4678-8030-ef0f5c7172de", "value": 752406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618298251, "uuid": "96e7edb6-b7a3-41a4-96f9-7b746c1fe4d1", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618298251, "uuid": "ae0075f3-4ca6-4646-bbac-5d66812a8b2f", "value": "Copy of Bank Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }